{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "8aae63e7-6918-4035-9617-92110e462324",
   "metadata": {},
   "source": [
    "### Description\n",
    "\n",
    "a simple jupyter notebook that helps Splunk Threat Research Team see the data connections, commonalities and differences of security content stories or threat families.This helps us to look for visualizing the common TTP’s and tooling used by adversaries or threat actors based on the Security content analytics we developed in each analytic story.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "78b65762-08c4-4100-bdd8-dcf162b09e73",
   "metadata": {},
   "outputs": [],
   "source": [
    "__author__ = \"Teoderick Contreras STRT\"\n",
    "import os\n",
    "import argparse\n",
    "from pathlib import Path\n",
    "import json\n",
    "import csv\n",
    "import yaml\n",
    "from collections import defaultdict\n",
    "import pandas as pd\n",
    "import numpy as np\n",
    "from IPython.display import display, HTML"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "1e73c539-8e4e-40be-973a-72d7d1f3a93e",
   "metadata": {},
   "outputs": [],
   "source": [
    "SECURITY_CONTENT_PATH = \"~/security_content/detections/\"\n",
    "sec_content_name_and_story = defaultdict(list)\n",
    "mitre_attack_id_info_dict = defaultdict(list)\n",
    "mitre_attack_tid_dict = defaultdict(list)\n",
    "mitre_attack_fn_dict = defaultdict(list)\n",
    "mitre_attack_story_dict = defaultdict(list)\n",
    "mitre_attack_tid_name_dict = defaultdict(list)\n",
    "home_path = Path.home()\n",
    "story_detection_list = []"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "bf35a8ba-2f3f-4983-85c8-e7a1ba4c3802",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def display_side_by_side(dfs:list, captions:list):\n",
    "    \"\"\"Display tables side by side to save vertical space\n",
    "    Input:\n",
    "        dfs: list of pandas.DataFrame\n",
    "        captions: list of table captions\n",
    "    \"\"\"\n",
    "    output = \"\"\n",
    "    combined = dict(zip(captions, dfs))\n",
    "    for caption, df in combined.items():\n",
    "        output += df.style.set_table_attributes(\"style='display:inline'\").set_caption(caption)._repr_html_()\n",
    "        output += \"\\xa0\\xa0\\xa0\"\n",
    "    display(HTML(output))\n",
    "\n",
    "def expand_path(file_path):\n",
    "    if \"~\" in file_path:\n",
    "        return str(file_path).replace(\"~\", str(home_path))\n",
    "    else:\n",
    "        return file_path\n",
    "\n",
    "def generate_name_and_story_dict(sec_content_path, story):\n",
    "    \n",
    "    for roots, dirs, files in os.walk(sec_content_path):\n",
    "        temp_file_name = \"\"\n",
    "        #print(\"[+] enumerating yml files in: {0}\".format(roots))\n",
    "        detection_base_dir_name = os.path.basename(roots)\n",
    "        \n",
    "        for f in files:\n",
    "            temp_file_name = os.path.join(detection_base_dir_name, f)\n",
    "            file_path = os.path.join(roots, f)\n",
    "            if file_path.endswith(\".yml\"):\n",
    "                parse_yml_file(file_path, temp_file_name, story)\n",
    "    print(\"[+] total detection found: {0}\".format(len(story_detection_list)))\n",
    "    return\n",
    "    \n",
    "def parse_yml_file(file_path, base_file_name, story):\n",
    "    file_name = os.path.basename(base_file_name)\n",
    "    mitre_tid = \"\"\n",
    "    tid_json_obj = load_attack_id_json()\n",
    "    with open(file_path, \"r\") as f:\n",
    "        yml_buff = yaml.safe_load(f)\n",
    "    \n",
    "    for s in story:\n",
    "        s = s.strip()\n",
    "        if s in yml_buff['tags']['analytic_story']:\n",
    "\n",
    "            sec_content_name_and_story[s].append(file_name)\n",
    "            print(\"       [{0}] : {1}\".format(s, base_file_name))\n",
    "            story_detection_list.append(base_file_name)\n",
    "            #f_name = \"-\".join(yml_buff['tags'][\"mitre_attack_id\"]) + \":\" + file_name \n",
    "            f_name = file_name\n",
    "\n",
    "\n",
    "            mitre_attack_id_info_dict[f_name].append(s)\n",
    "            for m in yml_buff['tags'][\"mitre_attack_id\"]:\n",
    "\n",
    "                mitre_attack_tid_dict[m].append(s)\n",
    "                mitre_attack_tid_dict[m] = sorted(list(set(mitre_attack_tid_dict[m])))\n",
    "                \n",
    "                mitre_attack_fn_dict[m].append(s + \":\" +file_name)\n",
    "                mitre_attack_fn_dict[m] = sorted(list(set(mitre_attack_fn_dict[m])))\n",
    "                \n",
    "\n",
    "                mitre_attack_story_dict[s].append(m)\n",
    "                mitre_attack_story_dict[s] = sorted(list(set(mitre_attack_story_dict[s])))\n",
    "                \n",
    "                new_key = m + \"-\" + tid_json_obj[m].replace(\" \", \"_\")\n",
    "                mitre_attack_tid_name_dict[new_key].append(s)\n",
    "                mitre_attack_tid_name_dict[new_key] = sorted(list(set(mitre_attack_tid_name_dict[new_key])))\n",
    "            #logger.info(self.mitre_attack_id_info_dict[file_name])\n",
    "            #for mitre_tid in yml_buff['tags']['mitre_attack_id']:\n",
    "            #    self.mitre_attack_tid_dict[mitre_tid].append(s)\n",
    "        \n",
    "    return\n",
    "\n",
    "def load_attack_id_json():\n",
    "    template_path = os.path.join(os.getcwd(), \"templates\")\n",
    "    tid_json_path = os.path.join(template_path, \"tid.json\")\n",
    "    with open(tid_json_path, \"r\") as f:\n",
    "        tid_json_obj = json.load(f)\n",
    "    return tid_json_obj\n",
    "\n",
    "def process_sec_content(story_list):\n",
    "        debug = 0\n",
    "        print(\" [+] story coverage needed: {0}\".format(story_list))\n",
    "        normalized_security_content_path = expand_path(SECURITY_CONTENT_PATH)\n",
    "        generate_name_and_story_dict(normalized_security_content_path, story_list)\n",
    "        if debug == 1:\n",
    "            print(\"\\n-----------------------------\\n[-] detection name vs analytic story - mitre_attack_id_info_dict \\n-----------------------------\\n\")\n",
    "            for k, v in mitre_attack_id_info_dict.items():\n",
    "                print(\"[{0}] detection name: {1} related story: {2}\".format(len(v), k, v))    \n",
    "            print(\"\\n-----------------------------\\n[-] mitre attack id vs analytic story - mitre_attack_tid_dict \\n-----------------------------\\n\")\n",
    "            for k, v in mitre_attack_tid_dict.items():\n",
    "                print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v))))\n",
    "            print(\"\\n-----------------------------\\n[-] mitre attack id vs story:detectioname - mitre_attack_fn_dict \\n-----------------------------\\n\")\n",
    "            for k, v in mitre_attack_fn_dict.items():\n",
    "                print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v)))) \n",
    "            print(\"\\n-----------------------------\\n[-] story vs id - mitre_attack_story_dict \\n-----------------------------\\n\")\n",
    "            for k, v in mitre_attack_story_dict.items():\n",
    "                print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v)))) \n",
    "                \n",
    "def highlight_cells_5(val):\n",
    "    color= \"\"\n",
    "    for k ,v in mitre_attack_tid_dict.items():\n",
    "        if val == k and len(v) == 5:\n",
    "            color = 'yellow'\n",
    "            return 'background-color: {}'.format(color)\n",
    "\n",
    "def highlight_cells_4(val):\n",
    "    color= \"\"\n",
    "    for k ,v in mitre_attack_tid_dict.items():\n",
    "        if val == k and len(v) == 4:\n",
    "            color = 'orange'\n",
    "            return 'background-color: {}'.format(color)\n",
    "        \n",
    "def highlight_cells_3(val):\n",
    "    color= \"\"\n",
    "    for k ,v in mitre_attack_tid_dict.items():\n",
    "        if val == k and len(v) == 3:\n",
    "            color = 'lightgreen'\n",
    "            return 'background-color: {}'.format(color)\n",
    "\n",
    "def highlight_cells_2(val):\n",
    "    color= \"\"\n",
    "    for k ,v in mitre_attack_tid_dict.items():\n",
    "        if val == k and len(v) == 2:\n",
    "            color = 'lightblue'\n",
    "            return 'background-color: {}'.format(color)\n",
    "\n",
    "def highlight_cells_1(val):\n",
    "    color= \"\"\n",
    "    for k ,v in mitre_attack_tid_dict.items():\n",
    "        if val == k and len(v) == 1:\n",
    "            color = 'lightgray'\n",
    "            return 'background-color: {}'.format(color)\n",
    "\n",
    "def summary_table_of_id(dict_name, det_len): \n",
    "    temp_dict = {}  \n",
    "    for k, v in dict_name.items():\n",
    "        if len(v) == det_len:\n",
    "           temp_dict[k] = v \n",
    "    return temp_dict\n",
    "\n",
    "def detection_list_by_count(det_table_dict): \n",
    "    detection_count_by_id = {}\n",
    "    for k, det_dict in det_table_dict.items():\n",
    "        t = {}\n",
    "        for s_, d in det_dict.items():\n",
    "            t[s_] = \"(\" + str(len(d)) + \")-detection count\"\n",
    "        detection_count_by_id[k] = t    \n",
    "    return pd.DataFrame.from_dict(detection_count_by_id, orient='index')\n",
    "\n",
    "def detection_list_by_id(temp_dict): \n",
    "    det_table_dict = {}\n",
    "    for k, v in temp_dict.items():\n",
    "        temp_d = defaultdict(list)\n",
    "        for fn in mitre_attack_fn_dict[k]:\n",
    "            s_,d = fn.split(\":\")\n",
    "            temp_d[s_].append(d)\n",
    "        det_table_dict[k] = temp_d\n",
    "    \n",
    "    return det_table_dict\n",
    "\n",
    "\n",
    "def highlight_cells(val):\n",
    "    color= \"\"\n",
    "    for k ,v in mitre_attack_tid_dict.items():\n",
    "        if val == k and len(v) == 5:\n",
    "            color = 'yellow'\n",
    "            return 'background-color: {}'.format(color)\n",
    "        elif val == k and len(v) == 4:\n",
    "            color = 'orange'\n",
    "            return 'background-color: {}'.format(color)\n",
    "        elif val == k and len(v) == 3:\n",
    "            color = 'lightgreen'\n",
    "            return 'background-color: {}'.format(color)\n",
    "        elif val == k and len(v) == 2:\n",
    "            color = 'lightblue'\n",
    "            return 'background-color: {}'.format(color)\n",
    "        elif val == k and len(v) == 1:\n",
    "            color = 'lightgray' \n",
    "            return 'background-color: {}'.format(color)\n",
    "\n",
    "def highlight_legend(val):\n",
    "    color= \"\"\n",
    "    if val == \"yellow\":\n",
    "        color = 'yellow'\n",
    "        return 'background-color: {}'.format(color)\n",
    "    elif val == 'orange':\n",
    "        color = 'orange'\n",
    "        return 'background-color: {}'.format(color)\n",
    "    elif val == 'lightgreen':\n",
    "        color = 'lightgreen'\n",
    "        return 'background-color: {}'.format(color)\n",
    "    elif val == 'lightblue':\n",
    "        color = 'lightblue'\n",
    "        return 'background-color: {}'.format(color)\n",
    "    elif val == \"lightgray\":\n",
    "        color = 'lightgray' \n",
    "        return 'background-color: {}'.format(color)\n",
    "\n",
    "def highlight_nan(val):\n",
    "    color= \"\"\n",
    "    if val == \"NaN\":\n",
    "        color = 'black'\n",
    "        return 'background-color: {}'.format(color)\n",
    "    \n",
    "def show_legend():\n",
    "    color_dict = {\"5 malware coverage\":\"yellow\", \"4 malware coverage\":\"orange\", \"3 malware coverage\":\"lightgreen\", \"2 malware coverage\":\"lightblue\", \"1 malware coverage\":\"lightgray\"}\n",
    "    cf = pd.DataFrame.from_dict(color_dict, orient='index')\n",
    "    \n",
    "    return cf.style.applymap(highlight_legend)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "293bd920-aeac-405e-8a4a-4291fe6abbbe",
   "metadata": {},
   "outputs": [],
   "source": [
    "def main():\n",
    "    \n",
    "    pd.options.display.max_colwidth = 1000\n",
    "    pd.set_option('display.max_rows', 500)\n",
    "    story_list = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]\n",
    "    process_sec_content(story_list)\n",
    "    \n",
    "    return"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "74a4cf30-31a9-4cb1-9a26-a4f88cdc5605",
   "metadata": {},
   "source": [
    "### Scan Detections\n",
    "Scanning Splunk Security Content Analytic Detections related to the 5 CISA Malware family that STRT worked on."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "926af3fd-3b64-4d3f-8bb7-f839e5aaf45a",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " [+] story coverage needed: ['Qakbot', 'Azorult', 'Remcos', 'Trickbot', 'AgentTesla']\n",
      "       [Remcos] : endpoint/powershell_windows_defender_exclusion_commands.yml\n",
      "       [AgentTesla] : endpoint/powershell_windows_defender_exclusion_commands.yml\n",
      "       [Remcos] : endpoint/vbscript_execution_using_wscript_app.yml\n",
      "       [Azorult] : endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n",
      "       [Azorult] : endpoint/excessive_attempt_to_disable_services.yml\n",
      "       [Qakbot] : endpoint/windows_process_injection_remote_thread.yml\n",
      "       [Azorult] : endpoint/windows_remote_access_software_rms_registry.yml\n",
      "       [Azorult] : endpoint/windows_remote_services_allow_remote_assistance.yml\n",
      "       [Qakbot] : endpoint/system_user_discovery_with_whoami.yml\n",
      "       [Trickbot] : endpoint/wermgr_process_create_executable_file.yml\n",
      "       [Qakbot] : endpoint/windows_iso_lnk_file_creation.yml\n",
      "       [Azorult] : endpoint/windows_iso_lnk_file_creation.yml\n",
      "       [Remcos] : endpoint/windows_iso_lnk_file_creation.yml\n",
      "       [AgentTesla] : endpoint/windows_iso_lnk_file_creation.yml\n",
      "       [Qakbot] : endpoint/windows_system_discovery_using_qwinsta.yml\n",
      "       [Azorult] : endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n",
      "       [Qakbot] : endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n",
      "       [Trickbot] : endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n",
      "       [Remcos] : endpoint/remcos_rat_file_creation_in_remcos_folder.yml\n",
      "       [Azorult] : endpoint/hide_user_account_from_sign_in_screen.yml\n",
      "       [Trickbot] : endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n",
      "       [Azorult] : endpoint/processes_launching_netsh.yml\n",
      "       [Azorult] : endpoint/icacls_deny_command.yml\n",
      "       [Remcos] : endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n",
      "       [Azorult] : endpoint/excessive_usage_of_taskkill.yml\n",
      "       [AgentTesla] : endpoint/excessive_usage_of_taskkill.yml\n",
      "       [Azorult] : endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n",
      "       [Azorult] : endpoint/allow_operation_with_consent_admin.yml\n",
      "       [Remcos] : endpoint/suspicious_wav_file_in_appdata_folder.yml\n",
      "       [Azorult] : endpoint/windows_remote_services_rdp_enable.yml\n",
      "       [Qakbot] : endpoint/network_connection_discovery_netstat.yml\n",
      "       [AgentTesla] : endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml\n",
      "       [Azorult] : endpoint/windows_modify_registry_regedit_silent_reg_import.yml\n",
      "       [Qakbot] : endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n",
      "       [Qakbot] : endpoint/windows_wmi_process_call_create.yml\n",
      "       [Qakbot] : endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n",
      "       [Remcos] : endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n",
      "       [Qakbot] : endpoint/windows_masquerading_explorer_as_child_process.yml\n",
      "       [Qakbot] : endpoint/schtasks_run_task_on_demand.yml\n",
      "       [Qakbot] : endpoint/network_connection_discovery_arp.yml\n",
      "       [Qakbot] : endpoint/create_remote_thread_in_shell_application.yml\n",
      "       [Azorult] : endpoint/disable_windows_behavior_monitoring.yml\n",
      "       [Azorult] : endpoint/excessive_usage_of_cacls_app.yml\n",
      "       [Remcos] : endpoint/loading_of_dynwrapx_module.yml\n",
      "       [Remcos] : endpoint/possible_browser_pass_view_parameter.yml\n",
      "       [Qakbot] : endpoint/network_discovery_using_route_windows_app.yml\n",
      "       [Trickbot] : endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n",
      "       [Qakbot] : endpoint/malicious_powershell_process___encoded_command.yml\n",
      "       [AgentTesla] : endpoint/windows_drivers_loaded_by_signature.yml\n",
      "       [Qakbot] : endpoint/suspicious_regsvr32_register_suspicious_path.yml\n",
      "       [Qakbot] : endpoint/recon_avproduct_through_pwh_or_wmi.yml\n",
      "       [Azorult] : endpoint/suspicious_scheduled_task_from_public_directory.yml\n",
      "       [AgentTesla] : endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n",
      "       [Remcos] : endpoint/remcos_client_registry_install_entry.yml\n",
      "       [Qakbot] : endpoint/windows_dll_side_loading_in_calc.yml\n",
      "       [Qakbot] : endpoint/office_product_spawn_cmd_process.yml\n",
      "       [Azorult] : endpoint/office_product_spawn_cmd_process.yml\n",
      "       [Remcos] : endpoint/office_product_spawn_cmd_process.yml\n",
      "       [Trickbot] : endpoint/office_product_spawn_cmd_process.yml\n",
      "       [AgentTesla] : endpoint/office_product_spawn_cmd_process.yml\n",
      "       [Trickbot] : endpoint/cobalt_strike_named_pipes.yml\n",
      "       [Remcos] : endpoint/suspicious_image_creation_in_appdata_folder.yml\n",
      "       [Azorult] : endpoint/create_local_admin_accounts_using_net_exe.yml\n",
      "       [Qakbot] : endpoint/disable_defender_spynet_reporting.yml\n",
      "       [Azorult] : endpoint/disable_defender_spynet_reporting.yml\n",
      "       [Remcos] : endpoint/office_product_spawning_windows_script_host.yml\n",
      "       [Remcos] : endpoint/process_deleting_its_process_file_path.yml\n",
      "       [Qakbot] : endpoint/cmd_carry_out_string_command_parameter.yml\n",
      "       [Azorult] : endpoint/cmd_carry_out_string_command_parameter.yml\n",
      "       [Trickbot] : endpoint/office_application_spawn_rundll32_process.yml\n",
      "       [AgentTesla] : endpoint/office_application_spawn_rundll32_process.yml\n",
      "       [Azorult] : endpoint/excessive_usage_of_net_app.yml\n",
      "       [Azorult] : endpoint/disabling_remote_user_account_control.yml\n",
      "       [Remcos] : endpoint/disabling_remote_user_account_control.yml\n",
      "       [AgentTesla] : endpoint/disabling_remote_user_account_control.yml\n",
      "       [Qakbot] : endpoint/windows_command_shell_fetch_env_variables.yml\n",
      "       [Azorult] : endpoint/firewall_allowed_program_enable.yml\n",
      "       [Qakbot] : endpoint/recon_using_wmi_class.yml\n",
      "       [Qakbot] : endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml\n",
      "       [Qakbot] : endpoint/windows_system_discovery_using_ldap_nslookup.yml\n",
      "       [Qakbot] : endpoint/windows_service_created_with_suspicious_service_path.yml\n",
      "       [Trickbot] : endpoint/trickbot_named_pipe.yml\n",
      "       [Qakbot] : endpoint/system_processes_run_from_unexpected_locations.yml\n",
      "       [AgentTesla] : endpoint/suspicious_driver_loaded_path.yml\n",
      "       [Azorult] : endpoint/windows_disableantispyware_reg.yml\n",
      "       [Azorult] : endpoint/office_product_spawning_mshta.yml\n",
      "       [Azorult] : endpoint/network_connection_discovery_net.yml\n",
      "       [Qakbot] : endpoint/windows_process_injection_wermgr_child_process.yml\n",
      "       [Azorult] : endpoint/sc_exe_manipulating_windows_services.yml\n",
      "       [Qakbot] : endpoint/suspicious_process_file_path.yml\n",
      "       [Azorult] : endpoint/suspicious_process_file_path.yml\n",
      "       [Remcos] : endpoint/suspicious_process_file_path.yml\n",
      "       [Trickbot] : endpoint/suspicious_process_file_path.yml\n",
      "       [AgentTesla] : endpoint/suspicious_process_file_path.yml\n",
      "       [Qakbot] : endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml\n",
      "       [AgentTesla] : endpoint/windows_multi_hop_proxy_tor_website_query.yml\n",
      "       [Remcos] : endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n",
      "       [Azorult] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n",
      "       [Remcos] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n",
      "       [AgentTesla] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n",
      "       [Azorult] : endpoint/windows_service_stop_by_deletion.yml\n",
      "       [Trickbot] : endpoint/schedule_task_with_rundll32_command_trigger.yml\n",
      "       [Remcos] : endpoint/jscript_execution_using_cscript_app.yml\n",
      "       [Qakbot] : endpoint/services_exe_lolbas_execution_process_spawn.yml\n",
      "       [Azorult] : endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml\n",
      "       [Qakbot] : endpoint/windows_regsvr32_renamed_binary.yml\n",
      "       [Remcos] : endpoint/winhlp32_spawning_a_process.yml\n",
      "       [Azorult] : endpoint/attempt_to_stop_security_service.yml\n",
      "       [Trickbot] : endpoint/attempt_to_stop_security_service.yml\n",
      "       [Azorult] : endpoint/excessive_usage_of_sc_service_utility.yml\n",
      "       [Remcos] : endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n",
      "       [AgentTesla] : endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n",
      "       [Azorult] : endpoint/chcp_command_execution.yml\n",
      "       [Qakbot] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
      "       [Azorult] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
      "       [Trickbot] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
      "       [AgentTesla] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
      "       [Azorult] : endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml\n",
      "       [Trickbot] : endpoint/account_discovery_with_net_app.yml\n",
      "       [Trickbot] : endpoint/suspicious_rundll32_startw.yml\n",
      "       [Azorult] : endpoint/windows_modify_registry_disallow_windows_app.yml\n",
      "       [AgentTesla] : endpoint/detect_html_help_spawn_child_process.yml\n",
      "       [Qakbot] : endpoint/suspicious_copy_on_system32.yml\n",
      "       [Azorult] : endpoint/disable_defender_submit_samples_consent_feature.yml\n",
      "       [Azorult] : endpoint/windows_powershell_import_applocker_policy.yml\n",
      "       [Trickbot] : endpoint/executable_file_written_in_administrative_smb_share.yml\n",
      "       [Azorult] : endpoint/wmic_noninteractive_app_uninstallation.yml\n",
      "       [Qakbot] : endpoint/office_document_executing_macro_code.yml\n",
      "       [Azorult] : endpoint/office_document_executing_macro_code.yml\n",
      "       [Remcos] : endpoint/office_document_executing_macro_code.yml\n",
      "       [Trickbot] : endpoint/office_document_executing_macro_code.yml\n",
      "       [AgentTesla] : endpoint/office_document_executing_macro_code.yml\n",
      "       [Azorult] : endpoint/disable_show_hidden_files.yml\n",
      "       [Azorult] : endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n",
      "       [Azorult] : endpoint/windows_valid_account_with_never_expires_password.yml\n",
      "       [Qakbot] : endpoint/winevent_windows_task_scheduler_event_action_started.yml\n",
      "       [AgentTesla] : endpoint/windows_mail_protocol_in_non_common_process_path.yml\n",
      "       [Remcos] : endpoint/system_info_gathering_using_dxdiag_application.yml\n",
      "       [Remcos] : endpoint/process_writing_dynamicwrapperx.yml\n",
      "       [Qakbot] : endpoint/windows_process_injection_of_wermgr_to_known_browser.yml\n",
      "       [Remcos] : endpoint/add_or_set_windows_defender_exclusion.yml\n",
      "       [AgentTesla] : endpoint/add_or_set_windows_defender_exclusion.yml\n",
      "       [Trickbot] : endpoint/powershell_remote_thread_to_known_windows_process.yml\n",
      "       [Azorult] : endpoint/disable_defender_enhanced_notification.yml\n",
      "       [Azorult] : endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n",
      "       [Trickbot] : endpoint/office_product_spawning_certutil.yml\n",
      "       [AgentTesla] : endpoint/office_product_spawning_certutil.yml\n",
      "       [AgentTesla] : endpoint/office_application_drop_executable.yml\n",
      "       [Qakbot] : endpoint/process_creating_lnk_file_in_suspicious_location.yml\n",
      "       [Qakbot] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
      "       [Azorult] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
      "       [Remcos] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
      "       [Trickbot] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
      "       [AgentTesla] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
      "       [Azorult] : endpoint/windows_modify_registry_suppress_win_defender_notif.yml\n",
      "       [Qakbot] : endpoint/nltest_domain_trust_discovery.yml\n",
      "       [Qakbot] : endpoint/windows_modify_registry_qakbot_binary_data_registry.yml\n",
      "       [Qakbot] : endpoint/windows_defender_exclusion_registry_entry.yml\n",
      "       [Azorult] : endpoint/windows_defender_exclusion_registry_entry.yml\n",
      "       [Remcos] : endpoint/windows_defender_exclusion_registry_entry.yml\n",
      "       [Qakbot] : endpoint/office_application_spawn_regsvr32_process.yml\n",
      "       [Qakbot] : endpoint/windows_wmi_impersonate_token.yml\n",
      "       [Azorult] : endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml\n",
      "       [Azorult] : endpoint/windows_modify_registry_disable_windows_security_center_notif.yml\n",
      "       [Azorult] : endpoint/windows_modify_registry_disable_toast_notifications.yml\n",
      "       [Azorult] : endpoint/hiding_files_and_directories_with_attrib_exe.yml\n",
      "       [Remcos] : endpoint/wscript_or_cscript_suspicious_child_process.yml\n",
      "       [AgentTesla] : endpoint/powershell___connect_to_internet_with_hidden_window.yml\n",
      "       [Azorult] : endpoint/disable_defender_blockatfirstseen_feature.yml\n",
      "       [Qakbot] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
      "       [Azorult] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
      "       [Remcos] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
      "       [AgentTesla] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
      "       [Qakbot] : endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n",
      "       [Azorult] : endpoint/net_localgroup_discovery.yml\n",
      "       [Azorult] : endpoint/windows_modify_registry_disabling_wer_settings.yml\n",
      "       [Qakbot] : endpoint/windows_dll_side_loading_process_child_of_calc.yml\n",
      "       [Qakbot] : endpoint/registry_keys_used_for_persistence.yml\n",
      "       [Azorult] : endpoint/registry_keys_used_for_persistence.yml\n",
      "       [Remcos] : endpoint/registry_keys_used_for_persistence.yml\n",
      "       [Azorult] : endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n",
      "       [AgentTesla] : endpoint/windows_driver_load_non_standard_path.yml\n",
      "       [Qakbot] : endpoint/windows_schtasks_create_run_as_system.yml\n",
      "       [Remcos] : endpoint/malicious_inprocserver32_modification.yml\n",
      "[+] total detection found: 184\n"
     ]
    }
   ],
   "source": [
    "if __name__ == \"__main__\":\n",
    "    main()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "74eef86f-b203-447d-96e0-231744aa1c66",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Remcos</th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>T1036</td>\n",
       "      <td>T1014</td>\n",
       "      <td>T1021</td>\n",
       "      <td>T1016</td>\n",
       "      <td>T1021</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>T1055</td>\n",
       "      <td>T1036</td>\n",
       "      <td>T1021.001</td>\n",
       "      <td>T1016.001</td>\n",
       "      <td>T1021.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>T1055.001</td>\n",
       "      <td>T1053</td>\n",
       "      <td>T1036</td>\n",
       "      <td>T1027</td>\n",
       "      <td>T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>T1059</td>\n",
       "      <td>T1053.005</td>\n",
       "      <td>T1049</td>\n",
       "      <td>T1033</td>\n",
       "      <td>T1036</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>T1059.005</td>\n",
       "      <td>T1059</td>\n",
       "      <td>T1053</td>\n",
       "      <td>T1036</td>\n",
       "      <td>T1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>T1059.007</td>\n",
       "      <td>T1059.001</td>\n",
       "      <td>T1053.005</td>\n",
       "      <td>T1036.003</td>\n",
       "      <td>T1053.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>T1070</td>\n",
       "      <td>T1068</td>\n",
       "      <td>T1059</td>\n",
       "      <td>T1047</td>\n",
       "      <td>T1055</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>T1112</td>\n",
       "      <td>T1071</td>\n",
       "      <td>T1059.001</td>\n",
       "      <td>T1049</td>\n",
       "      <td>T1059</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>T1113</td>\n",
       "      <td>T1071.003</td>\n",
       "      <td>T1059.003</td>\n",
       "      <td>T1053</td>\n",
       "      <td>T1087</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>T1134</td>\n",
       "      <td>T1204</td>\n",
       "      <td>T1069</td>\n",
       "      <td>T1053.005</td>\n",
       "      <td>T1087.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>T1134.004</td>\n",
       "      <td>T1204.001</td>\n",
       "      <td>T1069.001</td>\n",
       "      <td>T1055</td>\n",
       "      <td>T1218</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>T1204</td>\n",
       "      <td>T1218</td>\n",
       "      <td>T1071</td>\n",
       "      <td>T1055.001</td>\n",
       "      <td>T1218.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>T1204.001</td>\n",
       "      <td>T1218.001</td>\n",
       "      <td>T1112</td>\n",
       "      <td>T1055.002</td>\n",
       "      <td>T1218.011</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>T1218</td>\n",
       "      <td>T1543</td>\n",
       "      <td>T1136</td>\n",
       "      <td>T1059</td>\n",
       "      <td>T1543</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>T1218.010</td>\n",
       "      <td>T1543.003</td>\n",
       "      <td>T1136.001</td>\n",
       "      <td>T1059.001</td>\n",
       "      <td>T1562</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>T1543</td>\n",
       "      <td>T1548</td>\n",
       "      <td>T1204</td>\n",
       "      <td>T1059.003</td>\n",
       "      <td>T1562.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>T1547</td>\n",
       "      <td>T1548.002</td>\n",
       "      <td>T1204.001</td>\n",
       "      <td>T1059.007</td>\n",
       "      <td>T1566</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>T1547.001</td>\n",
       "      <td>T1555</td>\n",
       "      <td>T1219</td>\n",
       "      <td>T1071</td>\n",
       "      <td>T1566.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>T1548</td>\n",
       "      <td>T1555.003</td>\n",
       "      <td>T1222</td>\n",
       "      <td>T1112</td>\n",
       "      <td>T1590</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>T1548.002</td>\n",
       "      <td>T1562</td>\n",
       "      <td>T1222.001</td>\n",
       "      <td>T1204</td>\n",
       "      <td>T1590.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>T1555</td>\n",
       "      <td>T1562.001</td>\n",
       "      <td>T1489</td>\n",
       "      <td>T1204.001</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>T1555.003</td>\n",
       "      <td>T1566</td>\n",
       "      <td>T1531</td>\n",
       "      <td>T1218</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>T1559.001</td>\n",
       "      <td>T1566.001</td>\n",
       "      <td>T1543</td>\n",
       "      <td>T1218.010</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>T1562</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1543.003</td>\n",
       "      <td>T1482</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>T1562.001</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1547</td>\n",
       "      <td>T1543</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>T1566</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1547.001</td>\n",
       "      <td>T1543.003</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>T1566.001</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1548</td>\n",
       "      <td>T1547</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>T1592</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1548.002</td>\n",
       "      <td>T1547.001</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1555</td>\n",
       "      <td>T1562</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1555.003</td>\n",
       "      <td>T1562.001</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1562</td>\n",
       "      <td>T1566</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>31</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1562.001</td>\n",
       "      <td>T1566.001</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>32</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1562.004</td>\n",
       "      <td>T1566.002</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>33</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1564</td>\n",
       "      <td>T1569</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>34</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1564.001</td>\n",
       "      <td>T1569.002</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>35</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1566</td>\n",
       "      <td>T1574</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>36</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1566.001</td>\n",
       "      <td>T1574.001</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>37</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1569</td>\n",
       "      <td>T1574.002</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>38</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1569.002</td>\n",
       "      <td>T1592</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>39</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1590</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>40</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>T1590.005</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       Remcos AgentTesla    Azorult     Qakbot   Trickbot\n",
       "0       T1036      T1014      T1021      T1016      T1021\n",
       "1       T1055      T1036  T1021.001  T1016.001  T1021.002\n",
       "2   T1055.001      T1053      T1036      T1027      T1027\n",
       "3       T1059  T1053.005      T1049      T1033      T1036\n",
       "4   T1059.005      T1059      T1053      T1036      T1053\n",
       "5   T1059.007  T1059.001  T1053.005  T1036.003  T1053.005\n",
       "6       T1070      T1068      T1059      T1047      T1055\n",
       "7       T1112      T1071  T1059.001      T1049      T1059\n",
       "8       T1113  T1071.003  T1059.003      T1053      T1087\n",
       "9       T1134      T1204      T1069  T1053.005  T1087.002\n",
       "10  T1134.004  T1204.001  T1069.001      T1055      T1218\n",
       "11      T1204      T1218      T1071  T1055.001  T1218.005\n",
       "12  T1204.001  T1218.001      T1112  T1055.002  T1218.011\n",
       "13      T1218      T1543      T1136      T1059      T1543\n",
       "14  T1218.010  T1543.003  T1136.001  T1059.001      T1562\n",
       "15      T1543      T1548      T1204  T1059.003  T1562.001\n",
       "16      T1547  T1548.002  T1204.001  T1059.007      T1566\n",
       "17  T1547.001      T1555      T1219      T1071  T1566.001\n",
       "18      T1548  T1555.003      T1222      T1112      T1590\n",
       "19  T1548.002      T1562  T1222.001      T1204  T1590.005\n",
       "20      T1555  T1562.001      T1489  T1204.001        NaN\n",
       "21  T1555.003      T1566      T1531      T1218        NaN\n",
       "22  T1559.001  T1566.001      T1543  T1218.010        NaN\n",
       "23      T1562        NaN  T1543.003      T1482        NaN\n",
       "24  T1562.001        NaN      T1547      T1543        NaN\n",
       "25      T1566        NaN  T1547.001  T1543.003        NaN\n",
       "26  T1566.001        NaN      T1548      T1547        NaN\n",
       "27      T1592        NaN  T1548.002  T1547.001        NaN\n",
       "28        NaN        NaN      T1555      T1562        NaN\n",
       "29        NaN        NaN  T1555.003  T1562.001        NaN\n",
       "30        NaN        NaN      T1562      T1566        NaN\n",
       "31        NaN        NaN  T1562.001  T1566.001        NaN\n",
       "32        NaN        NaN  T1562.004  T1566.002        NaN\n",
       "33        NaN        NaN      T1564      T1569        NaN\n",
       "34        NaN        NaN  T1564.001  T1569.002        NaN\n",
       "35        NaN        NaN      T1566      T1574        NaN\n",
       "36        NaN        NaN  T1566.001  T1574.001        NaN\n",
       "37        NaN        NaN      T1569  T1574.002        NaN\n",
       "38        NaN        NaN  T1569.002      T1592        NaN\n",
       "39        NaN        NaN      T1590        NaN        NaN\n",
       "40        NaN        NaN  T1590.005        NaN        NaN"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df = pd.DataFrame({ key:pd.Series(value) for key, value in mitre_attack_story_dict.items() })\n",
    "df = df.sort_values(by =[\"Remcos\", \"Azorult\", \"Qakbot\", \"Trickbot\", \"AgentTesla\"])\n",
    "df\n",
    "                "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e1325b00-3932-4ba3-92ad-25d9d382354b",
   "metadata": {
    "tags": []
   },
   "source": [
    "## Security Content mitre attack id Coverage for [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "2fb85a5d-d498-43c1-97a5-08da5c0f6c32",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_afed1_row0_col0 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_afed1_row1_col0 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_afed1_row2_col0 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_afed1_row3_col0 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_afed1_row4_col0 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_afed1\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_afed1_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_afed1_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
       "      <td id=\"T_afed1_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_afed1_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
       "      <td id=\"T_afed1_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_afed1_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
       "      <td id=\"T_afed1_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_afed1_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
       "      <td id=\"T_afed1_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_afed1_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
       "      <td id=\"T_afed1_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12bfedfa0>"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "show_legend()\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "0868588f-3ab0-4065-be94-b6632544a204",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_c2526_row0_col0, #T_c2526_row1_col1, #T_c2526_row2_col2, #T_c2526_row3_col0, #T_c2526_row3_col4, #T_c2526_row4_col1, #T_c2526_row4_col3, #T_c2526_row6_col2, #T_c2526_row7_col4, #T_c2526_row13_col1, #T_c2526_row13_col3, #T_c2526_row13_col4, #T_c2526_row14_col4, #T_c2526_row15_col0, #T_c2526_row15_col4, #T_c2526_row16_col4, #T_c2526_row17_col4, #T_c2526_row19_col1, #T_c2526_row20_col1, #T_c2526_row21_col1, #T_c2526_row22_col1, #T_c2526_row22_col2, #T_c2526_row23_col0, #T_c2526_row24_col0, #T_c2526_row24_col3, #T_c2526_row25_col0, #T_c2526_row26_col0, #T_c2526_row28_col3, #T_c2526_row29_col3, #T_c2526_row30_col2, #T_c2526_row30_col3, #T_c2526_row31_col2, #T_c2526_row31_col3, #T_c2526_row35_col2, #T_c2526_row36_col2 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_c2526_row0_col1, #T_c2526_row0_col3, #T_c2526_row1_col2, #T_c2526_row1_col3, #T_c2526_row1_col4, #T_c2526_row3_col3, #T_c2526_row4_col0, #T_c2526_row5_col3, #T_c2526_row6_col0, #T_c2526_row6_col1, #T_c2526_row6_col3, #T_c2526_row8_col0, #T_c2526_row8_col1, #T_c2526_row8_col4, #T_c2526_row9_col0, #T_c2526_row9_col2, #T_c2526_row9_col4, #T_c2526_row10_col0, #T_c2526_row10_col2, #T_c2526_row11_col4, #T_c2526_row12_col1, #T_c2526_row12_col3, #T_c2526_row12_col4, #T_c2526_row13_col2, #T_c2526_row14_col2, #T_c2526_row17_col2, #T_c2526_row18_col2, #T_c2526_row19_col2, #T_c2526_row20_col2, #T_c2526_row21_col2, #T_c2526_row22_col0, #T_c2526_row23_col3, #T_c2526_row32_col2, #T_c2526_row32_col3, #T_c2526_row33_col2, #T_c2526_row34_col2, #T_c2526_row35_col3, #T_c2526_row36_col3, #T_c2526_row37_col3 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "#T_c2526_row0_col2, #T_c2526_row0_col4, #T_c2526_row2_col0, #T_c2526_row2_col3, #T_c2526_row2_col4, #T_c2526_row3_col2, #T_c2526_row5_col0, #T_c2526_row7_col3, #T_c2526_row8_col2, #T_c2526_row11_col3, #T_c2526_row14_col0, #T_c2526_row15_col3, #T_c2526_row16_col3, #T_c2526_row18_col4, #T_c2526_row19_col4, #T_c2526_row22_col3, #T_c2526_row27_col0, #T_c2526_row33_col3, #T_c2526_row34_col3, #T_c2526_row37_col2, #T_c2526_row38_col2, #T_c2526_row38_col3, #T_c2526_row39_col2, #T_c2526_row40_col2 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_c2526_row1_col0, #T_c2526_row5_col1, #T_c2526_row6_col4, #T_c2526_row7_col0, #T_c2526_row7_col1, #T_c2526_row7_col2, #T_c2526_row10_col3, #T_c2526_row11_col2, #T_c2526_row12_col2, #T_c2526_row14_col1, #T_c2526_row14_col3, #T_c2526_row15_col1, #T_c2526_row16_col0, #T_c2526_row16_col1, #T_c2526_row17_col0, #T_c2526_row17_col1, #T_c2526_row17_col3, #T_c2526_row18_col0, #T_c2526_row18_col1, #T_c2526_row18_col3, #T_c2526_row19_col0, #T_c2526_row20_col0, #T_c2526_row21_col0, #T_c2526_row23_col2, #T_c2526_row24_col2, #T_c2526_row25_col2, #T_c2526_row25_col3, #T_c2526_row26_col2, #T_c2526_row26_col3, #T_c2526_row27_col2, #T_c2526_row27_col3, #T_c2526_row28_col2, #T_c2526_row29_col2 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_c2526_row2_col1, #T_c2526_row3_col1, #T_c2526_row4_col2, #T_c2526_row4_col4, #T_c2526_row5_col2, #T_c2526_row5_col4, #T_c2526_row8_col3, #T_c2526_row9_col1, #T_c2526_row9_col3, #T_c2526_row10_col1, #T_c2526_row10_col4, #T_c2526_row11_col0, #T_c2526_row11_col1, #T_c2526_row12_col0, #T_c2526_row13_col0, #T_c2526_row15_col2, #T_c2526_row16_col2, #T_c2526_row19_col3, #T_c2526_row20_col3, #T_c2526_row21_col3 {\n",
       "  background-color: orange;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_c2526\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_c2526_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
       "      <th id=\"T_c2526_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
       "      <th id=\"T_c2526_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
       "      <th id=\"T_c2526_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
       "      <th id=\"T_c2526_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
       "      <td id=\"T_c2526_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
       "      <td id=\"T_c2526_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
       "      <td id=\"T_c2526_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
       "      <td id=\"T_c2526_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
       "      <td id=\"T_c2526_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
       "      <td id=\"T_c2526_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
       "      <td id=\"T_c2526_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
       "      <td id=\"T_c2526_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
       "      <td id=\"T_c2526_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
       "      <td id=\"T_c2526_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
       "      <td id=\"T_c2526_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
       "      <td id=\"T_c2526_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
       "      <td id=\"T_c2526_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
       "      <td id=\"T_c2526_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
       "      <td id=\"T_c2526_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
       "      <td id=\"T_c2526_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
       "      <td id=\"T_c2526_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
       "      <td id=\"T_c2526_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
       "      <td id=\"T_c2526_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
       "      <td id=\"T_c2526_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
       "      <td id=\"T_c2526_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
       "      <td id=\"T_c2526_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
       "      <td id=\"T_c2526_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
       "      <td id=\"T_c2526_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
       "      <td id=\"T_c2526_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
       "      <td id=\"T_c2526_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
       "      <td id=\"T_c2526_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
       "      <td id=\"T_c2526_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
       "      <td id=\"T_c2526_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
       "      <td id=\"T_c2526_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
       "      <td id=\"T_c2526_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
       "      <td id=\"T_c2526_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
       "      <td id=\"T_c2526_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
       "      <td id=\"T_c2526_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
       "      <td id=\"T_c2526_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
       "      <td id=\"T_c2526_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
       "      <td id=\"T_c2526_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
       "      <td id=\"T_c2526_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
       "      <td id=\"T_c2526_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
       "      <td id=\"T_c2526_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
       "      <td id=\"T_c2526_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
       "      <td id=\"T_c2526_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
       "      <td id=\"T_c2526_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
       "      <td id=\"T_c2526_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
       "      <td id=\"T_c2526_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
       "      <td id=\"T_c2526_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
       "      <td id=\"T_c2526_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
       "      <td id=\"T_c2526_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
       "      <td id=\"T_c2526_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
       "      <td id=\"T_c2526_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
       "      <td id=\"T_c2526_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
       "      <td id=\"T_c2526_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
       "      <td id=\"T_c2526_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
       "      <td id=\"T_c2526_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
       "      <td id=\"T_c2526_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
       "      <td id=\"T_c2526_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
       "      <td id=\"T_c2526_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
       "      <td id=\"T_c2526_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
       "      <td id=\"T_c2526_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
       "      <td id=\"T_c2526_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
       "      <td id=\"T_c2526_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
       "      <td id=\"T_c2526_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
       "      <td id=\"T_c2526_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
       "      <td id=\"T_c2526_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
       "      <td id=\"T_c2526_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
       "      <td id=\"T_c2526_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
       "      <td id=\"T_c2526_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
       "      <td id=\"T_c2526_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
       "      <td id=\"T_c2526_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
       "      <td id=\"T_c2526_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
       "      <td id=\"T_c2526_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
       "      <td id=\"T_c2526_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
       "      <td id=\"T_c2526_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
       "      <td id=\"T_c2526_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
       "      <td id=\"T_c2526_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
       "      <td id=\"T_c2526_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
       "      <td id=\"T_c2526_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
       "      <td id=\"T_c2526_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
       "      <td id=\"T_c2526_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
       "      <td id=\"T_c2526_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
       "      <td id=\"T_c2526_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
       "      <td id=\"T_c2526_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
       "      <td id=\"T_c2526_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
       "      <td id=\"T_c2526_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
       "      <td id=\"T_c2526_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
       "      <td id=\"T_c2526_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
       "      <td id=\"T_c2526_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
       "      <td id=\"T_c2526_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
       "      <td id=\"T_c2526_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
       "      <td id=\"T_c2526_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
       "      <td id=\"T_c2526_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
       "      <td id=\"T_c2526_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
       "      <td id=\"T_c2526_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
       "      <td id=\"T_c2526_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
       "      <td id=\"T_c2526_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
       "      <td id=\"T_c2526_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
       "      <td id=\"T_c2526_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
       "      <td id=\"T_c2526_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
       "      <td id=\"T_c2526_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
       "      <td id=\"T_c2526_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
       "      <td id=\"T_c2526_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
       "      <td id=\"T_c2526_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
       "      <td id=\"T_c2526_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
       "      <td id=\"T_c2526_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
       "      <td id=\"T_c2526_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
       "      <td id=\"T_c2526_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
       "      <td id=\"T_c2526_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
       "      <td id=\"T_c2526_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
       "      <td id=\"T_c2526_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
       "      <td id=\"T_c2526_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
       "      <td id=\"T_c2526_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
       "      <td id=\"T_c2526_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
       "      <td id=\"T_c2526_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
       "      <td id=\"T_c2526_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
       "      <td id=\"T_c2526_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
       "      <td id=\"T_c2526_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
       "      <td id=\"T_c2526_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
       "      <td id=\"T_c2526_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
       "      <td id=\"T_c2526_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
       "      <td id=\"T_c2526_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
       "      <td id=\"T_c2526_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
       "      <td id=\"T_c2526_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
       "      <td id=\"T_c2526_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
       "      <td id=\"T_c2526_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
       "      <td id=\"T_c2526_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
       "      <td id=\"T_c2526_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
       "      <td id=\"T_c2526_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
       "      <td id=\"T_c2526_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
       "      <td id=\"T_c2526_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
       "      <td id=\"T_c2526_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
       "      <td id=\"T_c2526_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
       "      <td id=\"T_c2526_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
       "      <td id=\"T_c2526_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
       "      <td id=\"T_c2526_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
       "      <td id=\"T_c2526_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
       "      <td id=\"T_c2526_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
       "      <td id=\"T_c2526_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
       "      <td id=\"T_c2526_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
       "      <td id=\"T_c2526_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
       "      <td id=\"T_c2526_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
       "      <td id=\"T_c2526_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
       "      <td id=\"T_c2526_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
       "      <td id=\"T_c2526_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
       "      <td id=\"T_c2526_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
       "      <td id=\"T_c2526_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
       "      <td id=\"T_c2526_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
       "      <td id=\"T_c2526_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
       "      <td id=\"T_c2526_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
       "      <td id=\"T_c2526_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
       "      <td id=\"T_c2526_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
       "      <td id=\"T_c2526_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
       "      <td id=\"T_c2526_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
       "      <td id=\"T_c2526_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
       "      <td id=\"T_c2526_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
       "      <td id=\"T_c2526_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
       "      <td id=\"T_c2526_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
       "      <td id=\"T_c2526_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
       "      <td id=\"T_c2526_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
       "      <td id=\"T_c2526_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
       "      <td id=\"T_c2526_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
       "      <td id=\"T_c2526_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
       "      <td id=\"T_c2526_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
       "      <td id=\"T_c2526_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
       "      <td id=\"T_c2526_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
       "      <td id=\"T_c2526_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
       "      <td id=\"T_c2526_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
       "      <td id=\"T_c2526_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
       "      <td id=\"T_c2526_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
       "      <td id=\"T_c2526_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
       "      <td id=\"T_c2526_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
       "      <td id=\"T_c2526_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_c2526_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
       "      <td id=\"T_c2526_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
       "      <td id=\"T_c2526_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
       "      <td id=\"T_c2526_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
       "      <td id=\"T_c2526_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
       "      <td id=\"T_c2526_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1f36a0>"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "df.style.applymap(highlight_cells)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a7510444-c411-443e-b8b5-de788fb940c2",
   "metadata": {
    "tags": []
   },
   "source": [
    "### Highlight Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "fcc9a6f6-cd1d-4150-8896-ec1e12b50e68",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_67470_row0_col0 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_67470_row1_col0 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_67470_row2_col0 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_67470_row3_col0 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_67470_row4_col0 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_67470\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_67470_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_67470_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
       "      <td id=\"T_67470_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67470_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
       "      <td id=\"T_67470_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67470_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
       "      <td id=\"T_67470_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67470_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
       "      <td id=\"T_67470_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67470_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
       "      <td id=\"T_67470_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c2109a0>"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "show_legend()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "29cb6e5d-8929-4620-8707-917886b3107c",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_e8c5e_row0_col0, #T_e8c5e_row1_col1, #T_e8c5e_row2_col2, #T_e8c5e_row3_col0, #T_e8c5e_row3_col4, #T_e8c5e_row4_col1, #T_e8c5e_row4_col3, #T_e8c5e_row6_col2, #T_e8c5e_row7_col4, #T_e8c5e_row13_col1, #T_e8c5e_row13_col3, #T_e8c5e_row13_col4, #T_e8c5e_row14_col4, #T_e8c5e_row15_col0, #T_e8c5e_row15_col4, #T_e8c5e_row16_col4, #T_e8c5e_row17_col4, #T_e8c5e_row19_col1, #T_e8c5e_row20_col1, #T_e8c5e_row21_col1, #T_e8c5e_row22_col1, #T_e8c5e_row22_col2, #T_e8c5e_row23_col0, #T_e8c5e_row24_col0, #T_e8c5e_row24_col3, #T_e8c5e_row25_col0, #T_e8c5e_row26_col0, #T_e8c5e_row28_col3, #T_e8c5e_row29_col3, #T_e8c5e_row30_col2, #T_e8c5e_row30_col3, #T_e8c5e_row31_col2, #T_e8c5e_row31_col3, #T_e8c5e_row35_col2, #T_e8c5e_row36_col2 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_e8c5e\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_e8c5e_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
       "      <th id=\"T_e8c5e_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
       "      <th id=\"T_e8c5e_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
       "      <th id=\"T_e8c5e_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
       "      <th id=\"T_e8c5e_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
       "      <td id=\"T_e8c5e_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
       "      <td id=\"T_e8c5e_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
       "      <td id=\"T_e8c5e_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
       "      <td id=\"T_e8c5e_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
       "      <td id=\"T_e8c5e_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
       "      <td id=\"T_e8c5e_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
       "      <td id=\"T_e8c5e_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
       "      <td id=\"T_e8c5e_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
       "      <td id=\"T_e8c5e_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
       "      <td id=\"T_e8c5e_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
       "      <td id=\"T_e8c5e_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
       "      <td id=\"T_e8c5e_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
       "      <td id=\"T_e8c5e_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
       "      <td id=\"T_e8c5e_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
       "      <td id=\"T_e8c5e_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
       "      <td id=\"T_e8c5e_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
       "      <td id=\"T_e8c5e_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
       "      <td id=\"T_e8c5e_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
       "      <td id=\"T_e8c5e_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
       "      <td id=\"T_e8c5e_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
       "      <td id=\"T_e8c5e_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
       "      <td id=\"T_e8c5e_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
       "      <td id=\"T_e8c5e_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
       "      <td id=\"T_e8c5e_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
       "      <td id=\"T_e8c5e_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
       "      <td id=\"T_e8c5e_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
       "      <td id=\"T_e8c5e_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
       "      <td id=\"T_e8c5e_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
       "      <td id=\"T_e8c5e_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
       "      <td id=\"T_e8c5e_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
       "      <td id=\"T_e8c5e_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
       "      <td id=\"T_e8c5e_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
       "      <td id=\"T_e8c5e_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
       "      <td id=\"T_e8c5e_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
       "      <td id=\"T_e8c5e_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
       "      <td id=\"T_e8c5e_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
       "      <td id=\"T_e8c5e_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
       "      <td id=\"T_e8c5e_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
       "      <td id=\"T_e8c5e_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
       "      <td id=\"T_e8c5e_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
       "      <td id=\"T_e8c5e_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
       "      <td id=\"T_e8c5e_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
       "      <td id=\"T_e8c5e_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
       "      <td id=\"T_e8c5e_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
       "      <td id=\"T_e8c5e_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
       "      <td id=\"T_e8c5e_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
       "      <td id=\"T_e8c5e_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
       "      <td id=\"T_e8c5e_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
       "      <td id=\"T_e8c5e_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
       "      <td id=\"T_e8c5e_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
       "      <td id=\"T_e8c5e_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
       "      <td id=\"T_e8c5e_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
       "      <td id=\"T_e8c5e_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
       "      <td id=\"T_e8c5e_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
       "      <td id=\"T_e8c5e_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
       "      <td id=\"T_e8c5e_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
       "      <td id=\"T_e8c5e_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
       "      <td id=\"T_e8c5e_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
       "      <td id=\"T_e8c5e_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
       "      <td id=\"T_e8c5e_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
       "      <td id=\"T_e8c5e_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
       "      <td id=\"T_e8c5e_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
       "      <td id=\"T_e8c5e_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
       "      <td id=\"T_e8c5e_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
       "      <td id=\"T_e8c5e_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
       "      <td id=\"T_e8c5e_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
       "      <td id=\"T_e8c5e_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
       "      <td id=\"T_e8c5e_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
       "      <td id=\"T_e8c5e_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
       "      <td id=\"T_e8c5e_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
       "      <td id=\"T_e8c5e_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
       "      <td id=\"T_e8c5e_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
       "      <td id=\"T_e8c5e_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
       "      <td id=\"T_e8c5e_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
       "      <td id=\"T_e8c5e_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
       "      <td id=\"T_e8c5e_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
       "      <td id=\"T_e8c5e_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
       "      <td id=\"T_e8c5e_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
       "      <td id=\"T_e8c5e_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
       "      <td id=\"T_e8c5e_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
       "      <td id=\"T_e8c5e_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
       "      <td id=\"T_e8c5e_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
       "      <td id=\"T_e8c5e_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
       "      <td id=\"T_e8c5e_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
       "      <td id=\"T_e8c5e_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
       "      <td id=\"T_e8c5e_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
       "      <td id=\"T_e8c5e_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
       "      <td id=\"T_e8c5e_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
       "      <td id=\"T_e8c5e_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
       "      <td id=\"T_e8c5e_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
       "      <td id=\"T_e8c5e_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
       "      <td id=\"T_e8c5e_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
       "      <td id=\"T_e8c5e_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
       "      <td id=\"T_e8c5e_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
       "      <td id=\"T_e8c5e_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
       "      <td id=\"T_e8c5e_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
       "      <td id=\"T_e8c5e_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
       "      <td id=\"T_e8c5e_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
       "      <td id=\"T_e8c5e_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
       "      <td id=\"T_e8c5e_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
       "      <td id=\"T_e8c5e_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
       "      <td id=\"T_e8c5e_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
       "      <td id=\"T_e8c5e_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
       "      <td id=\"T_e8c5e_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
       "      <td id=\"T_e8c5e_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
       "      <td id=\"T_e8c5e_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
       "      <td id=\"T_e8c5e_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
       "      <td id=\"T_e8c5e_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
       "      <td id=\"T_e8c5e_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
       "      <td id=\"T_e8c5e_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
       "      <td id=\"T_e8c5e_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
       "      <td id=\"T_e8c5e_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
       "      <td id=\"T_e8c5e_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
       "      <td id=\"T_e8c5e_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
       "      <td id=\"T_e8c5e_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
       "      <td id=\"T_e8c5e_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
       "      <td id=\"T_e8c5e_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
       "      <td id=\"T_e8c5e_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
       "      <td id=\"T_e8c5e_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
       "      <td id=\"T_e8c5e_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
       "      <td id=\"T_e8c5e_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
       "      <td id=\"T_e8c5e_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
       "      <td id=\"T_e8c5e_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
       "      <td id=\"T_e8c5e_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
       "      <td id=\"T_e8c5e_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
       "      <td id=\"T_e8c5e_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
       "      <td id=\"T_e8c5e_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
       "      <td id=\"T_e8c5e_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
       "      <td id=\"T_e8c5e_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
       "      <td id=\"T_e8c5e_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
       "      <td id=\"T_e8c5e_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
       "      <td id=\"T_e8c5e_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
       "      <td id=\"T_e8c5e_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
       "      <td id=\"T_e8c5e_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
       "      <td id=\"T_e8c5e_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
       "      <td id=\"T_e8c5e_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
       "      <td id=\"T_e8c5e_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
       "      <td id=\"T_e8c5e_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
       "      <td id=\"T_e8c5e_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
       "      <td id=\"T_e8c5e_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
       "      <td id=\"T_e8c5e_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
       "      <td id=\"T_e8c5e_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
       "      <td id=\"T_e8c5e_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
       "      <td id=\"T_e8c5e_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
       "      <td id=\"T_e8c5e_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
       "      <td id=\"T_e8c5e_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
       "      <td id=\"T_e8c5e_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
       "      <td id=\"T_e8c5e_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
       "      <td id=\"T_e8c5e_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
       "      <td id=\"T_e8c5e_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
       "      <td id=\"T_e8c5e_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
       "      <td id=\"T_e8c5e_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
       "      <td id=\"T_e8c5e_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
       "      <td id=\"T_e8c5e_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
       "      <td id=\"T_e8c5e_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
       "      <td id=\"T_e8c5e_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
       "      <td id=\"T_e8c5e_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
       "      <td id=\"T_e8c5e_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
       "      <td id=\"T_e8c5e_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
       "      <td id=\"T_e8c5e_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
       "      <td id=\"T_e8c5e_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
       "      <td id=\"T_e8c5e_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
       "      <td id=\"T_e8c5e_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
       "      <td id=\"T_e8c5e_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
       "      <td id=\"T_e8c5e_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
       "      <td id=\"T_e8c5e_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
       "      <td id=\"T_e8c5e_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
       "      <td id=\"T_e8c5e_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
       "      <td id=\"T_e8c5e_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
       "      <td id=\"T_e8c5e_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e8c5e_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
       "      <td id=\"T_e8c5e_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
       "      <td id=\"T_e8c5e_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
       "      <td id=\"T_e8c5e_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1f3c10>"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.style.applymap(highlight_cells_5)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c30e6a45-7728-4e91-aa34-88242a623b0c",
   "metadata": {},
   "source": [
    "### Summary of Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "91f6821c-20ed-4c4d-968a-267cdf9bea36",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "      <th>2</th>\n",
       "      <th>3</th>\n",
       "      <th>4</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1562.001</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1562</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566.001</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1036</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1543</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                    0        1       2       3         4\n",
       "T1562.001  AgentTesla  Azorult  Qakbot  Remcos  Trickbot\n",
       "T1562      AgentTesla  Azorult  Qakbot  Remcos  Trickbot\n",
       "T1059      AgentTesla  Azorult  Qakbot  Remcos  Trickbot\n",
       "T1566.001  AgentTesla  Azorult  Qakbot  Remcos  Trickbot\n",
       "T1566      AgentTesla  Azorult  Qakbot  Remcos  Trickbot\n",
       "T1036      AgentTesla  Azorult  Qakbot  Remcos  Trickbot\n",
       "T1543      AgentTesla  Azorult  Qakbot  Remcos  Trickbot"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 5)\n",
    "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
    "tdf"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "77c29341-1e19-404b-acd6-7cc20cccc1dc",
   "metadata": {},
   "source": [
    "### detection list for Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "05d30039-ae22-4ea1-b381-064d8826cb57",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(7, 5)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1562.001</th>\n",
       "      <td>[add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml]</td>\n",
       "      <td>[attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, hide_user_account_from_sign_in_screen.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml]</td>\n",
       "      <td>[disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
       "      <td>[add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
       "      <td>[attempt_to_stop_security_service.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1562</th>\n",
       "      <td>[add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml]</td>\n",
       "      <td>[attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, firewall_allowed_program_enable.yml, hide_user_account_from_sign_in_screen.yml, processes_launching_netsh.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml]</td>\n",
       "      <td>[disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
       "      <td>[add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
       "      <td>[attempt_to_stop_security_service.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059</th>\n",
       "      <td>[powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml]</td>\n",
       "      <td>[chcp_command_execution.yml, cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml]</td>\n",
       "      <td>[cmd_carry_out_string_command_parameter.yml, cmdline_tool_not_executed_in_cmd_shell.yml, wermgr_process_spawned_cmd_or_powershell_process.yml]</td>\n",
       "      <td>[jscript_execution_using_cscript_app.yml, process_writing_dynamicwrapperx.yml, suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml]</td>\n",
       "      <td>[wermgr_process_spawned_cmd_or_powershell_process.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566.001</th>\n",
       "      <td>[office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566</th>\n",
       "      <td>[office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, process_creating_lnk_file_in_suspicious_location.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
       "      <td>[office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1036</th>\n",
       "      <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
       "      <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
       "      <td>[executables_or_script_creation_in_suspicious_path.yml, suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml]</td>\n",
       "      <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
       "      <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1543</th>\n",
       "      <td>[suspicious_driver_loaded_path.yml, suspicious_process_file_path.yml]</td>\n",
       "      <td>[sc_exe_manipulating_windows_services.yml, suspicious_process_file_path.yml]</td>\n",
       "      <td>[services_exe_lolbas_execution_process_spawn.yml, suspicious_process_file_path.yml]</td>\n",
       "      <td>[suspicious_process_file_path.yml, wscript_or_cscript_suspicious_child_process.yml]</td>\n",
       "      <td>[suspicious_process_file_path.yml]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                                                                                                                                                                                                                                                                AgentTesla  \\\n",
       "T1562.001                                                                                                                                                                 [add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml]   \n",
       "T1562                                                                                                                                                                     [add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml]   \n",
       "T1059                                                                                                                                                                                  [powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml]   \n",
       "T1566.001  [office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1566      [office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1036                                                                                                                                                                                                                                              [executables_or_script_creation_in_suspicious_path.yml]   \n",
       "T1543                                                                                                                                                                                                                                [suspicious_driver_loaded_path.yml, suspicious_process_file_path.yml]   \n",
       "\n",
       "                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Azorult  \\\n",
       "T1562.001                                                                      [attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, hide_user_account_from_sign_in_screen.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml]   \n",
       "T1562      [attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, firewall_allowed_program_enable.yml, hide_user_account_from_sign_in_screen.yml, processes_launching_netsh.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml]   \n",
       "T1059                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               [chcp_command_execution.yml, cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml]   \n",
       "T1566.001                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1566                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1036                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         [executables_or_script_creation_in_suspicious_path.yml]   \n",
       "T1543                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    [sc_exe_manipulating_windows_services.yml, suspicious_process_file_path.yml]   \n",
       "\n",
       "                                                                                                                                                                                                                                                                            Qakbot  \\\n",
       "T1562.001                                                                                                                                                                                   [disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml]   \n",
       "T1562                                                                                                                                                                                       [disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml]   \n",
       "T1059                                                                                                                               [cmd_carry_out_string_command_parameter.yml, cmdline_tool_not_executed_in_cmd_shell.yml, wermgr_process_spawned_cmd_or_powershell_process.yml]   \n",
       "T1566.001                                                        [office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1566      [office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, process_creating_lnk_file_in_suspicious_location.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1036                                                                                                                                 [executables_or_script_creation_in_suspicious_path.yml, suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml]   \n",
       "T1543                                                                                                                                                                                          [services_exe_lolbas_execution_process_spawn.yml, suspicious_process_file_path.yml]   \n",
       "\n",
       "                                                                                                                                                                                                                        Remcos  \\\n",
       "T1562.001                                                                       [add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml]   \n",
       "T1562                                                                           [add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml]   \n",
       "T1059                                      [jscript_execution_using_cscript_app.yml, process_writing_dynamicwrapperx.yml, suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml]   \n",
       "T1566.001  [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1566      [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]   \n",
       "T1036                                                                                                                                                                  [executables_or_script_creation_in_suspicious_path.yml]   \n",
       "T1543                                                                                                                                      [suspicious_process_file_path.yml, wscript_or_cscript_suspicious_child_process.yml]   \n",
       "\n",
       "                                                                                                                                                                        Trickbot  \n",
       "T1562.001                                                                                                                                 [attempt_to_stop_security_service.yml]  \n",
       "T1562                                                                                                                                     [attempt_to_stop_security_service.yml]  \n",
       "T1059                                                                                                                     [wermgr_process_spawned_cmd_or_powershell_process.yml]  \n",
       "T1566.001  [office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]  \n",
       "T1566      [office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]  \n",
       "T1036                                                                                                                    [executables_or_script_creation_in_suspicious_path.yml]  \n",
       "T1543                                                                                                                                         [suspicious_process_file_path.yml]  "
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "det_table_dict = detection_list_by_id(temp_dict)\n",
    "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
    "print(tdf.shape)\n",
    "tdf "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2f50a79c-075e-46ea-a00e-c535f01f304f",
   "metadata": {},
   "source": [
    "### detection count per mitre attack id in each malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "bd5233dd-a4fd-49bf-86ff-f46cbb6f9ce9",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1562.001</th>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(14)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1562</th>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(16)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059</th>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(4)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566.001</th>\n",
       "      <td>(7)-detection count</td>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>(4)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566</th>\n",
       "      <td>(7)-detection count</td>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>(6)-detection count</td>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>(4)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1036</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1543</th>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                    AgentTesla               Azorult               Qakbot  \\\n",
       "T1562.001  (3)-detection count  (14)-detection count  (2)-detection count   \n",
       "T1562      (3)-detection count  (16)-detection count  (2)-detection count   \n",
       "T1059      (2)-detection count   (3)-detection count  (3)-detection count   \n",
       "T1566.001  (7)-detection count   (5)-detection count  (5)-detection count   \n",
       "T1566      (7)-detection count   (5)-detection count  (6)-detection count   \n",
       "T1036      (1)-detection count   (1)-detection count  (3)-detection count   \n",
       "T1543      (2)-detection count   (2)-detection count  (2)-detection count   \n",
       "\n",
       "                        Remcos             Trickbot  \n",
       "T1562.001  (3)-detection count  (1)-detection count  \n",
       "T1562      (3)-detection count  (1)-detection count  \n",
       "T1059      (4)-detection count  (1)-detection count  \n",
       "T1566.001  (5)-detection count  (4)-detection count  \n",
       "T1566      (5)-detection count  (4)-detection count  \n",
       "T1036      (1)-detection count  (1)-detection count  \n",
       "T1543      (2)-detection count  (1)-detection count  "
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "detection_list_by_count(det_table_dict)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a7cbd7a7-46d2-464d-9af7-d1a65c87b822",
   "metadata": {},
   "source": [
    "### Highlight Mitre Attack ID that detects 4/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "2a32699e-442b-458f-9b24-bb753efc5325",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_2b475_row0_col0 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_2b475_row1_col0 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_2b475_row2_col0 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_2b475_row3_col0 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_2b475_row4_col0 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_2b475\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_2b475_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_2b475_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
       "      <td id=\"T_2b475_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_2b475_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
       "      <td id=\"T_2b475_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_2b475_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
       "      <td id=\"T_2b475_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_2b475_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
       "      <td id=\"T_2b475_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_2b475_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
       "      <td id=\"T_2b475_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1db400>"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "show_legend()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "cdad9857-37ff-40a5-8cbd-532cb23f6373",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_bd535_row2_col1, #T_bd535_row3_col1, #T_bd535_row4_col2, #T_bd535_row4_col4, #T_bd535_row5_col2, #T_bd535_row5_col4, #T_bd535_row8_col3, #T_bd535_row9_col1, #T_bd535_row9_col3, #T_bd535_row10_col1, #T_bd535_row10_col4, #T_bd535_row11_col0, #T_bd535_row11_col1, #T_bd535_row12_col0, #T_bd535_row13_col0, #T_bd535_row15_col2, #T_bd535_row16_col2, #T_bd535_row19_col3, #T_bd535_row20_col3, #T_bd535_row21_col3 {\n",
       "  background-color: orange;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_bd535\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_bd535_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
       "      <th id=\"T_bd535_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
       "      <th id=\"T_bd535_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
       "      <th id=\"T_bd535_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
       "      <th id=\"T_bd535_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
       "      <td id=\"T_bd535_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
       "      <td id=\"T_bd535_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
       "      <td id=\"T_bd535_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
       "      <td id=\"T_bd535_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
       "      <td id=\"T_bd535_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
       "      <td id=\"T_bd535_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
       "      <td id=\"T_bd535_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
       "      <td id=\"T_bd535_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
       "      <td id=\"T_bd535_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
       "      <td id=\"T_bd535_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
       "      <td id=\"T_bd535_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
       "      <td id=\"T_bd535_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
       "      <td id=\"T_bd535_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
       "      <td id=\"T_bd535_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
       "      <td id=\"T_bd535_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
       "      <td id=\"T_bd535_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
       "      <td id=\"T_bd535_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
       "      <td id=\"T_bd535_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
       "      <td id=\"T_bd535_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
       "      <td id=\"T_bd535_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
       "      <td id=\"T_bd535_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
       "      <td id=\"T_bd535_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
       "      <td id=\"T_bd535_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
       "      <td id=\"T_bd535_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
       "      <td id=\"T_bd535_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
       "      <td id=\"T_bd535_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
       "      <td id=\"T_bd535_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
       "      <td id=\"T_bd535_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
       "      <td id=\"T_bd535_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
       "      <td id=\"T_bd535_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
       "      <td id=\"T_bd535_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
       "      <td id=\"T_bd535_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
       "      <td id=\"T_bd535_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
       "      <td id=\"T_bd535_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
       "      <td id=\"T_bd535_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
       "      <td id=\"T_bd535_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
       "      <td id=\"T_bd535_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
       "      <td id=\"T_bd535_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
       "      <td id=\"T_bd535_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
       "      <td id=\"T_bd535_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
       "      <td id=\"T_bd535_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
       "      <td id=\"T_bd535_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
       "      <td id=\"T_bd535_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
       "      <td id=\"T_bd535_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
       "      <td id=\"T_bd535_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
       "      <td id=\"T_bd535_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
       "      <td id=\"T_bd535_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
       "      <td id=\"T_bd535_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
       "      <td id=\"T_bd535_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
       "      <td id=\"T_bd535_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
       "      <td id=\"T_bd535_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
       "      <td id=\"T_bd535_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
       "      <td id=\"T_bd535_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
       "      <td id=\"T_bd535_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
       "      <td id=\"T_bd535_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
       "      <td id=\"T_bd535_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
       "      <td id=\"T_bd535_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
       "      <td id=\"T_bd535_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
       "      <td id=\"T_bd535_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
       "      <td id=\"T_bd535_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
       "      <td id=\"T_bd535_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
       "      <td id=\"T_bd535_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
       "      <td id=\"T_bd535_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
       "      <td id=\"T_bd535_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
       "      <td id=\"T_bd535_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
       "      <td id=\"T_bd535_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
       "      <td id=\"T_bd535_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
       "      <td id=\"T_bd535_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
       "      <td id=\"T_bd535_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
       "      <td id=\"T_bd535_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
       "      <td id=\"T_bd535_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
       "      <td id=\"T_bd535_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
       "      <td id=\"T_bd535_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
       "      <td id=\"T_bd535_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
       "      <td id=\"T_bd535_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
       "      <td id=\"T_bd535_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
       "      <td id=\"T_bd535_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
       "      <td id=\"T_bd535_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
       "      <td id=\"T_bd535_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
       "      <td id=\"T_bd535_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
       "      <td id=\"T_bd535_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
       "      <td id=\"T_bd535_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
       "      <td id=\"T_bd535_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
       "      <td id=\"T_bd535_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
       "      <td id=\"T_bd535_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
       "      <td id=\"T_bd535_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
       "      <td id=\"T_bd535_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
       "      <td id=\"T_bd535_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
       "      <td id=\"T_bd535_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
       "      <td id=\"T_bd535_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
       "      <td id=\"T_bd535_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
       "      <td id=\"T_bd535_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
       "      <td id=\"T_bd535_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
       "      <td id=\"T_bd535_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
       "      <td id=\"T_bd535_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
       "      <td id=\"T_bd535_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
       "      <td id=\"T_bd535_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
       "      <td id=\"T_bd535_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
       "      <td id=\"T_bd535_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
       "      <td id=\"T_bd535_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
       "      <td id=\"T_bd535_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
       "      <td id=\"T_bd535_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
       "      <td id=\"T_bd535_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
       "      <td id=\"T_bd535_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
       "      <td id=\"T_bd535_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
       "      <td id=\"T_bd535_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
       "      <td id=\"T_bd535_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
       "      <td id=\"T_bd535_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
       "      <td id=\"T_bd535_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
       "      <td id=\"T_bd535_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
       "      <td id=\"T_bd535_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
       "      <td id=\"T_bd535_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
       "      <td id=\"T_bd535_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
       "      <td id=\"T_bd535_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
       "      <td id=\"T_bd535_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
       "      <td id=\"T_bd535_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
       "      <td id=\"T_bd535_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
       "      <td id=\"T_bd535_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
       "      <td id=\"T_bd535_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
       "      <td id=\"T_bd535_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
       "      <td id=\"T_bd535_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
       "      <td id=\"T_bd535_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
       "      <td id=\"T_bd535_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
       "      <td id=\"T_bd535_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
       "      <td id=\"T_bd535_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
       "      <td id=\"T_bd535_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
       "      <td id=\"T_bd535_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
       "      <td id=\"T_bd535_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
       "      <td id=\"T_bd535_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
       "      <td id=\"T_bd535_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
       "      <td id=\"T_bd535_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
       "      <td id=\"T_bd535_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
       "      <td id=\"T_bd535_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
       "      <td id=\"T_bd535_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
       "      <td id=\"T_bd535_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
       "      <td id=\"T_bd535_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
       "      <td id=\"T_bd535_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
       "      <td id=\"T_bd535_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
       "      <td id=\"T_bd535_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
       "      <td id=\"T_bd535_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
       "      <td id=\"T_bd535_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
       "      <td id=\"T_bd535_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
       "      <td id=\"T_bd535_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
       "      <td id=\"T_bd535_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
       "      <td id=\"T_bd535_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
       "      <td id=\"T_bd535_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
       "      <td id=\"T_bd535_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
       "      <td id=\"T_bd535_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
       "      <td id=\"T_bd535_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
       "      <td id=\"T_bd535_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
       "      <td id=\"T_bd535_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
       "      <td id=\"T_bd535_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
       "      <td id=\"T_bd535_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
       "      <td id=\"T_bd535_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
       "      <td id=\"T_bd535_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
       "      <td id=\"T_bd535_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
       "      <td id=\"T_bd535_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
       "      <td id=\"T_bd535_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
       "      <td id=\"T_bd535_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
       "      <td id=\"T_bd535_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
       "      <td id=\"T_bd535_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
       "      <td id=\"T_bd535_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
       "      <td id=\"T_bd535_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
       "      <td id=\"T_bd535_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
       "      <td id=\"T_bd535_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
       "      <td id=\"T_bd535_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
       "      <td id=\"T_bd535_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
       "      <td id=\"T_bd535_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
       "      <td id=\"T_bd535_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
       "      <td id=\"T_bd535_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
       "      <td id=\"T_bd535_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_bd535_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
       "      <td id=\"T_bd535_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
       "      <td id=\"T_bd535_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
       "      <td id=\"T_bd535_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
       "      <td id=\"T_bd535_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
       "      <td id=\"T_bd535_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1f4d00>"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.style.applymap(highlight_cells_4)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "49b139b0-a8b6-4b5a-88cb-6c009047519d",
   "metadata": {},
   "source": [
    "### Summary of Mitre Attack ID that detects 4/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "1dbccecb-9411-4087-8760-f16ba681d310",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "      <th>2</th>\n",
       "      <th>3</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1204.001</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1204</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1053</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1053.005</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                    0        1       2         3\n",
       "T1204.001  AgentTesla  Azorult  Qakbot    Remcos\n",
       "T1204      AgentTesla  Azorult  Qakbot    Remcos\n",
       "T1053      AgentTesla  Azorult  Qakbot  Trickbot\n",
       "T1053.005  AgentTesla  Azorult  Qakbot  Trickbot\n",
       "T1218      AgentTesla   Qakbot  Remcos  Trickbot"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 4)\n",
    "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
    "tdf = tdf.sort_values(by=[0,1,2,3])\n",
    "tdf"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4deb3bef-e9b9-4e98-a44f-7b8162a74d92",
   "metadata": {},
   "source": [
    "### detection list for Mitre Attack ID that detects 4/5 malware families"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "874c8687-477a-4f0f-8e79-abf8643ab128",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(5, 5)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1204.001</th>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1204</th>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>[windows_iso_lnk_file_creation.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218</th>\n",
       "      <td>[detect_html_help_spawn_child_process.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml]</td>\n",
       "      <td>[regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml]</td>\n",
       "      <td>[mshta_spawning_rundll32_or_regsvr32_process.yml, suspicious_rundll32_startw.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1053</th>\n",
       "      <td>[scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
       "      <td>[scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml]</td>\n",
       "      <td>[scheduled_task_deleted_or_created_via_cmd.yml, schtasks_run_task_on_demand.yml, windows_schtasks_create_run_as_system.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[schedule_task_with_rundll32_command_trigger.yml, scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1053.005</th>\n",
       "      <td>[scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
       "      <td>[scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml]</td>\n",
       "      <td>[scheduled_task_deleted_or_created_via_cmd.yml, windows_schtasks_create_run_as_system.yml, winevent_windows_task_scheduler_event_action_started.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                AgentTesla  \\\n",
       "T1204.001              [windows_iso_lnk_file_creation.yml]   \n",
       "T1204                  [windows_iso_lnk_file_creation.yml]   \n",
       "T1218           [detect_html_help_spawn_child_process.yml]   \n",
       "T1053      [scheduled_task_deleted_or_created_via_cmd.yml]   \n",
       "T1053.005  [scheduled_task_deleted_or_created_via_cmd.yml]   \n",
       "\n",
       "                                                                                                        Azorult  \\\n",
       "T1204.001                                                                   [windows_iso_lnk_file_creation.yml]   \n",
       "T1204                                                                       [windows_iso_lnk_file_creation.yml]   \n",
       "T1218                                                                                                       NaN   \n",
       "T1053      [scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml]   \n",
       "T1053.005  [scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml]   \n",
       "\n",
       "                                                                                                                                                         Qakbot  \\\n",
       "T1204.001                                                                                                                   [windows_iso_lnk_file_creation.yml]   \n",
       "T1204                                                                                                                       [windows_iso_lnk_file_creation.yml]   \n",
       "T1218                    [regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml]   \n",
       "T1053                               [scheduled_task_deleted_or_created_via_cmd.yml, schtasks_run_task_on_demand.yml, windows_schtasks_create_run_as_system.yml]   \n",
       "T1053.005  [scheduled_task_deleted_or_created_via_cmd.yml, windows_schtasks_create_run_as_system.yml, winevent_windows_task_scheduler_event_action_started.yml]   \n",
       "\n",
       "                                                                                                       Remcos  \\\n",
       "T1204.001                                                                 [windows_iso_lnk_file_creation.yml]   \n",
       "T1204                                                                     [windows_iso_lnk_file_creation.yml]   \n",
       "T1218      [regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml]   \n",
       "T1053                                                                                                     NaN   \n",
       "T1053.005                                                                                                 NaN   \n",
       "\n",
       "                                                                                                   Trickbot  \n",
       "T1204.001                                                                                               NaN  \n",
       "T1204                                                                                                   NaN  \n",
       "T1218                     [mshta_spawning_rundll32_or_regsvr32_process.yml, suspicious_rundll32_startw.yml]  \n",
       "T1053      [schedule_task_with_rundll32_command_trigger.yml, scheduled_task_deleted_or_created_via_cmd.yml]  \n",
       "T1053.005                                                   [scheduled_task_deleted_or_created_via_cmd.yml]  "
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "det_table_dict = detection_list_by_id(temp_dict)\n",
    "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
    "print(tdf.shape)\n",
    "tdf  "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a50a8933-f8ec-4dc2-b116-5761e97b7024",
   "metadata": {},
   "source": [
    "### detection count per mitre attack id in each malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "54fb9a34-ac9a-48f2-a436-0cafaf16066c",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1204.001</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1204</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1053</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1053.005</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                    AgentTesla              Azorult               Qakbot  \\\n",
       "T1204.001  (1)-detection count  (1)-detection count  (1)-detection count   \n",
       "T1204      (1)-detection count  (1)-detection count  (1)-detection count   \n",
       "T1218      (1)-detection count                  NaN  (3)-detection count   \n",
       "T1053      (1)-detection count  (2)-detection count  (3)-detection count   \n",
       "T1053.005  (1)-detection count  (2)-detection count  (3)-detection count   \n",
       "\n",
       "                        Remcos             Trickbot  \n",
       "T1204.001  (1)-detection count                  NaN  \n",
       "T1204      (1)-detection count                  NaN  \n",
       "T1218      (2)-detection count  (2)-detection count  \n",
       "T1053                      NaN  (2)-detection count  \n",
       "T1053.005                  NaN  (1)-detection count  "
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "detection_list_by_count(det_table_dict)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "23f0dad6-7b39-4eeb-97b0-c5fecc08f5f2",
   "metadata": {},
   "source": [
    "### Highlight Mitre Attack ID that detects 3/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "1e1ad988-b482-4b75-b4ec-a1238e7e441e",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_50c38_row0_col0 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_50c38_row1_col0 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_50c38_row2_col0 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_50c38_row3_col0 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_50c38_row4_col0 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_50c38\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_50c38_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_50c38_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
       "      <td id=\"T_50c38_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_50c38_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
       "      <td id=\"T_50c38_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_50c38_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
       "      <td id=\"T_50c38_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_50c38_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
       "      <td id=\"T_50c38_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_50c38_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
       "      <td id=\"T_50c38_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1cca90>"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "show_legend()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "385f15e4-d000-4004-9a1c-8a762b3a3af7",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_df10c_row1_col0, #T_df10c_row5_col1, #T_df10c_row6_col4, #T_df10c_row7_col0, #T_df10c_row7_col1, #T_df10c_row7_col2, #T_df10c_row10_col3, #T_df10c_row11_col2, #T_df10c_row12_col2, #T_df10c_row14_col1, #T_df10c_row14_col3, #T_df10c_row15_col1, #T_df10c_row16_col0, #T_df10c_row16_col1, #T_df10c_row17_col0, #T_df10c_row17_col1, #T_df10c_row17_col3, #T_df10c_row18_col0, #T_df10c_row18_col1, #T_df10c_row18_col3, #T_df10c_row19_col0, #T_df10c_row20_col0, #T_df10c_row21_col0, #T_df10c_row23_col2, #T_df10c_row24_col2, #T_df10c_row25_col2, #T_df10c_row25_col3, #T_df10c_row26_col2, #T_df10c_row26_col3, #T_df10c_row27_col2, #T_df10c_row27_col3, #T_df10c_row28_col2, #T_df10c_row29_col2 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_df10c\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_df10c_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
       "      <th id=\"T_df10c_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
       "      <th id=\"T_df10c_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
       "      <th id=\"T_df10c_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
       "      <th id=\"T_df10c_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
       "      <td id=\"T_df10c_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
       "      <td id=\"T_df10c_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
       "      <td id=\"T_df10c_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
       "      <td id=\"T_df10c_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
       "      <td id=\"T_df10c_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
       "      <td id=\"T_df10c_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
       "      <td id=\"T_df10c_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
       "      <td id=\"T_df10c_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
       "      <td id=\"T_df10c_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
       "      <td id=\"T_df10c_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
       "      <td id=\"T_df10c_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
       "      <td id=\"T_df10c_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
       "      <td id=\"T_df10c_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
       "      <td id=\"T_df10c_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
       "      <td id=\"T_df10c_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
       "      <td id=\"T_df10c_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
       "      <td id=\"T_df10c_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
       "      <td id=\"T_df10c_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
       "      <td id=\"T_df10c_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
       "      <td id=\"T_df10c_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
       "      <td id=\"T_df10c_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
       "      <td id=\"T_df10c_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
       "      <td id=\"T_df10c_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
       "      <td id=\"T_df10c_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
       "      <td id=\"T_df10c_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
       "      <td id=\"T_df10c_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
       "      <td id=\"T_df10c_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
       "      <td id=\"T_df10c_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
       "      <td id=\"T_df10c_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
       "      <td id=\"T_df10c_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
       "      <td id=\"T_df10c_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
       "      <td id=\"T_df10c_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
       "      <td id=\"T_df10c_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
       "      <td id=\"T_df10c_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
       "      <td id=\"T_df10c_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
       "      <td id=\"T_df10c_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
       "      <td id=\"T_df10c_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
       "      <td id=\"T_df10c_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
       "      <td id=\"T_df10c_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
       "      <td id=\"T_df10c_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
       "      <td id=\"T_df10c_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
       "      <td id=\"T_df10c_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
       "      <td id=\"T_df10c_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
       "      <td id=\"T_df10c_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
       "      <td id=\"T_df10c_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
       "      <td id=\"T_df10c_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
       "      <td id=\"T_df10c_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
       "      <td id=\"T_df10c_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
       "      <td id=\"T_df10c_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
       "      <td id=\"T_df10c_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
       "      <td id=\"T_df10c_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
       "      <td id=\"T_df10c_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
       "      <td id=\"T_df10c_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
       "      <td id=\"T_df10c_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
       "      <td id=\"T_df10c_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
       "      <td id=\"T_df10c_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
       "      <td id=\"T_df10c_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
       "      <td id=\"T_df10c_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
       "      <td id=\"T_df10c_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
       "      <td id=\"T_df10c_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
       "      <td id=\"T_df10c_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
       "      <td id=\"T_df10c_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
       "      <td id=\"T_df10c_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
       "      <td id=\"T_df10c_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
       "      <td id=\"T_df10c_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
       "      <td id=\"T_df10c_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
       "      <td id=\"T_df10c_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
       "      <td id=\"T_df10c_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
       "      <td id=\"T_df10c_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
       "      <td id=\"T_df10c_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
       "      <td id=\"T_df10c_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
       "      <td id=\"T_df10c_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
       "      <td id=\"T_df10c_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
       "      <td id=\"T_df10c_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
       "      <td id=\"T_df10c_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
       "      <td id=\"T_df10c_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
       "      <td id=\"T_df10c_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
       "      <td id=\"T_df10c_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
       "      <td id=\"T_df10c_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
       "      <td id=\"T_df10c_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
       "      <td id=\"T_df10c_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
       "      <td id=\"T_df10c_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
       "      <td id=\"T_df10c_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
       "      <td id=\"T_df10c_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
       "      <td id=\"T_df10c_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
       "      <td id=\"T_df10c_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
       "      <td id=\"T_df10c_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
       "      <td id=\"T_df10c_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
       "      <td id=\"T_df10c_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
       "      <td id=\"T_df10c_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
       "      <td id=\"T_df10c_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
       "      <td id=\"T_df10c_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
       "      <td id=\"T_df10c_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
       "      <td id=\"T_df10c_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
       "      <td id=\"T_df10c_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
       "      <td id=\"T_df10c_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
       "      <td id=\"T_df10c_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
       "      <td id=\"T_df10c_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
       "      <td id=\"T_df10c_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
       "      <td id=\"T_df10c_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
       "      <td id=\"T_df10c_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
       "      <td id=\"T_df10c_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
       "      <td id=\"T_df10c_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
       "      <td id=\"T_df10c_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
       "      <td id=\"T_df10c_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
       "      <td id=\"T_df10c_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
       "      <td id=\"T_df10c_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
       "      <td id=\"T_df10c_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
       "      <td id=\"T_df10c_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
       "      <td id=\"T_df10c_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
       "      <td id=\"T_df10c_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
       "      <td id=\"T_df10c_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
       "      <td id=\"T_df10c_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
       "      <td id=\"T_df10c_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
       "      <td id=\"T_df10c_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
       "      <td id=\"T_df10c_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
       "      <td id=\"T_df10c_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
       "      <td id=\"T_df10c_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
       "      <td id=\"T_df10c_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
       "      <td id=\"T_df10c_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
       "      <td id=\"T_df10c_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
       "      <td id=\"T_df10c_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
       "      <td id=\"T_df10c_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
       "      <td id=\"T_df10c_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
       "      <td id=\"T_df10c_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
       "      <td id=\"T_df10c_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
       "      <td id=\"T_df10c_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
       "      <td id=\"T_df10c_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
       "      <td id=\"T_df10c_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
       "      <td id=\"T_df10c_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
       "      <td id=\"T_df10c_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
       "      <td id=\"T_df10c_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
       "      <td id=\"T_df10c_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
       "      <td id=\"T_df10c_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
       "      <td id=\"T_df10c_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
       "      <td id=\"T_df10c_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
       "      <td id=\"T_df10c_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
       "      <td id=\"T_df10c_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
       "      <td id=\"T_df10c_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
       "      <td id=\"T_df10c_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
       "      <td id=\"T_df10c_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
       "      <td id=\"T_df10c_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
       "      <td id=\"T_df10c_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
       "      <td id=\"T_df10c_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
       "      <td id=\"T_df10c_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
       "      <td id=\"T_df10c_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
       "      <td id=\"T_df10c_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
       "      <td id=\"T_df10c_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
       "      <td id=\"T_df10c_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
       "      <td id=\"T_df10c_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
       "      <td id=\"T_df10c_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
       "      <td id=\"T_df10c_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
       "      <td id=\"T_df10c_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
       "      <td id=\"T_df10c_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
       "      <td id=\"T_df10c_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
       "      <td id=\"T_df10c_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
       "      <td id=\"T_df10c_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
       "      <td id=\"T_df10c_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
       "      <td id=\"T_df10c_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
       "      <td id=\"T_df10c_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
       "      <td id=\"T_df10c_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
       "      <td id=\"T_df10c_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
       "      <td id=\"T_df10c_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
       "      <td id=\"T_df10c_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
       "      <td id=\"T_df10c_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
       "      <td id=\"T_df10c_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
       "      <td id=\"T_df10c_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
       "      <td id=\"T_df10c_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
       "      <td id=\"T_df10c_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
       "      <td id=\"T_df10c_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
       "      <td id=\"T_df10c_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_df10c_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
       "      <td id=\"T_df10c_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
       "      <td id=\"T_df10c_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
       "      <td id=\"T_df10c_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
       "      <td id=\"T_df10c_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
       "      <td id=\"T_df10c_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1b6790>"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.style.applymap(highlight_cells_3)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d5b5a932-286d-4e02-b642-c02c40e4b454",
   "metadata": {},
   "source": [
    "### Summary of Mitre Attack ID that detects 3/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "00422f3c-2dc7-4fe2-b942-83c63535edd3",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "      <th>2</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1071</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.001</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1543.003</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1548</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1555.003</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1555</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1548.002</th>\n",
       "      <td>AgentTesla</td>\n",
       "      <td>Azorult</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1112</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1547.001</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1547</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1055</th>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                    0        1         2\n",
       "T1071      AgentTesla  Azorult    Qakbot\n",
       "T1059.001  AgentTesla  Azorult    Qakbot\n",
       "T1543.003  AgentTesla  Azorult    Qakbot\n",
       "T1548      AgentTesla  Azorult    Remcos\n",
       "T1555.003  AgentTesla  Azorult    Remcos\n",
       "T1555      AgentTesla  Azorult    Remcos\n",
       "T1548.002  AgentTesla  Azorult    Remcos\n",
       "T1112         Azorult   Qakbot    Remcos\n",
       "T1547.001     Azorult   Qakbot    Remcos\n",
       "T1547         Azorult   Qakbot    Remcos\n",
       "T1055          Qakbot   Remcos  Trickbot"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 3)\n",
    "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
    "tdf = tdf.sort_values(by=[0,1,2])\n",
    "tdf"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "917b867f-73df-432d-ad61-f8288ed0bd17",
   "metadata": {},
   "source": [
    "### detection list for Mitre Attack ID that detects 3/5 malware families"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "4b5556a3-185b-4d09-9b11-8754f8a63668",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(11, 5)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Trickbot</th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Azorult</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1055</th>\n",
       "      <td>[create_remote_thread_in_shell_application.yml, windows_command_shell_fetch_env_variables.yml, windows_process_injection_of_wermgr_to_known_browser.yml, windows_process_injection_remote_thread.yml, windows_process_injection_wermgr_child_process.yml]</td>\n",
       "      <td>[loading_of_dynwrapx_module.yml, winhlp32_spawning_a_process.yml, wscript_or_cscript_suspicious_child_process.yml]</td>\n",
       "      <td>[cobalt_strike_named_pipes.yml, powershell_remote_thread_to_known_windows_process.yml, trickbot_named_pipe.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1071</th>\n",
       "      <td>[windows_app_layer_protocol_qakbot_namedpipe.yml, windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml]</td>\n",
       "      <td>[windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1112</th>\n",
       "      <td>[windows_modify_registry_qakbot_binary_data_registry.yml]</td>\n",
       "      <td>[malicious_inprocserver32_modification.yml, remcos_client_registry_install_entry.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_modify_registry_disable_toast_notifications.yml, windows_modify_registry_disable_win_defender_raw_write_notif.yml, windows_modify_registry_disable_windows_security_center_notif.yml, windows_modify_registry_disabling_wer_settings.yml, windows_modify_registry_disallow_windows_app.yml, windows_modify_registry_regedit_silent_reg_import.yml, windows_modify_registry_suppress_win_defender_notif.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.001</th>\n",
       "      <td>[recon_using_wmi_class.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml]</td>\n",
       "      <td>[windows_powershell_import_applocker_policy.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1543.003</th>\n",
       "      <td>[services_exe_lolbas_execution_process_spawn.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[suspicious_driver_loaded_path.yml]</td>\n",
       "      <td>[sc_exe_manipulating_windows_services.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1547.001</th>\n",
       "      <td>[registry_keys_used_for_persistence.yml]</td>\n",
       "      <td>[registry_keys_used_for_persistence.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[registry_keys_used_for_persistence.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1547</th>\n",
       "      <td>[registry_keys_used_for_persistence.yml]</td>\n",
       "      <td>[registry_keys_used_for_persistence.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[registry_keys_used_for_persistence.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1548</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[disabling_remote_user_account_control.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[disabling_remote_user_account_control.yml]</td>\n",
       "      <td>[allow_operation_with_consent_admin.yml, disabling_remote_user_account_control.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1555.003</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
       "      <td>[non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1555</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
       "      <td>[non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1548.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[disabling_remote_user_account_control.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[disabling_remote_user_account_control.yml]</td>\n",
       "      <td>[disabling_remote_user_account_control.yml]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                                                                                                                                                                                                                              Qakbot  \\\n",
       "T1055      [create_remote_thread_in_shell_application.yml, windows_command_shell_fetch_env_variables.yml, windows_process_injection_of_wermgr_to_known_browser.yml, windows_process_injection_remote_thread.yml, windows_process_injection_wermgr_child_process.yml]   \n",
       "T1071                                                                                                                                                  [windows_app_layer_protocol_qakbot_namedpipe.yml, windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml]   \n",
       "T1112                                                                                                                                                                                                      [windows_modify_registry_qakbot_binary_data_registry.yml]   \n",
       "T1059.001                                                                                                                                                                                                                                [recon_using_wmi_class.yml]   \n",
       "T1543.003                                                                                                                                                                                                          [services_exe_lolbas_execution_process_spawn.yml]   \n",
       "T1547.001                                                                                                                                                                                                                   [registry_keys_used_for_persistence.yml]   \n",
       "T1547                                                                                                                                                                                                                       [registry_keys_used_for_persistence.yml]   \n",
       "T1548                                                                                                                                                                                                                                                            NaN   \n",
       "T1555.003                                                                                                                                                                                                                                                        NaN   \n",
       "T1555                                                                                                                                                                                                                                                            NaN   \n",
       "T1548.002                                                                                                                                                                                                                                                        NaN   \n",
       "\n",
       "                                                                                                                                                        Remcos  \\\n",
       "T1055                                       [loading_of_dynwrapx_module.yml, winhlp32_spawning_a_process.yml, wscript_or_cscript_suspicious_child_process.yml]   \n",
       "T1071                                                                                                                                                      NaN   \n",
       "T1112                                                                    [malicious_inprocserver32_modification.yml, remcos_client_registry_install_entry.yml]   \n",
       "T1059.001                                                                                                                                                  NaN   \n",
       "T1543.003                                                                                                                                                  NaN   \n",
       "T1547.001                                                                                                             [registry_keys_used_for_persistence.yml]   \n",
       "T1547                                                                                                                 [registry_keys_used_for_persistence.yml]   \n",
       "T1548                                                                                                              [disabling_remote_user_account_control.yml]   \n",
       "T1555.003  [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]   \n",
       "T1555      [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]   \n",
       "T1548.002                                                                                                          [disabling_remote_user_account_control.yml]   \n",
       "\n",
       "                                                                                                                  Trickbot  \\\n",
       "T1055      [cobalt_strike_named_pipes.yml, powershell_remote_thread_to_known_windows_process.yml, trickbot_named_pipe.yml]   \n",
       "T1071                                                                                                                  NaN   \n",
       "T1112                                                                                                                  NaN   \n",
       "T1059.001                                                                                                              NaN   \n",
       "T1543.003                                                                                                              NaN   \n",
       "T1547.001                                                                                                              NaN   \n",
       "T1547                                                                                                                  NaN   \n",
       "T1548                                                                                                                  NaN   \n",
       "T1555.003                                                                                                              NaN   \n",
       "T1555                                                                                                                  NaN   \n",
       "T1548.002                                                                                                              NaN   \n",
       "\n",
       "                                                                                                                                                                     AgentTesla  \\\n",
       "T1055                                                                                                                                                                       NaN   \n",
       "T1071      [windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml]   \n",
       "T1112                                                                                                                                                                       NaN   \n",
       "T1059.001                                                   [powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml]   \n",
       "T1543.003                                                                                                                                   [suspicious_driver_loaded_path.yml]   \n",
       "T1547.001                                                                                                                                                                   NaN   \n",
       "T1547                                                                                                                                                                       NaN   \n",
       "T1548                                                                                                                               [disabling_remote_user_account_control.yml]   \n",
       "T1555.003                                                             [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml]   \n",
       "T1555                                                                 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml]   \n",
       "T1548.002                                                                                                                           [disabling_remote_user_account_control.yml]   \n",
       "\n",
       "                                                                                                                                                                                                                                                                                                                                                                                                                        Azorult  \n",
       "T1055                                                                                                                                                                                                                                                                                                                                                                                                                       NaN  \n",
       "T1071                                                                                                                                                                                                                                                                                                                                                        [windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml]  \n",
       "T1112      [windows_modify_registry_disable_toast_notifications.yml, windows_modify_registry_disable_win_defender_raw_write_notif.yml, windows_modify_registry_disable_windows_security_center_notif.yml, windows_modify_registry_disabling_wer_settings.yml, windows_modify_registry_disallow_windows_app.yml, windows_modify_registry_regedit_silent_reg_import.yml, windows_modify_registry_suppress_win_defender_notif.yml]  \n",
       "T1059.001                                                                                                                                                                                                                                                                                                                                                                      [windows_powershell_import_applocker_policy.yml]  \n",
       "T1543.003                                                                                                                                                                                                                                                                                                                                                                            [sc_exe_manipulating_windows_services.yml]  \n",
       "T1547.001                                                                                                                                                                                                                                                                                                                                                                              [registry_keys_used_for_persistence.yml]  \n",
       "T1547                                                                                                                                                                                                                                                                                                                                                                                  [registry_keys_used_for_persistence.yml]  \n",
       "T1548                                                                                                                                                                                                                                                                                                                                       [allow_operation_with_consent_admin.yml, disabling_remote_user_account_control.yml]  \n",
       "T1555.003                                                                                                                                                                                                                                                                                                                                                                  [non_firefox_process_access_firefox_profile_dir.yml]  \n",
       "T1555                                                                                                                                                                                                                                                                                                                                                                      [non_firefox_process_access_firefox_profile_dir.yml]  \n",
       "T1548.002                                                                                                                                                                                                                                                                                                                                                                           [disabling_remote_user_account_control.yml]  "
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "det_table_dict = detection_list_by_id(temp_dict)\n",
    "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
    "print(tdf.shape)\n",
    "tdf  "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cb75a49c-d35f-47ee-bad3-bb31e7e7d041",
   "metadata": {},
   "source": [
    "### detection count per mitre attack id in each malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "72b34254-fd19-4c37-a0e2-df5cb3934cb3",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Trickbot</th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Azorult</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1055</th>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1071</th>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1112</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(7)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.001</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1543.003</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1547.001</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1547</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1548</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(2)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1555.003</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1555</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1548.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                        Qakbot               Remcos             Trickbot  \\\n",
       "T1055      (5)-detection count  (3)-detection count  (3)-detection count   \n",
       "T1071      (2)-detection count                  NaN                  NaN   \n",
       "T1112      (1)-detection count  (2)-detection count                  NaN   \n",
       "T1059.001  (1)-detection count                  NaN                  NaN   \n",
       "T1543.003  (1)-detection count                  NaN                  NaN   \n",
       "T1547.001  (1)-detection count  (1)-detection count                  NaN   \n",
       "T1547      (1)-detection count  (1)-detection count                  NaN   \n",
       "T1548                      NaN  (1)-detection count                  NaN   \n",
       "T1555.003                  NaN  (3)-detection count                  NaN   \n",
       "T1555                      NaN  (3)-detection count                  NaN   \n",
       "T1548.002                  NaN  (1)-detection count                  NaN   \n",
       "\n",
       "                    AgentTesla              Azorult  \n",
       "T1055                      NaN                  NaN  \n",
       "T1071      (3)-detection count  (1)-detection count  \n",
       "T1112                      NaN  (7)-detection count  \n",
       "T1059.001  (2)-detection count  (1)-detection count  \n",
       "T1543.003  (1)-detection count  (1)-detection count  \n",
       "T1547.001                  NaN  (1)-detection count  \n",
       "T1547                      NaN  (1)-detection count  \n",
       "T1548      (1)-detection count  (2)-detection count  \n",
       "T1555.003  (2)-detection count  (1)-detection count  \n",
       "T1555      (2)-detection count  (1)-detection count  \n",
       "T1548.002  (1)-detection count  (1)-detection count  "
      ]
     },
     "execution_count": 23,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "detection_list_by_count(det_table_dict)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4289037d-495e-4f38-8d3c-c724a2805a9c",
   "metadata": {},
   "source": [
    "### Highlight Mitre Attack ID that detects 2/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "45ebfd15-bdbe-4415-bcea-c94558ba6a7a",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_8409a_row0_col0 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_8409a_row1_col0 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_8409a_row2_col0 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_8409a_row3_col0 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_8409a_row4_col0 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_8409a\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_8409a_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_8409a_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
       "      <td id=\"T_8409a_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8409a_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
       "      <td id=\"T_8409a_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8409a_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
       "      <td id=\"T_8409a_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8409a_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
       "      <td id=\"T_8409a_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8409a_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
       "      <td id=\"T_8409a_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1d2f10>"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "show_legend()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "id": "d28d99e3-aab1-4a7a-8a04-ec88b390abfe",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_23e9f_row0_col2, #T_23e9f_row0_col4, #T_23e9f_row2_col0, #T_23e9f_row2_col3, #T_23e9f_row2_col4, #T_23e9f_row3_col2, #T_23e9f_row5_col0, #T_23e9f_row7_col3, #T_23e9f_row8_col2, #T_23e9f_row11_col3, #T_23e9f_row14_col0, #T_23e9f_row15_col3, #T_23e9f_row16_col3, #T_23e9f_row18_col4, #T_23e9f_row19_col4, #T_23e9f_row22_col3, #T_23e9f_row27_col0, #T_23e9f_row33_col3, #T_23e9f_row34_col3, #T_23e9f_row37_col2, #T_23e9f_row38_col2, #T_23e9f_row38_col3, #T_23e9f_row39_col2, #T_23e9f_row40_col2 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_23e9f\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_23e9f_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
       "      <th id=\"T_23e9f_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
       "      <th id=\"T_23e9f_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
       "      <th id=\"T_23e9f_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
       "      <th id=\"T_23e9f_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
       "      <td id=\"T_23e9f_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
       "      <td id=\"T_23e9f_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
       "      <td id=\"T_23e9f_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
       "      <td id=\"T_23e9f_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
       "      <td id=\"T_23e9f_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
       "      <td id=\"T_23e9f_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
       "      <td id=\"T_23e9f_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
       "      <td id=\"T_23e9f_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
       "      <td id=\"T_23e9f_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
       "      <td id=\"T_23e9f_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
       "      <td id=\"T_23e9f_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
       "      <td id=\"T_23e9f_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
       "      <td id=\"T_23e9f_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
       "      <td id=\"T_23e9f_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
       "      <td id=\"T_23e9f_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
       "      <td id=\"T_23e9f_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
       "      <td id=\"T_23e9f_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
       "      <td id=\"T_23e9f_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
       "      <td id=\"T_23e9f_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
       "      <td id=\"T_23e9f_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
       "      <td id=\"T_23e9f_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
       "      <td id=\"T_23e9f_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
       "      <td id=\"T_23e9f_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
       "      <td id=\"T_23e9f_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
       "      <td id=\"T_23e9f_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
       "      <td id=\"T_23e9f_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
       "      <td id=\"T_23e9f_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
       "      <td id=\"T_23e9f_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
       "      <td id=\"T_23e9f_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
       "      <td id=\"T_23e9f_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
       "      <td id=\"T_23e9f_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
       "      <td id=\"T_23e9f_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
       "      <td id=\"T_23e9f_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
       "      <td id=\"T_23e9f_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
       "      <td id=\"T_23e9f_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
       "      <td id=\"T_23e9f_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
       "      <td id=\"T_23e9f_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
       "      <td id=\"T_23e9f_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
       "      <td id=\"T_23e9f_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
       "      <td id=\"T_23e9f_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
       "      <td id=\"T_23e9f_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
       "      <td id=\"T_23e9f_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
       "      <td id=\"T_23e9f_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
       "      <td id=\"T_23e9f_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
       "      <td id=\"T_23e9f_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
       "      <td id=\"T_23e9f_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
       "      <td id=\"T_23e9f_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
       "      <td id=\"T_23e9f_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
       "      <td id=\"T_23e9f_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
       "      <td id=\"T_23e9f_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
       "      <td id=\"T_23e9f_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
       "      <td id=\"T_23e9f_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
       "      <td id=\"T_23e9f_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
       "      <td id=\"T_23e9f_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
       "      <td id=\"T_23e9f_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
       "      <td id=\"T_23e9f_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
       "      <td id=\"T_23e9f_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
       "      <td id=\"T_23e9f_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
       "      <td id=\"T_23e9f_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
       "      <td id=\"T_23e9f_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
       "      <td id=\"T_23e9f_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
       "      <td id=\"T_23e9f_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
       "      <td id=\"T_23e9f_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
       "      <td id=\"T_23e9f_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
       "      <td id=\"T_23e9f_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
       "      <td id=\"T_23e9f_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
       "      <td id=\"T_23e9f_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
       "      <td id=\"T_23e9f_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
       "      <td id=\"T_23e9f_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
       "      <td id=\"T_23e9f_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
       "      <td id=\"T_23e9f_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
       "      <td id=\"T_23e9f_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
       "      <td id=\"T_23e9f_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
       "      <td id=\"T_23e9f_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
       "      <td id=\"T_23e9f_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
       "      <td id=\"T_23e9f_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
       "      <td id=\"T_23e9f_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
       "      <td id=\"T_23e9f_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
       "      <td id=\"T_23e9f_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
       "      <td id=\"T_23e9f_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
       "      <td id=\"T_23e9f_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
       "      <td id=\"T_23e9f_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
       "      <td id=\"T_23e9f_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
       "      <td id=\"T_23e9f_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
       "      <td id=\"T_23e9f_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
       "      <td id=\"T_23e9f_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
       "      <td id=\"T_23e9f_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
       "      <td id=\"T_23e9f_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
       "      <td id=\"T_23e9f_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
       "      <td id=\"T_23e9f_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
       "      <td id=\"T_23e9f_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
       "      <td id=\"T_23e9f_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
       "      <td id=\"T_23e9f_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
       "      <td id=\"T_23e9f_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
       "      <td id=\"T_23e9f_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
       "      <td id=\"T_23e9f_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
       "      <td id=\"T_23e9f_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
       "      <td id=\"T_23e9f_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
       "      <td id=\"T_23e9f_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
       "      <td id=\"T_23e9f_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
       "      <td id=\"T_23e9f_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
       "      <td id=\"T_23e9f_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
       "      <td id=\"T_23e9f_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
       "      <td id=\"T_23e9f_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
       "      <td id=\"T_23e9f_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
       "      <td id=\"T_23e9f_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
       "      <td id=\"T_23e9f_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
       "      <td id=\"T_23e9f_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
       "      <td id=\"T_23e9f_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
       "      <td id=\"T_23e9f_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
       "      <td id=\"T_23e9f_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
       "      <td id=\"T_23e9f_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
       "      <td id=\"T_23e9f_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
       "      <td id=\"T_23e9f_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
       "      <td id=\"T_23e9f_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
       "      <td id=\"T_23e9f_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
       "      <td id=\"T_23e9f_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
       "      <td id=\"T_23e9f_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
       "      <td id=\"T_23e9f_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
       "      <td id=\"T_23e9f_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
       "      <td id=\"T_23e9f_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
       "      <td id=\"T_23e9f_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
       "      <td id=\"T_23e9f_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
       "      <td id=\"T_23e9f_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
       "      <td id=\"T_23e9f_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
       "      <td id=\"T_23e9f_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
       "      <td id=\"T_23e9f_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
       "      <td id=\"T_23e9f_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
       "      <td id=\"T_23e9f_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
       "      <td id=\"T_23e9f_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
       "      <td id=\"T_23e9f_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
       "      <td id=\"T_23e9f_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
       "      <td id=\"T_23e9f_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
       "      <td id=\"T_23e9f_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
       "      <td id=\"T_23e9f_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
       "      <td id=\"T_23e9f_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
       "      <td id=\"T_23e9f_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
       "      <td id=\"T_23e9f_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
       "      <td id=\"T_23e9f_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
       "      <td id=\"T_23e9f_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
       "      <td id=\"T_23e9f_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
       "      <td id=\"T_23e9f_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
       "      <td id=\"T_23e9f_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
       "      <td id=\"T_23e9f_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
       "      <td id=\"T_23e9f_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
       "      <td id=\"T_23e9f_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
       "      <td id=\"T_23e9f_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
       "      <td id=\"T_23e9f_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
       "      <td id=\"T_23e9f_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
       "      <td id=\"T_23e9f_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
       "      <td id=\"T_23e9f_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
       "      <td id=\"T_23e9f_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
       "      <td id=\"T_23e9f_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
       "      <td id=\"T_23e9f_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
       "      <td id=\"T_23e9f_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
       "      <td id=\"T_23e9f_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
       "      <td id=\"T_23e9f_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
       "      <td id=\"T_23e9f_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
       "      <td id=\"T_23e9f_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
       "      <td id=\"T_23e9f_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
       "      <td id=\"T_23e9f_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
       "      <td id=\"T_23e9f_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
       "      <td id=\"T_23e9f_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
       "      <td id=\"T_23e9f_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
       "      <td id=\"T_23e9f_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
       "      <td id=\"T_23e9f_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
       "      <td id=\"T_23e9f_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
       "      <td id=\"T_23e9f_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
       "      <td id=\"T_23e9f_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
       "      <td id=\"T_23e9f_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
       "      <td id=\"T_23e9f_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_23e9f_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
       "      <td id=\"T_23e9f_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
       "      <td id=\"T_23e9f_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
       "      <td id=\"T_23e9f_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
       "      <td id=\"T_23e9f_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
       "      <td id=\"T_23e9f_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c2410d0>"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.style.applymap(highlight_cells_2)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "12972dd1-7e11-4097-b4fa-168c45a3ab2c",
   "metadata": {},
   "source": [
    "### Summary of Mitre Attack ID that detects 2/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "49b832b4-2436-4cef-98fe-997a2679d0c0",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1049</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.003</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1569</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1569.002</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1021</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1590</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1590.005</th>\n",
       "      <td>Azorult</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.007</th>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.010</th>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1055.001</th>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1592</th>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1027</th>\n",
       "      <td>Qakbot</td>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                 0         1\n",
       "T1049      Azorult    Qakbot\n",
       "T1059.003  Azorult    Qakbot\n",
       "T1569      Azorult    Qakbot\n",
       "T1569.002  Azorult    Qakbot\n",
       "T1021      Azorult  Trickbot\n",
       "T1590      Azorult  Trickbot\n",
       "T1590.005  Azorult  Trickbot\n",
       "T1059.007   Qakbot    Remcos\n",
       "T1218.010   Qakbot    Remcos\n",
       "T1055.001   Qakbot    Remcos\n",
       "T1592       Qakbot    Remcos\n",
       "T1027       Qakbot  Trickbot"
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 2)\n",
    "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
    "tdf = tdf.sort_values(by=[0,1])\n",
    "tdf"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "02cb02d6-310e-44fa-a701-2dcdc0338a10",
   "metadata": {},
   "source": [
    "### detection list for Mitre Attack ID that detects 2/5 malware families"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "id": "da26ea7f-7d62-47cc-a1e3-95442104d188",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(12, 4)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Trickbot</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1021</th>\n",
       "      <td>[allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml]</td>\n",
       "      <td>[executable_file_written_in_administrative_smb_share.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1590</th>\n",
       "      <td>[windows_gather_victim_network_info_through_ip_check_web_services.yml]</td>\n",
       "      <td>[wermgr_process_connecting_to_ip_check_web_services.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1590.005</th>\n",
       "      <td>[windows_gather_victim_network_info_through_ip_check_web_services.yml]</td>\n",
       "      <td>[wermgr_process_connecting_to_ip_check_web_services.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1049</th>\n",
       "      <td>[network_connection_discovery_net.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[network_connection_discovery_arp.yml, network_connection_discovery_netstat.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.003</th>\n",
       "      <td>[cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[cmd_carry_out_string_command_parameter.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1569</th>\n",
       "      <td>[excessive_usage_of_sc_service_utility.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_service_created_with_suspicious_service_path.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1569.002</th>\n",
       "      <td>[excessive_usage_of_sc_service_utility.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_service_created_with_suspicious_service_path.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1027</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[wermgr_process_create_executable_file.yml]</td>\n",
       "      <td>[malicious_powershell_process___encoded_command.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.007</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[cmdline_tool_not_executed_in_cmd_shell.yml]</td>\n",
       "      <td>[jscript_execution_using_cscript_app.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.010</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml]</td>\n",
       "      <td>[malicious_inprocserver32_modification.yml, regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1055.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_process_injection_of_wermgr_to_known_browser.yml]</td>\n",
       "      <td>[loading_of_dynwrapx_module.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1592</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[recon_avproduct_through_pwh_or_wmi.yml, recon_using_wmi_class.yml]</td>\n",
       "      <td>[system_info_gathering_using_dxdiag_application.yml]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                                                                                                                                                                                                                             Azorult  \\\n",
       "T1021      [allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml]   \n",
       "T1590                                                                                                                                                                                         [windows_gather_victim_network_info_through_ip_check_web_services.yml]   \n",
       "T1590.005                                                                                                                                                                                     [windows_gather_victim_network_info_through_ip_check_web_services.yml]   \n",
       "T1049                                                                                                                                                                                                                         [network_connection_discovery_net.yml]   \n",
       "T1059.003                                                                                                                                                      [cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml]   \n",
       "T1569                                                                                                                                                                                                                    [excessive_usage_of_sc_service_utility.yml]   \n",
       "T1569.002                                                                                                                                                                                                                [excessive_usage_of_sc_service_utility.yml]   \n",
       "T1027                                                                                                                                                                                                                                                            NaN   \n",
       "T1059.007                                                                                                                                                                                                                                                        NaN   \n",
       "T1218.010                                                                                                                                                                                                                                                        NaN   \n",
       "T1055.001                                                                                                                                                                                                                                                        NaN   \n",
       "T1592                                                                                                                                                                                                                                                            NaN   \n",
       "\n",
       "                                                            Trickbot  \\\n",
       "T1021      [executable_file_written_in_administrative_smb_share.yml]   \n",
       "T1590       [wermgr_process_connecting_to_ip_check_web_services.yml]   \n",
       "T1590.005   [wermgr_process_connecting_to_ip_check_web_services.yml]   \n",
       "T1049                                                            NaN   \n",
       "T1059.003                                                        NaN   \n",
       "T1569                                                            NaN   \n",
       "T1569.002                                                        NaN   \n",
       "T1027                    [wermgr_process_create_executable_file.yml]   \n",
       "T1059.007                                                        NaN   \n",
       "T1218.010                                                        NaN   \n",
       "T1055.001                                                        NaN   \n",
       "T1592                                                            NaN   \n",
       "\n",
       "                                                                                                                                           Qakbot  \\\n",
       "T1021                                                                                                                                         NaN   \n",
       "T1590                                                                                                                                         NaN   \n",
       "T1590.005                                                                                                                                     NaN   \n",
       "T1049                                                            [network_connection_discovery_arp.yml, network_connection_discovery_netstat.yml]   \n",
       "T1059.003                                                                                            [cmd_carry_out_string_command_parameter.yml]   \n",
       "T1569                                                                                  [windows_service_created_with_suspicious_service_path.yml]   \n",
       "T1569.002                                                                              [windows_service_created_with_suspicious_service_path.yml]   \n",
       "T1027                                                                                        [malicious_powershell_process___encoded_command.yml]   \n",
       "T1059.007                                                                                            [cmdline_tool_not_executed_in_cmd_shell.yml]   \n",
       "T1218.010  [regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml]   \n",
       "T1055.001                                                                              [windows_process_injection_of_wermgr_to_known_browser.yml]   \n",
       "T1592                                                                         [recon_avproduct_through_pwh_or_wmi.yml, recon_using_wmi_class.yml]   \n",
       "\n",
       "                                                                                                                                                  Remcos  \n",
       "T1021                                                                                                                                                NaN  \n",
       "T1590                                                                                                                                                NaN  \n",
       "T1590.005                                                                                                                                            NaN  \n",
       "T1049                                                                                                                                                NaN  \n",
       "T1059.003                                                                                                                                            NaN  \n",
       "T1569                                                                                                                                                NaN  \n",
       "T1569.002                                                                                                                                            NaN  \n",
       "T1027                                                                                                                                                NaN  \n",
       "T1059.007                                                                                                      [jscript_execution_using_cscript_app.yml]  \n",
       "T1218.010  [malicious_inprocserver32_modification.yml, regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml]  \n",
       "T1055.001                                                                                                               [loading_of_dynwrapx_module.yml]  \n",
       "T1592                                                                                               [system_info_gathering_using_dxdiag_application.yml]  "
      ]
     },
     "execution_count": 27,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "det_table_dict = detection_list_by_id(temp_dict)\n",
    "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
    "print(tdf.shape)\n",
    "tdf "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cc2bef38-a3e2-4081-a447-86c1e70d433f",
   "metadata": {},
   "source": [
    "### detection count per mitre attack id in each malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "id": "5863c606-ed0c-475d-b37d-1d4e8f9502a6",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Trickbot</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>Remcos</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1021</th>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1590</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1590.005</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1049</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.003</th>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1569</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1569.002</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1027</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.007</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.010</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>(3)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1055.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1592</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                       Azorult             Trickbot               Qakbot  \\\n",
       "T1021      (5)-detection count  (1)-detection count                  NaN   \n",
       "T1590      (1)-detection count  (1)-detection count                  NaN   \n",
       "T1590.005  (1)-detection count  (1)-detection count                  NaN   \n",
       "T1049      (1)-detection count                  NaN  (2)-detection count   \n",
       "T1059.003  (2)-detection count                  NaN  (1)-detection count   \n",
       "T1569      (1)-detection count                  NaN  (1)-detection count   \n",
       "T1569.002  (1)-detection count                  NaN  (1)-detection count   \n",
       "T1027                      NaN  (1)-detection count  (1)-detection count   \n",
       "T1059.007                  NaN                  NaN  (1)-detection count   \n",
       "T1218.010                  NaN                  NaN  (3)-detection count   \n",
       "T1055.001                  NaN                  NaN  (1)-detection count   \n",
       "T1592                      NaN                  NaN  (2)-detection count   \n",
       "\n",
       "                        Remcos  \n",
       "T1021                      NaN  \n",
       "T1590                      NaN  \n",
       "T1590.005                  NaN  \n",
       "T1049                      NaN  \n",
       "T1059.003                  NaN  \n",
       "T1569                      NaN  \n",
       "T1569.002                  NaN  \n",
       "T1027                      NaN  \n",
       "T1059.007  (1)-detection count  \n",
       "T1218.010  (3)-detection count  \n",
       "T1055.001  (1)-detection count  \n",
       "T1592      (1)-detection count  "
      ]
     },
     "execution_count": 28,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "detection_list_by_count(det_table_dict)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "316697a7-1d08-442d-849d-72a17764495d",
   "metadata": {},
   "source": [
    "### Highlight Mitre Attack ID that detects 1/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "id": "5805b5e1-679d-45b5-8e31-19cbc6edd390",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_81a9c_row0_col0 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_81a9c_row1_col0 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_81a9c_row2_col0 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_81a9c_row3_col0 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_81a9c_row4_col0 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_81a9c\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_81a9c_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_81a9c_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
       "      <td id=\"T_81a9c_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_81a9c_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
       "      <td id=\"T_81a9c_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_81a9c_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
       "      <td id=\"T_81a9c_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_81a9c_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
       "      <td id=\"T_81a9c_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_81a9c_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
       "      <td id=\"T_81a9c_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c2410a0>"
      ]
     },
     "execution_count": 29,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "show_legend()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "id": "1ed5bbe5-d4e8-42f3-b086-9bc065f314ed",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_97b18_row0_col1, #T_97b18_row0_col3, #T_97b18_row1_col2, #T_97b18_row1_col3, #T_97b18_row1_col4, #T_97b18_row3_col3, #T_97b18_row4_col0, #T_97b18_row5_col3, #T_97b18_row6_col0, #T_97b18_row6_col1, #T_97b18_row6_col3, #T_97b18_row8_col0, #T_97b18_row8_col1, #T_97b18_row8_col4, #T_97b18_row9_col0, #T_97b18_row9_col2, #T_97b18_row9_col4, #T_97b18_row10_col0, #T_97b18_row10_col2, #T_97b18_row11_col4, #T_97b18_row12_col1, #T_97b18_row12_col3, #T_97b18_row12_col4, #T_97b18_row13_col2, #T_97b18_row14_col2, #T_97b18_row17_col2, #T_97b18_row18_col2, #T_97b18_row19_col2, #T_97b18_row20_col2, #T_97b18_row21_col2, #T_97b18_row22_col0, #T_97b18_row23_col3, #T_97b18_row32_col2, #T_97b18_row32_col3, #T_97b18_row33_col2, #T_97b18_row34_col2, #T_97b18_row35_col3, #T_97b18_row36_col3, #T_97b18_row37_col3 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_97b18\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_97b18_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
       "      <th id=\"T_97b18_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
       "      <th id=\"T_97b18_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
       "      <th id=\"T_97b18_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
       "      <th id=\"T_97b18_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
       "      <td id=\"T_97b18_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
       "      <td id=\"T_97b18_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
       "      <td id=\"T_97b18_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
       "      <td id=\"T_97b18_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
       "      <td id=\"T_97b18_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
       "      <td id=\"T_97b18_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
       "      <td id=\"T_97b18_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
       "      <td id=\"T_97b18_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
       "      <td id=\"T_97b18_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
       "      <td id=\"T_97b18_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
       "      <td id=\"T_97b18_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
       "      <td id=\"T_97b18_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
       "      <td id=\"T_97b18_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
       "      <td id=\"T_97b18_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
       "      <td id=\"T_97b18_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
       "      <td id=\"T_97b18_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
       "      <td id=\"T_97b18_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
       "      <td id=\"T_97b18_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
       "      <td id=\"T_97b18_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
       "      <td id=\"T_97b18_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
       "      <td id=\"T_97b18_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
       "      <td id=\"T_97b18_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
       "      <td id=\"T_97b18_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
       "      <td id=\"T_97b18_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
       "      <td id=\"T_97b18_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
       "      <td id=\"T_97b18_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
       "      <td id=\"T_97b18_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
       "      <td id=\"T_97b18_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
       "      <td id=\"T_97b18_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
       "      <td id=\"T_97b18_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
       "      <td id=\"T_97b18_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
       "      <td id=\"T_97b18_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
       "      <td id=\"T_97b18_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
       "      <td id=\"T_97b18_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
       "      <td id=\"T_97b18_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
       "      <td id=\"T_97b18_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
       "      <td id=\"T_97b18_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
       "      <td id=\"T_97b18_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
       "      <td id=\"T_97b18_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
       "      <td id=\"T_97b18_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
       "      <td id=\"T_97b18_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
       "      <td id=\"T_97b18_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
       "      <td id=\"T_97b18_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
       "      <td id=\"T_97b18_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
       "      <td id=\"T_97b18_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
       "      <td id=\"T_97b18_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
       "      <td id=\"T_97b18_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
       "      <td id=\"T_97b18_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
       "      <td id=\"T_97b18_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
       "      <td id=\"T_97b18_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
       "      <td id=\"T_97b18_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
       "      <td id=\"T_97b18_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
       "      <td id=\"T_97b18_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
       "      <td id=\"T_97b18_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
       "      <td id=\"T_97b18_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
       "      <td id=\"T_97b18_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
       "      <td id=\"T_97b18_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
       "      <td id=\"T_97b18_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
       "      <td id=\"T_97b18_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
       "      <td id=\"T_97b18_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
       "      <td id=\"T_97b18_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
       "      <td id=\"T_97b18_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
       "      <td id=\"T_97b18_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
       "      <td id=\"T_97b18_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
       "      <td id=\"T_97b18_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
       "      <td id=\"T_97b18_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
       "      <td id=\"T_97b18_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
       "      <td id=\"T_97b18_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
       "      <td id=\"T_97b18_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
       "      <td id=\"T_97b18_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
       "      <td id=\"T_97b18_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
       "      <td id=\"T_97b18_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
       "      <td id=\"T_97b18_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
       "      <td id=\"T_97b18_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
       "      <td id=\"T_97b18_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
       "      <td id=\"T_97b18_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
       "      <td id=\"T_97b18_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
       "      <td id=\"T_97b18_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
       "      <td id=\"T_97b18_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
       "      <td id=\"T_97b18_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
       "      <td id=\"T_97b18_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
       "      <td id=\"T_97b18_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
       "      <td id=\"T_97b18_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
       "      <td id=\"T_97b18_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
       "      <td id=\"T_97b18_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
       "      <td id=\"T_97b18_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
       "      <td id=\"T_97b18_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
       "      <td id=\"T_97b18_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
       "      <td id=\"T_97b18_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
       "      <td id=\"T_97b18_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
       "      <td id=\"T_97b18_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
       "      <td id=\"T_97b18_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
       "      <td id=\"T_97b18_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
       "      <td id=\"T_97b18_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
       "      <td id=\"T_97b18_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
       "      <td id=\"T_97b18_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
       "      <td id=\"T_97b18_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
       "      <td id=\"T_97b18_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
       "      <td id=\"T_97b18_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
       "      <td id=\"T_97b18_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
       "      <td id=\"T_97b18_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
       "      <td id=\"T_97b18_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
       "      <td id=\"T_97b18_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
       "      <td id=\"T_97b18_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
       "      <td id=\"T_97b18_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
       "      <td id=\"T_97b18_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
       "      <td id=\"T_97b18_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
       "      <td id=\"T_97b18_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
       "      <td id=\"T_97b18_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
       "      <td id=\"T_97b18_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
       "      <td id=\"T_97b18_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
       "      <td id=\"T_97b18_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
       "      <td id=\"T_97b18_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
       "      <td id=\"T_97b18_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
       "      <td id=\"T_97b18_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
       "      <td id=\"T_97b18_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
       "      <td id=\"T_97b18_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
       "      <td id=\"T_97b18_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
       "      <td id=\"T_97b18_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
       "      <td id=\"T_97b18_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
       "      <td id=\"T_97b18_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
       "      <td id=\"T_97b18_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
       "      <td id=\"T_97b18_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
       "      <td id=\"T_97b18_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
       "      <td id=\"T_97b18_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
       "      <td id=\"T_97b18_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
       "      <td id=\"T_97b18_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
       "      <td id=\"T_97b18_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
       "      <td id=\"T_97b18_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
       "      <td id=\"T_97b18_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
       "      <td id=\"T_97b18_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
       "      <td id=\"T_97b18_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
       "      <td id=\"T_97b18_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
       "      <td id=\"T_97b18_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
       "      <td id=\"T_97b18_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
       "      <td id=\"T_97b18_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
       "      <td id=\"T_97b18_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
       "      <td id=\"T_97b18_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
       "      <td id=\"T_97b18_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
       "      <td id=\"T_97b18_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
       "      <td id=\"T_97b18_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
       "      <td id=\"T_97b18_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
       "      <td id=\"T_97b18_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
       "      <td id=\"T_97b18_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
       "      <td id=\"T_97b18_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
       "      <td id=\"T_97b18_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
       "      <td id=\"T_97b18_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
       "      <td id=\"T_97b18_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
       "      <td id=\"T_97b18_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
       "      <td id=\"T_97b18_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
       "      <td id=\"T_97b18_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
       "      <td id=\"T_97b18_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
       "      <td id=\"T_97b18_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
       "      <td id=\"T_97b18_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
       "      <td id=\"T_97b18_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
       "      <td id=\"T_97b18_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
       "      <td id=\"T_97b18_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
       "      <td id=\"T_97b18_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
       "      <td id=\"T_97b18_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
       "      <td id=\"T_97b18_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
       "      <td id=\"T_97b18_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
       "      <td id=\"T_97b18_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
       "      <td id=\"T_97b18_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
       "      <td id=\"T_97b18_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
       "      <td id=\"T_97b18_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
       "      <td id=\"T_97b18_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
       "      <td id=\"T_97b18_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
       "      <td id=\"T_97b18_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
       "      <td id=\"T_97b18_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
       "      <td id=\"T_97b18_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
       "      <td id=\"T_97b18_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_97b18_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
       "      <td id=\"T_97b18_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
       "      <td id=\"T_97b18_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
       "      <td id=\"T_97b18_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
       "      <td id=\"T_97b18_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
       "      <td id=\"T_97b18_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c252fa0>"
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df.style.applymap(highlight_cells_1)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b55314eb-390a-4396-acf6-4532b0480482",
   "metadata": {},
   "source": [
    "### Summary of Mitre Attack ID that detects 1/5 malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "id": "04b58cd6-09ae-41df-bd11-e973b7954b95",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1218.001</th>\n",
       "      <td>AgentTesla</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1068</th>\n",
       "      <td>AgentTesla</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1071.003</th>\n",
       "      <td>AgentTesla</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1014</th>\n",
       "      <td>AgentTesla</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1136</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1222.001</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1564</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1564.001</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1531</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1069</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1136.001</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1069.001</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1489</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1219</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1222</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1562.004</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1021.001</th>\n",
       "      <td>Azorult</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566.002</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574.002</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1482</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1036.003</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1055.002</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1047</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574.001</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1016.001</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1016</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1033</th>\n",
       "      <td>Qakbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1134</th>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1134.004</th>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1059.005</th>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1070</th>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1113</th>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1559.001</th>\n",
       "      <td>Remcos</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1021.002</th>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1087</th>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1087.002</th>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.005</th>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.011</th>\n",
       "      <td>Trickbot</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                    0\n",
       "T1218.001  AgentTesla\n",
       "T1068      AgentTesla\n",
       "T1071.003  AgentTesla\n",
       "T1014      AgentTesla\n",
       "T1136         Azorult\n",
       "T1222.001     Azorult\n",
       "T1564         Azorult\n",
       "T1564.001     Azorult\n",
       "T1531         Azorult\n",
       "T1069         Azorult\n",
       "T1136.001     Azorult\n",
       "T1069.001     Azorult\n",
       "T1489         Azorult\n",
       "T1219         Azorult\n",
       "T1222         Azorult\n",
       "T1562.004     Azorult\n",
       "T1021.001     Azorult\n",
       "T1566.002      Qakbot\n",
       "T1574.002      Qakbot\n",
       "T1482          Qakbot\n",
       "T1036.003      Qakbot\n",
       "T1574          Qakbot\n",
       "T1055.002      Qakbot\n",
       "T1047          Qakbot\n",
       "T1574.001      Qakbot\n",
       "T1016.001      Qakbot\n",
       "T1016          Qakbot\n",
       "T1033          Qakbot\n",
       "T1134          Remcos\n",
       "T1134.004      Remcos\n",
       "T1059.005      Remcos\n",
       "T1070          Remcos\n",
       "T1113          Remcos\n",
       "T1559.001      Remcos\n",
       "T1021.002    Trickbot\n",
       "T1087        Trickbot\n",
       "T1087.002    Trickbot\n",
       "T1218.005    Trickbot\n",
       "T1218.011    Trickbot"
      ]
     },
     "execution_count": 31,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 1)\n",
    "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
    "tdf = tdf.sort_values(by=[0])\n",
    "tdf"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c74c33a6-86e8-4897-aa03-64b1a1085ddf",
   "metadata": {},
   "source": [
    "### detection list for Mitre Attack ID that detects 1/5 malware families"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "id": "98f8eec2-b101-4cb2-b46d-182de0a7523c",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(39, 5)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1059.005</th>\n",
       "      <td>[suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1113</th>\n",
       "      <td>[remcos_rat_file_creation_in_remcos_folder.yml, suspicious_image_creation_in_appdata_folder.yml, suspicious_wav_file_in_appdata_folder.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1070</th>\n",
       "      <td>[process_deleting_its_process_file_path.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1559.001</th>\n",
       "      <td>[process_writing_dynamicwrapperx.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1134.004</th>\n",
       "      <td>[wscript_or_cscript_suspicious_child_process.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1134</th>\n",
       "      <td>[wscript_or_cscript_suspicious_child_process.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1021.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1489</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[excessive_attempt_to_disable_services.yml, windows_service_stop_by_deletion.yml, windows_valid_account_with_never_expires_password.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1219</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_remote_access_software_rms_registry.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1562.004</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[firewall_allowed_program_enable.yml, processes_launching_netsh.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1222</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[excessive_usage_of_cacls_app.yml, hiding_files_and_directories_with_attrib_exe.yml, icacls_deny_command.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1136.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[create_local_admin_accounts_using_net_exe.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1136</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[create_local_admin_accounts_using_net_exe.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1531</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[excessive_usage_of_net_app.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1564.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[disable_show_hidden_files.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1564</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[disable_show_hidden_files.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1222.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[hiding_files_and_directories_with_attrib_exe.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1069</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[net_localgroup_discovery.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1069.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>[net_localgroup_discovery.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1055.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_process_injection_remote_thread.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1033</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[system_user_discovery_with_whoami.yml, windows_system_discovery_using_ldap_nslookup.yml, windows_system_discovery_using_qwinsta.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1047</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_wmi_impersonate_token.yml, windows_wmi_process_call_create.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_dll_search_order_hijacking_hunt_with_sysmon.yml, windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1016</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[network_discovery_using_route_windows_app.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1016.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[network_discovery_using_route_windows_app.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1036.003</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[process_creating_lnk_file_in_suspicious_location.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1482</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[nltest_domain_trust_discovery.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_dll_search_order_hijacking_hunt_with_sysmon.yml]</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1071.003</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1014</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_driver_load_non_standard_path.yml, windows_drivers_loaded_by_signature.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1068</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[windows_drivers_loaded_by_signature.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[detect_html_help_spawn_child_process.yml]</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.005</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[mshta_spawning_rundll32_or_regsvr32_process.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1087.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[account_discovery_with_net_app.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1087</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[account_discovery_with_net_app.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.011</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[suspicious_rundll32_startw.yml]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1021.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>[executable_file_written_in_administrative_smb_share.yml]</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                                                                                                                Remcos  \\\n",
       "T1059.005                                        [suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml]   \n",
       "T1113      [remcos_rat_file_creation_in_remcos_folder.yml, suspicious_image_creation_in_appdata_folder.yml, suspicious_wav_file_in_appdata_folder.yml]   \n",
       "T1070                                                                                                     [process_deleting_its_process_file_path.yml]   \n",
       "T1559.001                                                                                                        [process_writing_dynamicwrapperx.yml]   \n",
       "T1134.004                                                                                            [wscript_or_cscript_suspicious_child_process.yml]   \n",
       "T1134                                                                                                [wscript_or_cscript_suspicious_child_process.yml]   \n",
       "T1021.001                                                                                                                                          NaN   \n",
       "T1489                                                                                                                                              NaN   \n",
       "T1219                                                                                                                                              NaN   \n",
       "T1562.004                                                                                                                                          NaN   \n",
       "T1222                                                                                                                                              NaN   \n",
       "T1136.001                                                                                                                                          NaN   \n",
       "T1136                                                                                                                                              NaN   \n",
       "T1531                                                                                                                                              NaN   \n",
       "T1564.001                                                                                                                                          NaN   \n",
       "T1564                                                                                                                                              NaN   \n",
       "T1222.001                                                                                                                                          NaN   \n",
       "T1069                                                                                                                                              NaN   \n",
       "T1069.001                                                                                                                                          NaN   \n",
       "T1055.002                                                                                                                                          NaN   \n",
       "T1033                                                                                                                                              NaN   \n",
       "T1047                                                                                                                                              NaN   \n",
       "T1574.002                                                                                                                                          NaN   \n",
       "T1574                                                                                                                                              NaN   \n",
       "T1016                                                                                                                                              NaN   \n",
       "T1016.001                                                                                                                                          NaN   \n",
       "T1036.003                                                                                                                                          NaN   \n",
       "T1566.002                                                                                                                                          NaN   \n",
       "T1482                                                                                                                                              NaN   \n",
       "T1574.001                                                                                                                                          NaN   \n",
       "T1071.003                                                                                                                                          NaN   \n",
       "T1014                                                                                                                                              NaN   \n",
       "T1068                                                                                                                                              NaN   \n",
       "T1218.001                                                                                                                                          NaN   \n",
       "T1218.005                                                                                                                                          NaN   \n",
       "T1087.002                                                                                                                                          NaN   \n",
       "T1087                                                                                                                                              NaN   \n",
       "T1218.011                                                                                                                                          NaN   \n",
       "T1021.002                                                                                                                                          NaN   \n",
       "\n",
       "                                                                                                                                                                                                                                                             Azorult  \\\n",
       "T1059.005                                                                                                                                                                                                                                                        NaN   \n",
       "T1113                                                                                                                                                                                                                                                            NaN   \n",
       "T1070                                                                                                                                                                                                                                                            NaN   \n",
       "T1559.001                                                                                                                                                                                                                                                        NaN   \n",
       "T1134.004                                                                                                                                                                                                                                                        NaN   \n",
       "T1134                                                                                                                                                                                                                                                            NaN   \n",
       "T1021.001  [allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml]   \n",
       "T1489                                                                                                                       [excessive_attempt_to_disable_services.yml, windows_service_stop_by_deletion.yml, windows_valid_account_with_never_expires_password.yml]   \n",
       "T1219                                                                                                                                                                                                              [windows_remote_access_software_rms_registry.yml]   \n",
       "T1562.004                                                                                                                                                                                       [firewall_allowed_program_enable.yml, processes_launching_netsh.yml]   \n",
       "T1222                                                                                                                                                  [excessive_usage_of_cacls_app.yml, hiding_files_and_directories_with_attrib_exe.yml, icacls_deny_command.yml]   \n",
       "T1136.001                                                                                                                                                                                                            [create_local_admin_accounts_using_net_exe.yml]   \n",
       "T1136                                                                                                                                                                                                                [create_local_admin_accounts_using_net_exe.yml]   \n",
       "T1531                                                                                                                                                                                                                               [excessive_usage_of_net_app.yml]   \n",
       "T1564.001                                                                                                                                                                                                                            [disable_show_hidden_files.yml]   \n",
       "T1564                                                                                                                                                                                                                                [disable_show_hidden_files.yml]   \n",
       "T1222.001                                                                                                                                                                                                         [hiding_files_and_directories_with_attrib_exe.yml]   \n",
       "T1069                                                                                                                                                                                                                                 [net_localgroup_discovery.yml]   \n",
       "T1069.001                                                                                                                                                                                                                             [net_localgroup_discovery.yml]   \n",
       "T1055.002                                                                                                                                                                                                                                                        NaN   \n",
       "T1033                                                                                                                                                                                                                                                            NaN   \n",
       "T1047                                                                                                                                                                                                                                                            NaN   \n",
       "T1574.002                                                                                                                                                                                                                                                        NaN   \n",
       "T1574                                                                                                                                                                                                                                                            NaN   \n",
       "T1016                                                                                                                                                                                                                                                            NaN   \n",
       "T1016.001                                                                                                                                                                                                                                                        NaN   \n",
       "T1036.003                                                                                                                                                                                                                                                        NaN   \n",
       "T1566.002                                                                                                                                                                                                                                                        NaN   \n",
       "T1482                                                                                                                                                                                                                                                            NaN   \n",
       "T1574.001                                                                                                                                                                                                                                                        NaN   \n",
       "T1071.003                                                                                                                                                                                                                                                        NaN   \n",
       "T1014                                                                                                                                                                                                                                                            NaN   \n",
       "T1068                                                                                                                                                                                                                                                            NaN   \n",
       "T1218.001                                                                                                                                                                                                                                                        NaN   \n",
       "T1218.005                                                                                                                                                                                                                                                        NaN   \n",
       "T1087.002                                                                                                                                                                                                                                                        NaN   \n",
       "T1087                                                                                                                                                                                                                                                            NaN   \n",
       "T1218.011                                                                                                                                                                                                                                                        NaN   \n",
       "T1021.002                                                                                                                                                                                                                                                        NaN   \n",
       "\n",
       "                                                                                                                                                                                                            Qakbot  \\\n",
       "T1059.005                                                                                                                                                                                                      NaN   \n",
       "T1113                                                                                                                                                                                                          NaN   \n",
       "T1070                                                                                                                                                                                                          NaN   \n",
       "T1559.001                                                                                                                                                                                                      NaN   \n",
       "T1134.004                                                                                                                                                                                                      NaN   \n",
       "T1134                                                                                                                                                                                                          NaN   \n",
       "T1021.001                                                                                                                                                                                                      NaN   \n",
       "T1489                                                                                                                                                                                                          NaN   \n",
       "T1219                                                                                                                                                                                                          NaN   \n",
       "T1562.004                                                                                                                                                                                                      NaN   \n",
       "T1222                                                                                                                                                                                                          NaN   \n",
       "T1136.001                                                                                                                                                                                                      NaN   \n",
       "T1136                                                                                                                                                                                                          NaN   \n",
       "T1531                                                                                                                                                                                                          NaN   \n",
       "T1564.001                                                                                                                                                                                                      NaN   \n",
       "T1564                                                                                                                                                                                                          NaN   \n",
       "T1222.001                                                                                                                                                                                                      NaN   \n",
       "T1069                                                                                                                                                                                                          NaN   \n",
       "T1069.001                                                                                                                                                                                                      NaN   \n",
       "T1055.002                                                                                                                                                            [windows_process_injection_remote_thread.yml]   \n",
       "T1033                                                                        [system_user_discovery_with_whoami.yml, windows_system_discovery_using_ldap_nslookup.yml, windows_system_discovery_using_qwinsta.yml]   \n",
       "T1047                                                                                                                                     [windows_wmi_impersonate_token.yml, windows_wmi_process_call_create.yml]   \n",
       "T1574.002                                                           [windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]   \n",
       "T1574      [windows_dll_search_order_hijacking_hunt_with_sysmon.yml, windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]   \n",
       "T1016                                                                                                                                                              [network_discovery_using_route_windows_app.yml]   \n",
       "T1016.001                                                                                                                                                          [network_discovery_using_route_windows_app.yml]   \n",
       "T1036.003                                                                                                                    [suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml]   \n",
       "T1566.002                                                                                                                                                   [process_creating_lnk_file_in_suspicious_location.yml]   \n",
       "T1482                                                                                                                                                                          [nltest_domain_trust_discovery.yml]   \n",
       "T1574.001                                                                                                                                                [windows_dll_search_order_hijacking_hunt_with_sysmon.yml]   \n",
       "T1071.003                                                                                                                                                                                                      NaN   \n",
       "T1014                                                                                                                                                                                                          NaN   \n",
       "T1068                                                                                                                                                                                                          NaN   \n",
       "T1218.001                                                                                                                                                                                                      NaN   \n",
       "T1218.005                                                                                                                                                                                                      NaN   \n",
       "T1087.002                                                                                                                                                                                                      NaN   \n",
       "T1087                                                                                                                                                                                                          NaN   \n",
       "T1218.011                                                                                                                                                                                                      NaN   \n",
       "T1021.002                                                                                                                                                                                                      NaN   \n",
       "\n",
       "                                                                                                                                                                     AgentTesla  \\\n",
       "T1059.005                                                                                                                                                                   NaN   \n",
       "T1113                                                                                                                                                                       NaN   \n",
       "T1070                                                                                                                                                                       NaN   \n",
       "T1559.001                                                                                                                                                                   NaN   \n",
       "T1134.004                                                                                                                                                                   NaN   \n",
       "T1134                                                                                                                                                                       NaN   \n",
       "T1021.001                                                                                                                                                                   NaN   \n",
       "T1489                                                                                                                                                                       NaN   \n",
       "T1219                                                                                                                                                                       NaN   \n",
       "T1562.004                                                                                                                                                                   NaN   \n",
       "T1222                                                                                                                                                                       NaN   \n",
       "T1136.001                                                                                                                                                                   NaN   \n",
       "T1136                                                                                                                                                                       NaN   \n",
       "T1531                                                                                                                                                                       NaN   \n",
       "T1564.001                                                                                                                                                                   NaN   \n",
       "T1564                                                                                                                                                                       NaN   \n",
       "T1222.001                                                                                                                                                                   NaN   \n",
       "T1069                                                                                                                                                                       NaN   \n",
       "T1069.001                                                                                                                                                                   NaN   \n",
       "T1055.002                                                                                                                                                                   NaN   \n",
       "T1033                                                                                                                                                                       NaN   \n",
       "T1047                                                                                                                                                                       NaN   \n",
       "T1574.002                                                                                                                                                                   NaN   \n",
       "T1574                                                                                                                                                                       NaN   \n",
       "T1016                                                                                                                                                                       NaN   \n",
       "T1016.001                                                                                                                                                                   NaN   \n",
       "T1036.003                                                                                                                                                                   NaN   \n",
       "T1566.002                                                                                                                                                                   NaN   \n",
       "T1482                                                                                                                                                                       NaN   \n",
       "T1574.001                                                                                                                                                                   NaN   \n",
       "T1071.003  [windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml]   \n",
       "T1014                                                                                      [windows_driver_load_non_standard_path.yml, windows_drivers_loaded_by_signature.yml]   \n",
       "T1068                                                                                                                                 [windows_drivers_loaded_by_signature.yml]   \n",
       "T1218.001                                                                                                                            [detect_html_help_spawn_child_process.yml]   \n",
       "T1218.005                                                                                                                                                                   NaN   \n",
       "T1087.002                                                                                                                                                                   NaN   \n",
       "T1087                                                                                                                                                                       NaN   \n",
       "T1218.011                                                                                                                                                                   NaN   \n",
       "T1021.002                                                                                                                                                                   NaN   \n",
       "\n",
       "                                                            Trickbot  \n",
       "T1059.005                                                        NaN  \n",
       "T1113                                                            NaN  \n",
       "T1070                                                            NaN  \n",
       "T1559.001                                                        NaN  \n",
       "T1134.004                                                        NaN  \n",
       "T1134                                                            NaN  \n",
       "T1021.001                                                        NaN  \n",
       "T1489                                                            NaN  \n",
       "T1219                                                            NaN  \n",
       "T1562.004                                                        NaN  \n",
       "T1222                                                            NaN  \n",
       "T1136.001                                                        NaN  \n",
       "T1136                                                            NaN  \n",
       "T1531                                                            NaN  \n",
       "T1564.001                                                        NaN  \n",
       "T1564                                                            NaN  \n",
       "T1222.001                                                        NaN  \n",
       "T1069                                                            NaN  \n",
       "T1069.001                                                        NaN  \n",
       "T1055.002                                                        NaN  \n",
       "T1033                                                            NaN  \n",
       "T1047                                                            NaN  \n",
       "T1574.002                                                        NaN  \n",
       "T1574                                                            NaN  \n",
       "T1016                                                            NaN  \n",
       "T1016.001                                                        NaN  \n",
       "T1036.003                                                        NaN  \n",
       "T1566.002                                                        NaN  \n",
       "T1482                                                            NaN  \n",
       "T1574.001                                                        NaN  \n",
       "T1071.003                                                        NaN  \n",
       "T1014                                                            NaN  \n",
       "T1068                                                            NaN  \n",
       "T1218.001                                                        NaN  \n",
       "T1218.005          [mshta_spawning_rundll32_or_regsvr32_process.yml]  \n",
       "T1087.002                       [account_discovery_with_net_app.yml]  \n",
       "T1087                           [account_discovery_with_net_app.yml]  \n",
       "T1218.011                           [suspicious_rundll32_startw.yml]  \n",
       "T1021.002  [executable_file_written_in_administrative_smb_share.yml]  "
      ]
     },
     "execution_count": 32,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "det_table_dict = detection_list_by_id(temp_dict)\n",
    "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
    "print(tdf.shape)\n",
    "tdf "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9ad6099d-a1cf-464c-8678-50d013436254",
   "metadata": {},
   "source": [
    "### detection count per mitre attack id in each malware family"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "id": "0f0abfc2-e6d8-4a42-b881-d4357b667a91",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Remcos</th>\n",
       "      <th>Azorult</th>\n",
       "      <th>Qakbot</th>\n",
       "      <th>AgentTesla</th>\n",
       "      <th>Trickbot</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>T1059.005</th>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1113</th>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1070</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1559.001</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1134.004</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1134</th>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1021.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(5)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1489</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1219</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1562.004</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1222</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1136.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1136</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1531</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1564.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1564</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1222.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1069</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1069.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1055.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1033</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1047</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(4)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1016</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1016.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1036.003</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1566.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1482</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1574.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1071.003</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(3)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1014</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(2)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1068</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.001</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.005</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1087.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1087</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1218.011</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>T1021.002</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>(1)-detection count</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                        Remcos              Azorult               Qakbot  \\\n",
       "T1059.005  (2)-detection count                  NaN                  NaN   \n",
       "T1113      (3)-detection count                  NaN                  NaN   \n",
       "T1070      (1)-detection count                  NaN                  NaN   \n",
       "T1559.001  (1)-detection count                  NaN                  NaN   \n",
       "T1134.004  (1)-detection count                  NaN                  NaN   \n",
       "T1134      (1)-detection count                  NaN                  NaN   \n",
       "T1021.001                  NaN  (5)-detection count                  NaN   \n",
       "T1489                      NaN  (3)-detection count                  NaN   \n",
       "T1219                      NaN  (1)-detection count                  NaN   \n",
       "T1562.004                  NaN  (2)-detection count                  NaN   \n",
       "T1222                      NaN  (3)-detection count                  NaN   \n",
       "T1136.001                  NaN  (1)-detection count                  NaN   \n",
       "T1136                      NaN  (1)-detection count                  NaN   \n",
       "T1531                      NaN  (1)-detection count                  NaN   \n",
       "T1564.001                  NaN  (1)-detection count                  NaN   \n",
       "T1564                      NaN  (1)-detection count                  NaN   \n",
       "T1222.001                  NaN  (1)-detection count                  NaN   \n",
       "T1069                      NaN  (1)-detection count                  NaN   \n",
       "T1069.001                  NaN  (1)-detection count                  NaN   \n",
       "T1055.002                  NaN                  NaN  (1)-detection count   \n",
       "T1033                      NaN                  NaN  (3)-detection count   \n",
       "T1047                      NaN                  NaN  (2)-detection count   \n",
       "T1574.002                  NaN                  NaN  (3)-detection count   \n",
       "T1574                      NaN                  NaN  (4)-detection count   \n",
       "T1016                      NaN                  NaN  (1)-detection count   \n",
       "T1016.001                  NaN                  NaN  (1)-detection count   \n",
       "T1036.003                  NaN                  NaN  (2)-detection count   \n",
       "T1566.002                  NaN                  NaN  (1)-detection count   \n",
       "T1482                      NaN                  NaN  (1)-detection count   \n",
       "T1574.001                  NaN                  NaN  (1)-detection count   \n",
       "T1071.003                  NaN                  NaN                  NaN   \n",
       "T1014                      NaN                  NaN                  NaN   \n",
       "T1068                      NaN                  NaN                  NaN   \n",
       "T1218.001                  NaN                  NaN                  NaN   \n",
       "T1218.005                  NaN                  NaN                  NaN   \n",
       "T1087.002                  NaN                  NaN                  NaN   \n",
       "T1087                      NaN                  NaN                  NaN   \n",
       "T1218.011                  NaN                  NaN                  NaN   \n",
       "T1021.002                  NaN                  NaN                  NaN   \n",
       "\n",
       "                    AgentTesla             Trickbot  \n",
       "T1059.005                  NaN                  NaN  \n",
       "T1113                      NaN                  NaN  \n",
       "T1070                      NaN                  NaN  \n",
       "T1559.001                  NaN                  NaN  \n",
       "T1134.004                  NaN                  NaN  \n",
       "T1134                      NaN                  NaN  \n",
       "T1021.001                  NaN                  NaN  \n",
       "T1489                      NaN                  NaN  \n",
       "T1219                      NaN                  NaN  \n",
       "T1562.004                  NaN                  NaN  \n",
       "T1222                      NaN                  NaN  \n",
       "T1136.001                  NaN                  NaN  \n",
       "T1136                      NaN                  NaN  \n",
       "T1531                      NaN                  NaN  \n",
       "T1564.001                  NaN                  NaN  \n",
       "T1564                      NaN                  NaN  \n",
       "T1222.001                  NaN                  NaN  \n",
       "T1069                      NaN                  NaN  \n",
       "T1069.001                  NaN                  NaN  \n",
       "T1055.002                  NaN                  NaN  \n",
       "T1033                      NaN                  NaN  \n",
       "T1047                      NaN                  NaN  \n",
       "T1574.002                  NaN                  NaN  \n",
       "T1574                      NaN                  NaN  \n",
       "T1016                      NaN                  NaN  \n",
       "T1016.001                  NaN                  NaN  \n",
       "T1036.003                  NaN                  NaN  \n",
       "T1566.002                  NaN                  NaN  \n",
       "T1482                      NaN                  NaN  \n",
       "T1574.001                  NaN                  NaN  \n",
       "T1071.003  (3)-detection count                  NaN  \n",
       "T1014      (2)-detection count                  NaN  \n",
       "T1068      (1)-detection count                  NaN  \n",
       "T1218.001  (1)-detection count                  NaN  \n",
       "T1218.005                  NaN  (1)-detection count  \n",
       "T1087.002                  NaN  (1)-detection count  \n",
       "T1087                      NaN  (1)-detection count  \n",
       "T1218.011                  NaN  (1)-detection count  \n",
       "T1021.002                  NaN  (1)-detection count  "
      ]
     },
     "execution_count": 33,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "detection_list_by_count(det_table_dict)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "id": "9a275cc7-9c29-492e-a266-7e5e15ca0874",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "['T1014', 'T1016', 'T1016.001', 'T1021', 'T1021.001', 'T1021.002', 'T1027', 'T1033', 'T1036', 'T1036.003', 'T1047', 'T1049', 'T1053', 'T1053.005', 'T1055', 'T1055.001', 'T1055.002', 'T1059', 'T1059.001', 'T1059.003', 'T1059.005', 'T1059.007', 'T1068', 'T1069', 'T1069.001', 'T1070', 'T1071', 'T1071.003', 'T1087', 'T1087.002', 'T1112', 'T1113', 'T1134', 'T1134.004', 'T1136', 'T1136.001', 'T1204', 'T1204.001', 'T1218', 'T1218.001', 'T1218.005', 'T1218.010', 'T1218.011', 'T1219', 'T1222', 'T1222.001', 'T1482', 'T1489', 'T1531', 'T1543', 'T1543.003', 'T1547', 'T1547.001', 'T1548', 'T1548.002', 'T1555', 'T1555.003', 'T1559.001', 'T1562', 'T1562.001', 'T1562.004', 'T1564', 'T1564.001', 'T1566', 'T1566.001', 'T1566.002', 'T1569', 'T1569.002', 'T1574', 'T1574.001', 'T1574.002', 'T1590', 'T1590.005', 'T1592']\n"
     ]
    }
   ],
   "source": [
    "detection_tid_list =[]\n",
    "for k,v in mitre_attack_tid_dict.items():\n",
    "    detection_tid_list.append(k)\n",
    "\n",
    "print(sorted(detection_tid_list))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e62ffc04-7445-479c-a5a8-751d0abd1b0f",
   "metadata": {},
   "source": [
    "### truth table splunk detection name vs analytic story (malware family)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "id": "31decfcb-ca16-479c-88cc-51b5a72422f6",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(140, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_9f55b_row0_col0, #T_9f55b_row0_col1, #T_9f55b_row0_col2, #T_9f55b_row0_col3, #T_9f55b_row0_col4, #T_9f55b_row0_col5, #T_9f55b_row1_col0, #T_9f55b_row1_col1, #T_9f55b_row1_col2, #T_9f55b_row1_col3, #T_9f55b_row1_col4, #T_9f55b_row1_col5, #T_9f55b_row2_col0, #T_9f55b_row2_col1, #T_9f55b_row2_col2, #T_9f55b_row2_col3, #T_9f55b_row2_col4, #T_9f55b_row2_col5, #T_9f55b_row3_col0, #T_9f55b_row3_col1, #T_9f55b_row3_col2, #T_9f55b_row3_col3, #T_9f55b_row3_col4, #T_9f55b_row3_col5 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_9f55b_row4_col0, #T_9f55b_row4_col1, #T_9f55b_row4_col2, #T_9f55b_row4_col3, #T_9f55b_row4_col4, #T_9f55b_row4_col5, #T_9f55b_row5_col0, #T_9f55b_row5_col1, #T_9f55b_row5_col2, #T_9f55b_row5_col3, #T_9f55b_row5_col4, #T_9f55b_row5_col5, #T_9f55b_row6_col0, #T_9f55b_row6_col1, #T_9f55b_row6_col2, #T_9f55b_row6_col3, #T_9f55b_row6_col4, #T_9f55b_row6_col5 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_9f55b_row7_col0, #T_9f55b_row7_col1, #T_9f55b_row7_col2, #T_9f55b_row7_col3, #T_9f55b_row7_col4, #T_9f55b_row7_col5, #T_9f55b_row8_col0, #T_9f55b_row8_col1, #T_9f55b_row8_col2, #T_9f55b_row8_col3, #T_9f55b_row8_col4, #T_9f55b_row8_col5, #T_9f55b_row9_col0, #T_9f55b_row9_col1, #T_9f55b_row9_col2, #T_9f55b_row9_col3, #T_9f55b_row9_col4, #T_9f55b_row9_col5, #T_9f55b_row10_col0, #T_9f55b_row10_col1, #T_9f55b_row10_col2, #T_9f55b_row10_col3, #T_9f55b_row10_col4, #T_9f55b_row10_col5 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_9f55b_row11_col0, #T_9f55b_row11_col1, #T_9f55b_row11_col2, #T_9f55b_row11_col3, #T_9f55b_row11_col4, #T_9f55b_row11_col5, #T_9f55b_row12_col0, #T_9f55b_row12_col1, #T_9f55b_row12_col2, #T_9f55b_row12_col3, #T_9f55b_row12_col4, #T_9f55b_row12_col5, #T_9f55b_row13_col0, #T_9f55b_row13_col1, #T_9f55b_row13_col2, #T_9f55b_row13_col3, #T_9f55b_row13_col4, #T_9f55b_row13_col5, #T_9f55b_row14_col0, #T_9f55b_row14_col1, #T_9f55b_row14_col2, #T_9f55b_row14_col3, #T_9f55b_row14_col4, #T_9f55b_row14_col5, #T_9f55b_row15_col0, #T_9f55b_row15_col1, #T_9f55b_row15_col2, #T_9f55b_row15_col3, #T_9f55b_row15_col4, #T_9f55b_row15_col5, #T_9f55b_row16_col0, #T_9f55b_row16_col1, #T_9f55b_row16_col2, #T_9f55b_row16_col3, #T_9f55b_row16_col4, #T_9f55b_row16_col5, #T_9f55b_row17_col0, #T_9f55b_row17_col1, #T_9f55b_row17_col2, #T_9f55b_row17_col3, #T_9f55b_row17_col4, #T_9f55b_row17_col5, #T_9f55b_row18_col0, #T_9f55b_row18_col1, #T_9f55b_row18_col2, #T_9f55b_row18_col3, #T_9f55b_row18_col4, #T_9f55b_row18_col5, #T_9f55b_row19_col0, #T_9f55b_row19_col1, #T_9f55b_row19_col2, #T_9f55b_row19_col3, #T_9f55b_row19_col4, #T_9f55b_row19_col5, #T_9f55b_row20_col0, #T_9f55b_row20_col1, #T_9f55b_row20_col2, #T_9f55b_row20_col3, #T_9f55b_row20_col4, #T_9f55b_row20_col5, #T_9f55b_row21_col0, #T_9f55b_row21_col1, #T_9f55b_row21_col2, #T_9f55b_row21_col3, #T_9f55b_row21_col4, #T_9f55b_row21_col5 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_9f55b_row22_col0, #T_9f55b_row22_col1, #T_9f55b_row22_col2, #T_9f55b_row22_col3, #T_9f55b_row22_col4, #T_9f55b_row22_col5, #T_9f55b_row23_col0, #T_9f55b_row23_col1, #T_9f55b_row23_col2, #T_9f55b_row23_col3, #T_9f55b_row23_col4, #T_9f55b_row23_col5, #T_9f55b_row24_col0, #T_9f55b_row24_col1, #T_9f55b_row24_col2, #T_9f55b_row24_col3, #T_9f55b_row24_col4, #T_9f55b_row24_col5, #T_9f55b_row25_col0, #T_9f55b_row25_col1, #T_9f55b_row25_col2, #T_9f55b_row25_col3, #T_9f55b_row25_col4, #T_9f55b_row25_col5, #T_9f55b_row26_col0, #T_9f55b_row26_col1, #T_9f55b_row26_col2, #T_9f55b_row26_col3, #T_9f55b_row26_col4, #T_9f55b_row26_col5, #T_9f55b_row27_col0, #T_9f55b_row27_col1, #T_9f55b_row27_col2, #T_9f55b_row27_col3, #T_9f55b_row27_col4, #T_9f55b_row27_col5, #T_9f55b_row28_col0, #T_9f55b_row28_col1, #T_9f55b_row28_col2, #T_9f55b_row28_col3, #T_9f55b_row28_col4, #T_9f55b_row28_col5, #T_9f55b_row29_col0, #T_9f55b_row29_col1, #T_9f55b_row29_col2, #T_9f55b_row29_col3, #T_9f55b_row29_col4, #T_9f55b_row29_col5, #T_9f55b_row30_col0, #T_9f55b_row30_col1, #T_9f55b_row30_col2, #T_9f55b_row30_col3, #T_9f55b_row30_col4, #T_9f55b_row30_col5, #T_9f55b_row31_col0, #T_9f55b_row31_col1, #T_9f55b_row31_col2, #T_9f55b_row31_col3, #T_9f55b_row31_col4, #T_9f55b_row31_col5, #T_9f55b_row32_col0, #T_9f55b_row32_col1, #T_9f55b_row32_col2, #T_9f55b_row32_col3, #T_9f55b_row32_col4, #T_9f55b_row32_col5, #T_9f55b_row33_col0, #T_9f55b_row33_col1, #T_9f55b_row33_col2, #T_9f55b_row33_col3, #T_9f55b_row33_col4, #T_9f55b_row33_col5, #T_9f55b_row34_col0, #T_9f55b_row34_col1, #T_9f55b_row34_col2, #T_9f55b_row34_col3, #T_9f55b_row34_col4, #T_9f55b_row34_col5, #T_9f55b_row35_col0, #T_9f55b_row35_col1, #T_9f55b_row35_col2, #T_9f55b_row35_col3, #T_9f55b_row35_col4, #T_9f55b_row35_col5, #T_9f55b_row36_col0, #T_9f55b_row36_col1, #T_9f55b_row36_col2, #T_9f55b_row36_col3, #T_9f55b_row36_col4, #T_9f55b_row36_col5, #T_9f55b_row37_col0, #T_9f55b_row37_col1, #T_9f55b_row37_col2, #T_9f55b_row37_col3, #T_9f55b_row37_col4, #T_9f55b_row37_col5, #T_9f55b_row38_col0, #T_9f55b_row38_col1, #T_9f55b_row38_col2, #T_9f55b_row38_col3, #T_9f55b_row38_col4, #T_9f55b_row38_col5, #T_9f55b_row39_col0, #T_9f55b_row39_col1, #T_9f55b_row39_col2, #T_9f55b_row39_col3, #T_9f55b_row39_col4, #T_9f55b_row39_col5, #T_9f55b_row40_col0, #T_9f55b_row40_col1, #T_9f55b_row40_col2, #T_9f55b_row40_col3, #T_9f55b_row40_col4, #T_9f55b_row40_col5, #T_9f55b_row41_col0, #T_9f55b_row41_col1, #T_9f55b_row41_col2, #T_9f55b_row41_col3, #T_9f55b_row41_col4, #T_9f55b_row41_col5, #T_9f55b_row42_col0, #T_9f55b_row42_col1, #T_9f55b_row42_col2, #T_9f55b_row42_col3, #T_9f55b_row42_col4, #T_9f55b_row42_col5, #T_9f55b_row43_col0, #T_9f55b_row43_col1, #T_9f55b_row43_col2, #T_9f55b_row43_col3, #T_9f55b_row43_col4, #T_9f55b_row43_col5, #T_9f55b_row44_col0, #T_9f55b_row44_col1, #T_9f55b_row44_col2, #T_9f55b_row44_col3, #T_9f55b_row44_col4, #T_9f55b_row44_col5, #T_9f55b_row45_col0, #T_9f55b_row45_col1, #T_9f55b_row45_col2, #T_9f55b_row45_col3, #T_9f55b_row45_col4, #T_9f55b_row45_col5, #T_9f55b_row46_col0, #T_9f55b_row46_col1, #T_9f55b_row46_col2, #T_9f55b_row46_col3, #T_9f55b_row46_col4, #T_9f55b_row46_col5, #T_9f55b_row47_col0, #T_9f55b_row47_col1, #T_9f55b_row47_col2, #T_9f55b_row47_col3, #T_9f55b_row47_col4, #T_9f55b_row47_col5, #T_9f55b_row48_col0, #T_9f55b_row48_col1, #T_9f55b_row48_col2, #T_9f55b_row48_col3, #T_9f55b_row48_col4, #T_9f55b_row48_col5, #T_9f55b_row49_col0, #T_9f55b_row49_col1, #T_9f55b_row49_col2, #T_9f55b_row49_col3, #T_9f55b_row49_col4, #T_9f55b_row49_col5, #T_9f55b_row50_col0, #T_9f55b_row50_col1, #T_9f55b_row50_col2, #T_9f55b_row50_col3, #T_9f55b_row50_col4, #T_9f55b_row50_col5, #T_9f55b_row51_col0, #T_9f55b_row51_col1, #T_9f55b_row51_col2, #T_9f55b_row51_col3, #T_9f55b_row51_col4, #T_9f55b_row51_col5, #T_9f55b_row52_col0, #T_9f55b_row52_col1, #T_9f55b_row52_col2, #T_9f55b_row52_col3, #T_9f55b_row52_col4, #T_9f55b_row52_col5, #T_9f55b_row53_col0, #T_9f55b_row53_col1, #T_9f55b_row53_col2, #T_9f55b_row53_col3, #T_9f55b_row53_col4, #T_9f55b_row53_col5, #T_9f55b_row54_col0, #T_9f55b_row54_col1, #T_9f55b_row54_col2, #T_9f55b_row54_col3, #T_9f55b_row54_col4, #T_9f55b_row54_col5, #T_9f55b_row55_col0, #T_9f55b_row55_col1, #T_9f55b_row55_col2, #T_9f55b_row55_col3, #T_9f55b_row55_col4, #T_9f55b_row55_col5, #T_9f55b_row56_col0, #T_9f55b_row56_col1, #T_9f55b_row56_col2, #T_9f55b_row56_col3, #T_9f55b_row56_col4, #T_9f55b_row56_col5, #T_9f55b_row57_col0, #T_9f55b_row57_col1, #T_9f55b_row57_col2, #T_9f55b_row57_col3, #T_9f55b_row57_col4, #T_9f55b_row57_col5, #T_9f55b_row58_col0, #T_9f55b_row58_col1, #T_9f55b_row58_col2, #T_9f55b_row58_col3, #T_9f55b_row58_col4, #T_9f55b_row58_col5, #T_9f55b_row59_col0, #T_9f55b_row59_col1, #T_9f55b_row59_col2, #T_9f55b_row59_col3, #T_9f55b_row59_col4, #T_9f55b_row59_col5, #T_9f55b_row60_col0, #T_9f55b_row60_col1, #T_9f55b_row60_col2, #T_9f55b_row60_col3, #T_9f55b_row60_col4, #T_9f55b_row60_col5, #T_9f55b_row61_col0, #T_9f55b_row61_col1, #T_9f55b_row61_col2, #T_9f55b_row61_col3, #T_9f55b_row61_col4, #T_9f55b_row61_col5, #T_9f55b_row62_col0, #T_9f55b_row62_col1, #T_9f55b_row62_col2, #T_9f55b_row62_col3, #T_9f55b_row62_col4, #T_9f55b_row62_col5, #T_9f55b_row63_col0, #T_9f55b_row63_col1, #T_9f55b_row63_col2, #T_9f55b_row63_col3, #T_9f55b_row63_col4, #T_9f55b_row63_col5, #T_9f55b_row64_col0, #T_9f55b_row64_col1, #T_9f55b_row64_col2, #T_9f55b_row64_col3, #T_9f55b_row64_col4, #T_9f55b_row64_col5, #T_9f55b_row65_col0, #T_9f55b_row65_col1, #T_9f55b_row65_col2, #T_9f55b_row65_col3, #T_9f55b_row65_col4, #T_9f55b_row65_col5, #T_9f55b_row66_col0, #T_9f55b_row66_col1, #T_9f55b_row66_col2, #T_9f55b_row66_col3, #T_9f55b_row66_col4, #T_9f55b_row66_col5, #T_9f55b_row67_col0, #T_9f55b_row67_col1, #T_9f55b_row67_col2, #T_9f55b_row67_col3, #T_9f55b_row67_col4, #T_9f55b_row67_col5, #T_9f55b_row68_col0, #T_9f55b_row68_col1, #T_9f55b_row68_col2, #T_9f55b_row68_col3, #T_9f55b_row68_col4, #T_9f55b_row68_col5, #T_9f55b_row69_col0, #T_9f55b_row69_col1, #T_9f55b_row69_col2, #T_9f55b_row69_col3, #T_9f55b_row69_col4, #T_9f55b_row69_col5, #T_9f55b_row70_col0, #T_9f55b_row70_col1, #T_9f55b_row70_col2, #T_9f55b_row70_col3, #T_9f55b_row70_col4, #T_9f55b_row70_col5, #T_9f55b_row71_col0, #T_9f55b_row71_col1, #T_9f55b_row71_col2, #T_9f55b_row71_col3, #T_9f55b_row71_col4, #T_9f55b_row71_col5, #T_9f55b_row72_col0, #T_9f55b_row72_col1, #T_9f55b_row72_col2, #T_9f55b_row72_col3, #T_9f55b_row72_col4, #T_9f55b_row72_col5, #T_9f55b_row73_col0, #T_9f55b_row73_col1, #T_9f55b_row73_col2, #T_9f55b_row73_col3, #T_9f55b_row73_col4, #T_9f55b_row73_col5, #T_9f55b_row74_col0, #T_9f55b_row74_col1, #T_9f55b_row74_col2, #T_9f55b_row74_col3, #T_9f55b_row74_col4, #T_9f55b_row74_col5, #T_9f55b_row75_col0, #T_9f55b_row75_col1, #T_9f55b_row75_col2, #T_9f55b_row75_col3, #T_9f55b_row75_col4, #T_9f55b_row75_col5, #T_9f55b_row76_col0, #T_9f55b_row76_col1, #T_9f55b_row76_col2, #T_9f55b_row76_col3, #T_9f55b_row76_col4, #T_9f55b_row76_col5, #T_9f55b_row77_col0, #T_9f55b_row77_col1, #T_9f55b_row77_col2, #T_9f55b_row77_col3, #T_9f55b_row77_col4, #T_9f55b_row77_col5, #T_9f55b_row78_col0, #T_9f55b_row78_col1, #T_9f55b_row78_col2, #T_9f55b_row78_col3, #T_9f55b_row78_col4, #T_9f55b_row78_col5, #T_9f55b_row79_col0, #T_9f55b_row79_col1, #T_9f55b_row79_col2, #T_9f55b_row79_col3, #T_9f55b_row79_col4, #T_9f55b_row79_col5, #T_9f55b_row80_col0, #T_9f55b_row80_col1, #T_9f55b_row80_col2, #T_9f55b_row80_col3, #T_9f55b_row80_col4, #T_9f55b_row80_col5, #T_9f55b_row81_col0, #T_9f55b_row81_col1, #T_9f55b_row81_col2, #T_9f55b_row81_col3, #T_9f55b_row81_col4, #T_9f55b_row81_col5, #T_9f55b_row82_col0, #T_9f55b_row82_col1, #T_9f55b_row82_col2, #T_9f55b_row82_col3, #T_9f55b_row82_col4, #T_9f55b_row82_col5, #T_9f55b_row83_col0, #T_9f55b_row83_col1, #T_9f55b_row83_col2, #T_9f55b_row83_col3, #T_9f55b_row83_col4, #T_9f55b_row83_col5, #T_9f55b_row84_col0, #T_9f55b_row84_col1, #T_9f55b_row84_col2, #T_9f55b_row84_col3, #T_9f55b_row84_col4, #T_9f55b_row84_col5, #T_9f55b_row85_col0, #T_9f55b_row85_col1, #T_9f55b_row85_col2, #T_9f55b_row85_col3, #T_9f55b_row85_col4, #T_9f55b_row85_col5, #T_9f55b_row86_col0, #T_9f55b_row86_col1, #T_9f55b_row86_col2, #T_9f55b_row86_col3, #T_9f55b_row86_col4, #T_9f55b_row86_col5, #T_9f55b_row87_col0, #T_9f55b_row87_col1, #T_9f55b_row87_col2, #T_9f55b_row87_col3, #T_9f55b_row87_col4, #T_9f55b_row87_col5, #T_9f55b_row88_col0, #T_9f55b_row88_col1, #T_9f55b_row88_col2, #T_9f55b_row88_col3, #T_9f55b_row88_col4, #T_9f55b_row88_col5, #T_9f55b_row89_col0, #T_9f55b_row89_col1, #T_9f55b_row89_col2, #T_9f55b_row89_col3, #T_9f55b_row89_col4, #T_9f55b_row89_col5, #T_9f55b_row90_col0, #T_9f55b_row90_col1, #T_9f55b_row90_col2, #T_9f55b_row90_col3, #T_9f55b_row90_col4, #T_9f55b_row90_col5, #T_9f55b_row91_col0, #T_9f55b_row91_col1, #T_9f55b_row91_col2, #T_9f55b_row91_col3, #T_9f55b_row91_col4, #T_9f55b_row91_col5, #T_9f55b_row92_col0, #T_9f55b_row92_col1, #T_9f55b_row92_col2, #T_9f55b_row92_col3, #T_9f55b_row92_col4, #T_9f55b_row92_col5, #T_9f55b_row93_col0, #T_9f55b_row93_col1, #T_9f55b_row93_col2, #T_9f55b_row93_col3, #T_9f55b_row93_col4, #T_9f55b_row93_col5, #T_9f55b_row94_col0, #T_9f55b_row94_col1, #T_9f55b_row94_col2, #T_9f55b_row94_col3, #T_9f55b_row94_col4, #T_9f55b_row94_col5, #T_9f55b_row95_col0, #T_9f55b_row95_col1, #T_9f55b_row95_col2, #T_9f55b_row95_col3, #T_9f55b_row95_col4, #T_9f55b_row95_col5, #T_9f55b_row96_col0, #T_9f55b_row96_col1, #T_9f55b_row96_col2, #T_9f55b_row96_col3, #T_9f55b_row96_col4, #T_9f55b_row96_col5, #T_9f55b_row97_col0, #T_9f55b_row97_col1, #T_9f55b_row97_col2, #T_9f55b_row97_col3, #T_9f55b_row97_col4, #T_9f55b_row97_col5, #T_9f55b_row98_col0, #T_9f55b_row98_col1, #T_9f55b_row98_col2, #T_9f55b_row98_col3, #T_9f55b_row98_col4, #T_9f55b_row98_col5, #T_9f55b_row99_col0, #T_9f55b_row99_col1, #T_9f55b_row99_col2, #T_9f55b_row99_col3, #T_9f55b_row99_col4, #T_9f55b_row99_col5, #T_9f55b_row100_col0, #T_9f55b_row100_col1, #T_9f55b_row100_col2, #T_9f55b_row100_col3, #T_9f55b_row100_col4, #T_9f55b_row100_col5, #T_9f55b_row101_col0, #T_9f55b_row101_col1, #T_9f55b_row101_col2, #T_9f55b_row101_col3, #T_9f55b_row101_col4, #T_9f55b_row101_col5, #T_9f55b_row102_col0, #T_9f55b_row102_col1, #T_9f55b_row102_col2, #T_9f55b_row102_col3, #T_9f55b_row102_col4, #T_9f55b_row102_col5, #T_9f55b_row103_col0, #T_9f55b_row103_col1, #T_9f55b_row103_col2, #T_9f55b_row103_col3, #T_9f55b_row103_col4, #T_9f55b_row103_col5, #T_9f55b_row104_col0, #T_9f55b_row104_col1, #T_9f55b_row104_col2, #T_9f55b_row104_col3, #T_9f55b_row104_col4, #T_9f55b_row104_col5, #T_9f55b_row105_col0, #T_9f55b_row105_col1, #T_9f55b_row105_col2, #T_9f55b_row105_col3, #T_9f55b_row105_col4, #T_9f55b_row105_col5, #T_9f55b_row106_col0, #T_9f55b_row106_col1, #T_9f55b_row106_col2, #T_9f55b_row106_col3, #T_9f55b_row106_col4, #T_9f55b_row106_col5, #T_9f55b_row107_col0, #T_9f55b_row107_col1, #T_9f55b_row107_col2, #T_9f55b_row107_col3, #T_9f55b_row107_col4, #T_9f55b_row107_col5, #T_9f55b_row108_col0, #T_9f55b_row108_col1, #T_9f55b_row108_col2, #T_9f55b_row108_col3, #T_9f55b_row108_col4, #T_9f55b_row108_col5, #T_9f55b_row109_col0, #T_9f55b_row109_col1, #T_9f55b_row109_col2, #T_9f55b_row109_col3, #T_9f55b_row109_col4, #T_9f55b_row109_col5, #T_9f55b_row110_col0, #T_9f55b_row110_col1, #T_9f55b_row110_col2, #T_9f55b_row110_col3, #T_9f55b_row110_col4, #T_9f55b_row110_col5, #T_9f55b_row111_col0, #T_9f55b_row111_col1, #T_9f55b_row111_col2, #T_9f55b_row111_col3, #T_9f55b_row111_col4, #T_9f55b_row111_col5, #T_9f55b_row112_col0, #T_9f55b_row112_col1, #T_9f55b_row112_col2, #T_9f55b_row112_col3, #T_9f55b_row112_col4, #T_9f55b_row112_col5, #T_9f55b_row113_col0, #T_9f55b_row113_col1, #T_9f55b_row113_col2, #T_9f55b_row113_col3, #T_9f55b_row113_col4, #T_9f55b_row113_col5, #T_9f55b_row114_col0, #T_9f55b_row114_col1, #T_9f55b_row114_col2, #T_9f55b_row114_col3, #T_9f55b_row114_col4, #T_9f55b_row114_col5, #T_9f55b_row115_col0, #T_9f55b_row115_col1, #T_9f55b_row115_col2, #T_9f55b_row115_col3, #T_9f55b_row115_col4, #T_9f55b_row115_col5, #T_9f55b_row116_col0, #T_9f55b_row116_col1, #T_9f55b_row116_col2, #T_9f55b_row116_col3, #T_9f55b_row116_col4, #T_9f55b_row116_col5, #T_9f55b_row117_col0, #T_9f55b_row117_col1, #T_9f55b_row117_col2, #T_9f55b_row117_col3, #T_9f55b_row117_col4, #T_9f55b_row117_col5, #T_9f55b_row118_col0, #T_9f55b_row118_col1, #T_9f55b_row118_col2, #T_9f55b_row118_col3, #T_9f55b_row118_col4, #T_9f55b_row118_col5, #T_9f55b_row119_col0, #T_9f55b_row119_col1, #T_9f55b_row119_col2, #T_9f55b_row119_col3, #T_9f55b_row119_col4, #T_9f55b_row119_col5, #T_9f55b_row120_col0, #T_9f55b_row120_col1, #T_9f55b_row120_col2, #T_9f55b_row120_col3, #T_9f55b_row120_col4, #T_9f55b_row120_col5, #T_9f55b_row121_col0, #T_9f55b_row121_col1, #T_9f55b_row121_col2, #T_9f55b_row121_col3, #T_9f55b_row121_col4, #T_9f55b_row121_col5, #T_9f55b_row122_col0, #T_9f55b_row122_col1, #T_9f55b_row122_col2, #T_9f55b_row122_col3, #T_9f55b_row122_col4, #T_9f55b_row122_col5, #T_9f55b_row123_col0, #T_9f55b_row123_col1, #T_9f55b_row123_col2, #T_9f55b_row123_col3, #T_9f55b_row123_col4, #T_9f55b_row123_col5, #T_9f55b_row124_col0, #T_9f55b_row124_col1, #T_9f55b_row124_col2, #T_9f55b_row124_col3, #T_9f55b_row124_col4, #T_9f55b_row124_col5, #T_9f55b_row125_col0, #T_9f55b_row125_col1, #T_9f55b_row125_col2, #T_9f55b_row125_col3, #T_9f55b_row125_col4, #T_9f55b_row125_col5, #T_9f55b_row126_col0, #T_9f55b_row126_col1, #T_9f55b_row126_col2, #T_9f55b_row126_col3, #T_9f55b_row126_col4, #T_9f55b_row126_col5, #T_9f55b_row127_col0, #T_9f55b_row127_col1, #T_9f55b_row127_col2, #T_9f55b_row127_col3, #T_9f55b_row127_col4, #T_9f55b_row127_col5, #T_9f55b_row128_col0, #T_9f55b_row128_col1, #T_9f55b_row128_col2, #T_9f55b_row128_col3, #T_9f55b_row128_col4, #T_9f55b_row128_col5, #T_9f55b_row129_col0, #T_9f55b_row129_col1, #T_9f55b_row129_col2, #T_9f55b_row129_col3, #T_9f55b_row129_col4, #T_9f55b_row129_col5, #T_9f55b_row130_col0, #T_9f55b_row130_col1, #T_9f55b_row130_col2, #T_9f55b_row130_col3, #T_9f55b_row130_col4, #T_9f55b_row130_col5, #T_9f55b_row131_col0, #T_9f55b_row131_col1, #T_9f55b_row131_col2, #T_9f55b_row131_col3, #T_9f55b_row131_col4, #T_9f55b_row131_col5, #T_9f55b_row132_col0, #T_9f55b_row132_col1, #T_9f55b_row132_col2, #T_9f55b_row132_col3, #T_9f55b_row132_col4, #T_9f55b_row132_col5, #T_9f55b_row133_col0, #T_9f55b_row133_col1, #T_9f55b_row133_col2, #T_9f55b_row133_col3, #T_9f55b_row133_col4, #T_9f55b_row133_col5, #T_9f55b_row134_col0, #T_9f55b_row134_col1, #T_9f55b_row134_col2, #T_9f55b_row134_col3, #T_9f55b_row134_col4, #T_9f55b_row134_col5, #T_9f55b_row135_col0, #T_9f55b_row135_col1, #T_9f55b_row135_col2, #T_9f55b_row135_col3, #T_9f55b_row135_col4, #T_9f55b_row135_col5, #T_9f55b_row136_col0, #T_9f55b_row136_col1, #T_9f55b_row136_col2, #T_9f55b_row136_col3, #T_9f55b_row136_col4, #T_9f55b_row136_col5, #T_9f55b_row137_col0, #T_9f55b_row137_col1, #T_9f55b_row137_col2, #T_9f55b_row137_col3, #T_9f55b_row137_col4, #T_9f55b_row137_col5, #T_9f55b_row138_col0, #T_9f55b_row138_col1, #T_9f55b_row138_col2, #T_9f55b_row138_col3, #T_9f55b_row138_col4, #T_9f55b_row138_col5, #T_9f55b_row139_col0, #T_9f55b_row139_col1, #T_9f55b_row139_col2, #T_9f55b_row139_col3, #T_9f55b_row139_col4, #T_9f55b_row139_col5 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_9f55b\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_9f55b_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_9f55b_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_9f55b_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_9f55b_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_9f55b_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_9f55b_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row0\" class=\"row_heading level0 row0\" >office_document_executing_macro_code.yml</th>\n",
       "      <td id=\"T_9f55b_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row0_col5\" class=\"data row0 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row1\" class=\"row_heading level0 row1\" >suspicious_process_file_path.yml</th>\n",
       "      <td id=\"T_9f55b_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row1_col5\" class=\"data row1 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row2\" class=\"row_heading level0 row2\" >executables_or_script_creation_in_suspicious_path.yml</th>\n",
       "      <td id=\"T_9f55b_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row2_col5\" class=\"data row2 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row3\" class=\"row_heading level0 row3\" >office_product_spawn_cmd_process.yml</th>\n",
       "      <td id=\"T_9f55b_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row3_col5\" class=\"data row3 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row4\" class=\"row_heading level0 row4\" >windows_phishing_recent_iso_exec_registry.yml</th>\n",
       "      <td id=\"T_9f55b_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row4_col3\" class=\"data row4 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row4_col5\" class=\"data row4 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row5\" class=\"row_heading level0 row5\" >windows_iso_lnk_file_creation.yml</th>\n",
       "      <td id=\"T_9f55b_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row5_col3\" class=\"data row5 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row5_col5\" class=\"data row5 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row6\" class=\"row_heading level0 row6\" >scheduled_task_deleted_or_created_via_cmd.yml</th>\n",
       "      <td id=\"T_9f55b_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row6_col2\" class=\"data row6 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row6_col5\" class=\"data row6 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row7\" class=\"row_heading level0 row7\" >registry_keys_used_for_persistence.yml</th>\n",
       "      <td id=\"T_9f55b_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row7_col5\" class=\"data row7 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row8\" class=\"row_heading level0 row8\" >non_firefox_process_access_firefox_profile_dir.yml</th>\n",
       "      <td id=\"T_9f55b_row8_col0\" class=\"data row8 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row8_col5\" class=\"data row8 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row9\" class=\"row_heading level0 row9\" >windows_defender_exclusion_registry_entry.yml</th>\n",
       "      <td id=\"T_9f55b_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row9_col5\" class=\"data row9 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row10\" class=\"row_heading level0 row10\" >disabling_remote_user_account_control.yml</th>\n",
       "      <td id=\"T_9f55b_row10_col0\" class=\"data row10 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row10_col3\" class=\"data row10 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row10_col5\" class=\"data row10 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row11\" class=\"row_heading level0 row11\" >add_or_set_windows_defender_exclusion.yml</th>\n",
       "      <td id=\"T_9f55b_row11_col0\" class=\"data row11 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row11_col1\" class=\"data row11 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row11_col3\" class=\"data row11 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row11_col4\" class=\"data row11 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row11_col5\" class=\"data row11 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row12\" class=\"row_heading level0 row12\" >disable_defender_spynet_reporting.yml</th>\n",
       "      <td id=\"T_9f55b_row12_col0\" class=\"data row12 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row12_col2\" class=\"data row12 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row12_col3\" class=\"data row12 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row12_col4\" class=\"data row12 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row12_col5\" class=\"data row12 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row13\" class=\"row_heading level0 row13\" >office_product_spawning_certutil.yml</th>\n",
       "      <td id=\"T_9f55b_row13_col0\" class=\"data row13 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row13_col1\" class=\"data row13 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row13_col2\" class=\"data row13 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row13_col3\" class=\"data row13 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row13_col4\" class=\"data row13 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row13_col5\" class=\"data row13 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row14\" class=\"row_heading level0 row14\" >excessive_usage_of_taskkill.yml</th>\n",
       "      <td id=\"T_9f55b_row14_col0\" class=\"data row14 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row14_col2\" class=\"data row14 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row14_col3\" class=\"data row14 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row14_col4\" class=\"data row14 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row14_col5\" class=\"data row14 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row15\" class=\"row_heading level0 row15\" >regsvr32_with_known_silent_switch_cmdline.yml</th>\n",
       "      <td id=\"T_9f55b_row15_col0\" class=\"data row15 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row15_col1\" class=\"data row15 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row15_col3\" class=\"data row15 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row15_col4\" class=\"data row15 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row15_col5\" class=\"data row15 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row16\" class=\"row_heading level0 row16\" >cmd_carry_out_string_command_parameter.yml</th>\n",
       "      <td id=\"T_9f55b_row16_col0\" class=\"data row16 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row16_col1\" class=\"data row16 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row16_col2\" class=\"data row16 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row16_col3\" class=\"data row16 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row16_col4\" class=\"data row16 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row16_col5\" class=\"data row16 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row17\" class=\"row_heading level0 row17\" >office_application_spawn_rundll32_process.yml</th>\n",
       "      <td id=\"T_9f55b_row17_col0\" class=\"data row17 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row17_col1\" class=\"data row17 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row17_col2\" class=\"data row17 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row17_col3\" class=\"data row17 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row17_col4\" class=\"data row17 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row17_col5\" class=\"data row17 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row18\" class=\"row_heading level0 row18\" >powershell_windows_defender_exclusion_commands.yml</th>\n",
       "      <td id=\"T_9f55b_row18_col0\" class=\"data row18 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row18_col1\" class=\"data row18 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row18_col2\" class=\"data row18 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row18_col3\" class=\"data row18 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row18_col4\" class=\"data row18 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row18_col5\" class=\"data row18 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row19\" class=\"row_heading level0 row19\" >attempt_to_stop_security_service.yml</th>\n",
       "      <td id=\"T_9f55b_row19_col0\" class=\"data row19 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row19_col2\" class=\"data row19 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row19_col3\" class=\"data row19 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row19_col4\" class=\"data row19 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row19_col5\" class=\"data row19 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row20\" class=\"row_heading level0 row20\" >wermgr_process_spawned_cmd_or_powershell_process.yml</th>\n",
       "      <td id=\"T_9f55b_row20_col0\" class=\"data row20 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row20_col1\" class=\"data row20 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row20_col2\" class=\"data row20 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row20_col3\" class=\"data row20 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row20_col4\" class=\"data row20 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row20_col5\" class=\"data row20 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row21\" class=\"row_heading level0 row21\" >non_chrome_process_accessing_chrome_default_dir.yml</th>\n",
       "      <td id=\"T_9f55b_row21_col0\" class=\"data row21 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row21_col1\" class=\"data row21 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row21_col2\" class=\"data row21 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row21_col3\" class=\"data row21 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row21_col4\" class=\"data row21 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row21_col5\" class=\"data row21 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row22\" class=\"row_heading level0 row22\" >chcp_command_execution.yml</th>\n",
       "      <td id=\"T_9f55b_row22_col0\" class=\"data row22 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row22_col2\" class=\"data row22 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row22_col3\" class=\"data row22 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row22_col4\" class=\"data row22 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row22_col5\" class=\"data row22 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row23\" class=\"row_heading level0 row23\" >jscript_execution_using_cscript_app.yml</th>\n",
       "      <td id=\"T_9f55b_row23_col0\" class=\"data row23 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row23_col1\" class=\"data row23 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row23_col2\" class=\"data row23 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row23_col3\" class=\"data row23 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row23_col4\" class=\"data row23 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row23_col5\" class=\"data row23 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row24\" class=\"row_heading level0 row24\" >wmic_noninteractive_app_uninstallation.yml</th>\n",
       "      <td id=\"T_9f55b_row24_col0\" class=\"data row24 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row24_col1\" class=\"data row24 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row24_col2\" class=\"data row24 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row24_col3\" class=\"data row24 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row24_col4\" class=\"data row24 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row24_col5\" class=\"data row24 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row25\" class=\"row_heading level0 row25\" >executable_file_written_in_administrative_smb_share.yml</th>\n",
       "      <td id=\"T_9f55b_row25_col0\" class=\"data row25 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row25_col1\" class=\"data row25 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row25_col2\" class=\"data row25 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row25_col3\" class=\"data row25 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row25_col4\" class=\"data row25 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row25_col5\" class=\"data row25 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row26\" class=\"row_heading level0 row26\" >windows_powershell_import_applocker_policy.yml</th>\n",
       "      <td id=\"T_9f55b_row26_col0\" class=\"data row26 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row26_col1\" class=\"data row26 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row26_col2\" class=\"data row26 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row26_col3\" class=\"data row26 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row26_col4\" class=\"data row26 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row26_col5\" class=\"data row26 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row27\" class=\"row_heading level0 row27\" >windows_service_stop_by_deletion.yml</th>\n",
       "      <td id=\"T_9f55b_row27_col0\" class=\"data row27 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row27_col1\" class=\"data row27 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row27_col2\" class=\"data row27 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row27_col3\" class=\"data row27 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row27_col4\" class=\"data row27 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row27_col5\" class=\"data row27 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row28\" class=\"row_heading level0 row28\" >disable_defender_submit_samples_consent_feature.yml</th>\n",
       "      <td id=\"T_9f55b_row28_col0\" class=\"data row28 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row28_col2\" class=\"data row28 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row28_col3\" class=\"data row28 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row28_col4\" class=\"data row28 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row28_col5\" class=\"data row28 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row29\" class=\"row_heading level0 row29\" >schedule_task_with_rundll32_command_trigger.yml</th>\n",
       "      <td id=\"T_9f55b_row29_col0\" class=\"data row29 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row29_col1\" class=\"data row29 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row29_col2\" class=\"data row29 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row29_col3\" class=\"data row29 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row29_col4\" class=\"data row29 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row29_col5\" class=\"data row29 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row30\" class=\"row_heading level0 row30\" >suspicious_copy_on_system32.yml</th>\n",
       "      <td id=\"T_9f55b_row30_col0\" class=\"data row30 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row30_col1\" class=\"data row30 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row30_col2\" class=\"data row30 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row30_col3\" class=\"data row30 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row30_col4\" class=\"data row30 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row30_col5\" class=\"data row30 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row31\" class=\"row_heading level0 row31\" >detect_html_help_spawn_child_process.yml</th>\n",
       "      <td id=\"T_9f55b_row31_col0\" class=\"data row31 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row31_col1\" class=\"data row31 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row31_col2\" class=\"data row31 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row31_col3\" class=\"data row31 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row31_col5\" class=\"data row31 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row32\" class=\"row_heading level0 row32\" >windows_modify_registry_disallow_windows_app.yml</th>\n",
       "      <td id=\"T_9f55b_row32_col0\" class=\"data row32 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row32_col1\" class=\"data row32 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row32_col2\" class=\"data row32 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row32_col3\" class=\"data row32 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row32_col4\" class=\"data row32 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row32_col5\" class=\"data row32 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row33\" class=\"row_heading level0 row33\" >services_exe_lolbas_execution_process_spawn.yml</th>\n",
       "      <td id=\"T_9f55b_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row33_col1\" class=\"data row33 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row33_col2\" class=\"data row33 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row33_col3\" class=\"data row33 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row33_col4\" class=\"data row33 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row33_col5\" class=\"data row33 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row34\" class=\"row_heading level0 row34\" >windows_gather_victim_network_info_through_ip_check_web_services.yml</th>\n",
       "      <td id=\"T_9f55b_row34_col0\" class=\"data row34 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row34_col2\" class=\"data row34 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row34_col3\" class=\"data row34 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row34_col4\" class=\"data row34 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row34_col5\" class=\"data row34 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row35\" class=\"row_heading level0 row35\" >suspicious_rundll32_startw.yml</th>\n",
       "      <td id=\"T_9f55b_row35_col0\" class=\"data row35 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row35_col1\" class=\"data row35 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row35_col2\" class=\"data row35 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row35_col3\" class=\"data row35 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row35_col4\" class=\"data row35 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row35_col5\" class=\"data row35 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row36\" class=\"row_heading level0 row36\" >windows_regsvr32_renamed_binary.yml</th>\n",
       "      <td id=\"T_9f55b_row36_col0\" class=\"data row36 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row36_col1\" class=\"data row36 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row36_col2\" class=\"data row36 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row36_col3\" class=\"data row36 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row36_col4\" class=\"data row36 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row36_col5\" class=\"data row36 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row37\" class=\"row_heading level0 row37\" >winhlp32_spawning_a_process.yml</th>\n",
       "      <td id=\"T_9f55b_row37_col0\" class=\"data row37 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row37_col1\" class=\"data row37 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row37_col2\" class=\"data row37 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row37_col3\" class=\"data row37 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row37_col4\" class=\"data row37 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row37_col5\" class=\"data row37 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row38\" class=\"row_heading level0 row38\" >account_discovery_with_net_app.yml</th>\n",
       "      <td id=\"T_9f55b_row38_col0\" class=\"data row38 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row38_col1\" class=\"data row38 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row38_col2\" class=\"data row38 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row38_col3\" class=\"data row38 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row38_col4\" class=\"data row38 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row38_col5\" class=\"data row38 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row39\" class=\"row_heading level0 row39\" >excessive_usage_of_sc_service_utility.yml</th>\n",
       "      <td id=\"T_9f55b_row39_col0\" class=\"data row39 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row39_col1\" class=\"data row39 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row39_col2\" class=\"data row39 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row39_col3\" class=\"data row39 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row39_col4\" class=\"data row39 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row39_col5\" class=\"data row39 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row40\" class=\"row_heading level0 row40\" >disable_show_hidden_files.yml</th>\n",
       "      <td id=\"T_9f55b_row40_col0\" class=\"data row40 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row40_col1\" class=\"data row40 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row40_col2\" class=\"data row40 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row40_col3\" class=\"data row40 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row40_col4\" class=\"data row40 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row40_col5\" class=\"data row40 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row41\" class=\"row_heading level0 row41\" >windows_modify_registry_disable_win_defender_raw_write_notif.yml</th>\n",
       "      <td id=\"T_9f55b_row41_col0\" class=\"data row41 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row41_col1\" class=\"data row41 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row41_col2\" class=\"data row41 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row41_col3\" class=\"data row41 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row41_col4\" class=\"data row41 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row41_col5\" class=\"data row41 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row42\" class=\"row_heading level0 row42\" >process_writing_dynamicwrapperx.yml</th>\n",
       "      <td id=\"T_9f55b_row42_col0\" class=\"data row42 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row42_col1\" class=\"data row42 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row42_col2\" class=\"data row42 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row42_col3\" class=\"data row42 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row42_col4\" class=\"data row42 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row42_col5\" class=\"data row42 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row43\" class=\"row_heading level0 row43\" >detect_use_of_cmd_exe_to_launch_script_interpreters.yml</th>\n",
       "      <td id=\"T_9f55b_row43_col0\" class=\"data row43 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row43_col1\" class=\"data row43 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row43_col2\" class=\"data row43 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row43_col3\" class=\"data row43 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row43_col4\" class=\"data row43 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row43_col5\" class=\"data row43 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row44\" class=\"row_heading level0 row44\" >windows_valid_account_with_never_expires_password.yml</th>\n",
       "      <td id=\"T_9f55b_row44_col0\" class=\"data row44 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row44_col1\" class=\"data row44 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row44_col2\" class=\"data row44 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row44_col3\" class=\"data row44 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row44_col4\" class=\"data row44 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row44_col5\" class=\"data row44 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row45\" class=\"row_heading level0 row45\" >windows_schtasks_create_run_as_system.yml</th>\n",
       "      <td id=\"T_9f55b_row45_col0\" class=\"data row45 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row45_col1\" class=\"data row45 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row45_col2\" class=\"data row45 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row45_col3\" class=\"data row45 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row45_col4\" class=\"data row45 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row45_col5\" class=\"data row45 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row46\" class=\"row_heading level0 row46\" >windows_driver_load_non_standard_path.yml</th>\n",
       "      <td id=\"T_9f55b_row46_col0\" class=\"data row46 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row46_col1\" class=\"data row46 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row46_col2\" class=\"data row46 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row46_col3\" class=\"data row46 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row46_col4\" class=\"data row46 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row46_col5\" class=\"data row46 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row47\" class=\"row_heading level0 row47\" >windows_impair_defense_deny_security_software_with_applocker.yml</th>\n",
       "      <td id=\"T_9f55b_row47_col0\" class=\"data row47 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row47_col1\" class=\"data row47 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row47_col2\" class=\"data row47 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row47_col3\" class=\"data row47 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row47_col4\" class=\"data row47 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row47_col5\" class=\"data row47 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row48\" class=\"row_heading level0 row48\" >windows_dll_side_loading_process_child_of_calc.yml</th>\n",
       "      <td id=\"T_9f55b_row48_col0\" class=\"data row48 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row48_col1\" class=\"data row48 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row48_col2\" class=\"data row48 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row48_col3\" class=\"data row48 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row48_col4\" class=\"data row48 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row48_col5\" class=\"data row48 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row49\" class=\"row_heading level0 row49\" >windows_modify_registry_disabling_wer_settings.yml</th>\n",
       "      <td id=\"T_9f55b_row49_col0\" class=\"data row49 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row49_col1\" class=\"data row49 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row49_col2\" class=\"data row49 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row49_col3\" class=\"data row49 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row49_col4\" class=\"data row49 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row49_col5\" class=\"data row49 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row50\" class=\"row_heading level0 row50\" >net_localgroup_discovery.yml</th>\n",
       "      <td id=\"T_9f55b_row50_col0\" class=\"data row50 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row50_col1\" class=\"data row50 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row50_col2\" class=\"data row50 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row50_col3\" class=\"data row50 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row50_col4\" class=\"data row50 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row50_col5\" class=\"data row50 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row51\" class=\"row_heading level0 row51\" >windows_dll_search_order_hijacking_hunt_with_sysmon.yml</th>\n",
       "      <td id=\"T_9f55b_row51_col0\" class=\"data row51 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row51_col1\" class=\"data row51 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row51_col2\" class=\"data row51 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row51_col3\" class=\"data row51 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row51_col4\" class=\"data row51 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row51_col5\" class=\"data row51 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row52\" class=\"row_heading level0 row52\" >disable_defender_blockatfirstseen_feature.yml</th>\n",
       "      <td id=\"T_9f55b_row52_col0\" class=\"data row52 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row52_col1\" class=\"data row52 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row52_col2\" class=\"data row52 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row52_col3\" class=\"data row52 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row52_col4\" class=\"data row52 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row52_col5\" class=\"data row52 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row53\" class=\"row_heading level0 row53\" >powershell___connect_to_internet_with_hidden_window.yml</th>\n",
       "      <td id=\"T_9f55b_row53_col0\" class=\"data row53 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row53_col1\" class=\"data row53 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row53_col2\" class=\"data row53 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row53_col3\" class=\"data row53 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row53_col4\" class=\"data row53 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row53_col5\" class=\"data row53 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row54\" class=\"row_heading level0 row54\" >wscript_or_cscript_suspicious_child_process.yml</th>\n",
       "      <td id=\"T_9f55b_row54_col0\" class=\"data row54 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row54_col1\" class=\"data row54 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row54_col2\" class=\"data row54 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row54_col3\" class=\"data row54 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row54_col4\" class=\"data row54 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row54_col5\" class=\"data row54 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row55\" class=\"row_heading level0 row55\" >hiding_files_and_directories_with_attrib_exe.yml</th>\n",
       "      <td id=\"T_9f55b_row55_col0\" class=\"data row55 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row55_col2\" class=\"data row55 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row55_col3\" class=\"data row55 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row55_col4\" class=\"data row55 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row55_col5\" class=\"data row55 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row56\" class=\"row_heading level0 row56\" >windows_modify_registry_disable_toast_notifications.yml</th>\n",
       "      <td id=\"T_9f55b_row56_col0\" class=\"data row56 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row56_col2\" class=\"data row56 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row56_col3\" class=\"data row56 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row56_col4\" class=\"data row56 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row56_col5\" class=\"data row56 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row57\" class=\"row_heading level0 row57\" >windows_modify_registry_disable_windows_security_center_notif.yml</th>\n",
       "      <td id=\"T_9f55b_row57_col0\" class=\"data row57 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row57_col1\" class=\"data row57 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row57_col2\" class=\"data row57 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row57_col3\" class=\"data row57 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row57_col4\" class=\"data row57 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row57_col5\" class=\"data row57 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row58\" class=\"row_heading level0 row58\" >windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml</th>\n",
       "      <td id=\"T_9f55b_row58_col0\" class=\"data row58 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row58_col1\" class=\"data row58 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row58_col2\" class=\"data row58 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row58_col3\" class=\"data row58 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row58_col4\" class=\"data row58 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row58_col5\" class=\"data row58 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row59\" class=\"row_heading level0 row59\" >windows_wmi_impersonate_token.yml</th>\n",
       "      <td id=\"T_9f55b_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row59_col1\" class=\"data row59 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row59_col2\" class=\"data row59 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row59_col3\" class=\"data row59 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row59_col4\" class=\"data row59 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row59_col5\" class=\"data row59 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row60\" class=\"row_heading level0 row60\" >office_application_spawn_regsvr32_process.yml</th>\n",
       "      <td id=\"T_9f55b_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row60_col1\" class=\"data row60 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row60_col2\" class=\"data row60 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row60_col3\" class=\"data row60 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row60_col4\" class=\"data row60 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row60_col5\" class=\"data row60 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row61\" class=\"row_heading level0 row61\" >windows_modify_registry_qakbot_binary_data_registry.yml</th>\n",
       "      <td id=\"T_9f55b_row61_col0\" class=\"data row61 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row61_col1\" class=\"data row61 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row61_col2\" class=\"data row61 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row61_col3\" class=\"data row61 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row61_col4\" class=\"data row61 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row61_col5\" class=\"data row61 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row62\" class=\"row_heading level0 row62\" >nltest_domain_trust_discovery.yml</th>\n",
       "      <td id=\"T_9f55b_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row62_col1\" class=\"data row62 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row62_col2\" class=\"data row62 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row62_col3\" class=\"data row62 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row62_col4\" class=\"data row62 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row62_col5\" class=\"data row62 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row63\" class=\"row_heading level0 row63\" >windows_modify_registry_suppress_win_defender_notif.yml</th>\n",
       "      <td id=\"T_9f55b_row63_col0\" class=\"data row63 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row63_col1\" class=\"data row63 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row63_col2\" class=\"data row63 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row63_col3\" class=\"data row63 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row63_col4\" class=\"data row63 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row63_col5\" class=\"data row63 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row64\" class=\"row_heading level0 row64\" >process_creating_lnk_file_in_suspicious_location.yml</th>\n",
       "      <td id=\"T_9f55b_row64_col0\" class=\"data row64 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row64_col1\" class=\"data row64 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row64_col2\" class=\"data row64 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row64_col3\" class=\"data row64 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row64_col4\" class=\"data row64 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row64_col5\" class=\"data row64 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row65\" class=\"row_heading level0 row65\" >office_application_drop_executable.yml</th>\n",
       "      <td id=\"T_9f55b_row65_col0\" class=\"data row65 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row65_col1\" class=\"data row65 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row65_col2\" class=\"data row65 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row65_col3\" class=\"data row65 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row65_col4\" class=\"data row65 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row65_col5\" class=\"data row65 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row66\" class=\"row_heading level0 row66\" >allow_inbound_traffic_by_firewall_rule_registry.yml</th>\n",
       "      <td id=\"T_9f55b_row66_col0\" class=\"data row66 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row66_col1\" class=\"data row66 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row66_col2\" class=\"data row66 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row66_col3\" class=\"data row66 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row66_col4\" class=\"data row66 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row66_col5\" class=\"data row66 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row67\" class=\"row_heading level0 row67\" >disable_defender_enhanced_notification.yml</th>\n",
       "      <td id=\"T_9f55b_row67_col0\" class=\"data row67 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row67_col1\" class=\"data row67 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row67_col2\" class=\"data row67 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row67_col3\" class=\"data row67 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row67_col4\" class=\"data row67 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row67_col5\" class=\"data row67 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row68\" class=\"row_heading level0 row68\" >powershell_remote_thread_to_known_windows_process.yml</th>\n",
       "      <td id=\"T_9f55b_row68_col0\" class=\"data row68 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row68_col1\" class=\"data row68 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row68_col2\" class=\"data row68 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row68_col3\" class=\"data row68 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row68_col4\" class=\"data row68 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row68_col5\" class=\"data row68 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row69\" class=\"row_heading level0 row69\" >windows_process_injection_of_wermgr_to_known_browser.yml</th>\n",
       "      <td id=\"T_9f55b_row69_col0\" class=\"data row69 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row69_col1\" class=\"data row69 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row69_col2\" class=\"data row69 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row69_col3\" class=\"data row69 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row69_col4\" class=\"data row69 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row69_col5\" class=\"data row69 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row70\" class=\"row_heading level0 row70\" >windows_multi_hop_proxy_tor_website_query.yml</th>\n",
       "      <td id=\"T_9f55b_row70_col0\" class=\"data row70 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row70_col1\" class=\"data row70 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row70_col2\" class=\"data row70 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row70_col3\" class=\"data row70 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row70_col4\" class=\"data row70 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row70_col5\" class=\"data row70 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row71\" class=\"row_heading level0 row71\" >system_info_gathering_using_dxdiag_application.yml</th>\n",
       "      <td id=\"T_9f55b_row71_col0\" class=\"data row71 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row71_col1\" class=\"data row71 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row71_col2\" class=\"data row71 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row71_col3\" class=\"data row71 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row71_col4\" class=\"data row71 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row71_col5\" class=\"data row71 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row72\" class=\"row_heading level0 row72\" >windows_mail_protocol_in_non_common_process_path.yml</th>\n",
       "      <td id=\"T_9f55b_row72_col0\" class=\"data row72 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row72_col1\" class=\"data row72 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row72_col2\" class=\"data row72 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row72_col3\" class=\"data row72 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row72_col4\" class=\"data row72 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row72_col5\" class=\"data row72 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row73\" class=\"row_heading level0 row73\" >winevent_windows_task_scheduler_event_action_started.yml</th>\n",
       "      <td id=\"T_9f55b_row73_col0\" class=\"data row73 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row73_col1\" class=\"data row73 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row73_col2\" class=\"data row73 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row73_col3\" class=\"data row73 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row73_col4\" class=\"data row73 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row73_col5\" class=\"data row73 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row74\" class=\"row_heading level0 row74\" >regsvr32_silent_and_install_param_dll_loading.yml</th>\n",
       "      <td id=\"T_9f55b_row74_col0\" class=\"data row74 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row74_col1\" class=\"data row74 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row74_col2\" class=\"data row74 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row74_col3\" class=\"data row74 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row74_col4\" class=\"data row74 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row74_col5\" class=\"data row74 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row75\" class=\"row_heading level0 row75\" >network_connection_discovery_net.yml</th>\n",
       "      <td id=\"T_9f55b_row75_col0\" class=\"data row75 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row75_col1\" class=\"data row75 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row75_col2\" class=\"data row75 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row75_col3\" class=\"data row75 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row75_col4\" class=\"data row75 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row75_col5\" class=\"data row75 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row76\" class=\"row_heading level0 row76\" >windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml</th>\n",
       "      <td id=\"T_9f55b_row76_col0\" class=\"data row76 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row76_col1\" class=\"data row76 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row76_col2\" class=\"data row76 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row76_col3\" class=\"data row76 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row76_col4\" class=\"data row76 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row76_col5\" class=\"data row76 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row77\" class=\"row_heading level0 row77\" >sc_exe_manipulating_windows_services.yml</th>\n",
       "      <td id=\"T_9f55b_row77_col0\" class=\"data row77 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row77_col1\" class=\"data row77 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row77_col2\" class=\"data row77 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row77_col3\" class=\"data row77 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row77_col4\" class=\"data row77 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row77_col5\" class=\"data row77 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row78\" class=\"row_heading level0 row78\" >disable_windows_behavior_monitoring.yml</th>\n",
       "      <td id=\"T_9f55b_row78_col0\" class=\"data row78 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row78_col1\" class=\"data row78 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row78_col2\" class=\"data row78 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row78_col3\" class=\"data row78 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row78_col4\" class=\"data row78 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row78_col5\" class=\"data row78 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row79\" class=\"row_heading level0 row79\" >create_remote_thread_in_shell_application.yml</th>\n",
       "      <td id=\"T_9f55b_row79_col0\" class=\"data row79 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row79_col1\" class=\"data row79 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row79_col2\" class=\"data row79 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row79_col3\" class=\"data row79 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row79_col4\" class=\"data row79 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row79_col5\" class=\"data row79 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row80\" class=\"row_heading level0 row80\" >network_connection_discovery_arp.yml</th>\n",
       "      <td id=\"T_9f55b_row80_col0\" class=\"data row80 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row80_col1\" class=\"data row80 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row80_col2\" class=\"data row80 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row80_col3\" class=\"data row80 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row80_col4\" class=\"data row80 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row80_col5\" class=\"data row80 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row81\" class=\"row_heading level0 row81\" >schtasks_run_task_on_demand.yml</th>\n",
       "      <td id=\"T_9f55b_row81_col0\" class=\"data row81 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row81_col1\" class=\"data row81 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row81_col2\" class=\"data row81 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row81_col3\" class=\"data row81 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row81_col4\" class=\"data row81 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row81_col5\" class=\"data row81 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row82\" class=\"row_heading level0 row82\" >windows_masquerading_explorer_as_child_process.yml</th>\n",
       "      <td id=\"T_9f55b_row82_col0\" class=\"data row82 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row82_col1\" class=\"data row82 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row82_col2\" class=\"data row82 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row82_col3\" class=\"data row82 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row82_col4\" class=\"data row82 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row82_col5\" class=\"data row82 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row83\" class=\"row_heading level0 row83\" >windows_wmi_process_call_create.yml</th>\n",
       "      <td id=\"T_9f55b_row83_col0\" class=\"data row83 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row83_col1\" class=\"data row83 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row83_col2\" class=\"data row83 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row83_col3\" class=\"data row83 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row83_col4\" class=\"data row83 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row83_col5\" class=\"data row83 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row84\" class=\"row_heading level0 row84\" >cmdline_tool_not_executed_in_cmd_shell.yml</th>\n",
       "      <td id=\"T_9f55b_row84_col0\" class=\"data row84 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row84_col1\" class=\"data row84 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row84_col2\" class=\"data row84 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row84_col3\" class=\"data row84 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row84_col4\" class=\"data row84 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row84_col5\" class=\"data row84 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row85\" class=\"row_heading level0 row85\" >windows_modify_registry_regedit_silent_reg_import.yml</th>\n",
       "      <td id=\"T_9f55b_row85_col0\" class=\"data row85 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row85_col1\" class=\"data row85 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row85_col2\" class=\"data row85 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row85_col3\" class=\"data row85 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row85_col4\" class=\"data row85 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row85_col5\" class=\"data row85 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row86\" class=\"row_heading level0 row86\" >windows_file_transfer_protocol_in_non_common_process_path.yml</th>\n",
       "      <td id=\"T_9f55b_row86_col0\" class=\"data row86 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row86_col1\" class=\"data row86 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row86_col2\" class=\"data row86 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row86_col3\" class=\"data row86 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row86_col4\" class=\"data row86 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row86_col5\" class=\"data row86 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row87\" class=\"row_heading level0 row87\" >network_connection_discovery_netstat.yml</th>\n",
       "      <td id=\"T_9f55b_row87_col0\" class=\"data row87 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row87_col1\" class=\"data row87 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row87_col2\" class=\"data row87 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row87_col3\" class=\"data row87 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row87_col4\" class=\"data row87 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row87_col5\" class=\"data row87 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row88\" class=\"row_heading level0 row88\" >windows_remote_services_rdp_enable.yml</th>\n",
       "      <td id=\"T_9f55b_row88_col0\" class=\"data row88 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row88_col1\" class=\"data row88 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row88_col2\" class=\"data row88 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row88_col3\" class=\"data row88 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row88_col4\" class=\"data row88 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row88_col5\" class=\"data row88 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row89\" class=\"row_heading level0 row89\" >suspicious_wav_file_in_appdata_folder.yml</th>\n",
       "      <td id=\"T_9f55b_row89_col0\" class=\"data row89 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row89_col1\" class=\"data row89 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row89_col2\" class=\"data row89 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row89_col3\" class=\"data row89 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row89_col4\" class=\"data row89 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row89_col5\" class=\"data row89 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row90\" class=\"row_heading level0 row90\" >allow_operation_with_consent_admin.yml</th>\n",
       "      <td id=\"T_9f55b_row90_col0\" class=\"data row90 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row90_col1\" class=\"data row90 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row90_col2\" class=\"data row90 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row90_col3\" class=\"data row90 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row90_col4\" class=\"data row90 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row90_col5\" class=\"data row90 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row91\" class=\"row_heading level0 row91\" >windows_remote_services_allow_rdp_in_firewall.yml</th>\n",
       "      <td id=\"T_9f55b_row91_col0\" class=\"data row91 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row91_col1\" class=\"data row91 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row91_col2\" class=\"data row91 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row91_col3\" class=\"data row91 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row91_col4\" class=\"data row91 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row91_col5\" class=\"data row91 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row92\" class=\"row_heading level0 row92\" >suspicious_process_dns_query_known_abuse_web_services.yml</th>\n",
       "      <td id=\"T_9f55b_row92_col0\" class=\"data row92 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row92_col1\" class=\"data row92 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row92_col2\" class=\"data row92 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row92_col3\" class=\"data row92 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row92_col4\" class=\"data row92 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row92_col5\" class=\"data row92 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row93\" class=\"row_heading level0 row93\" >icacls_deny_command.yml</th>\n",
       "      <td id=\"T_9f55b_row93_col0\" class=\"data row93 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row93_col1\" class=\"data row93 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row93_col2\" class=\"data row93 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row93_col3\" class=\"data row93 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row93_col4\" class=\"data row93 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row93_col5\" class=\"data row93 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row94\" class=\"row_heading level0 row94\" >processes_launching_netsh.yml</th>\n",
       "      <td id=\"T_9f55b_row94_col0\" class=\"data row94 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row94_col1\" class=\"data row94 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row94_col2\" class=\"data row94 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row94_col3\" class=\"data row94 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row94_col4\" class=\"data row94 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row94_col5\" class=\"data row94 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row95\" class=\"row_heading level0 row95\" >wermgr_process_connecting_to_ip_check_web_services.yml</th>\n",
       "      <td id=\"T_9f55b_row95_col0\" class=\"data row95 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row95_col1\" class=\"data row95 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row95_col2\" class=\"data row95 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row95_col3\" class=\"data row95 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row95_col4\" class=\"data row95 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row95_col5\" class=\"data row95 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row96\" class=\"row_heading level0 row96\" >hide_user_account_from_sign_in_screen.yml</th>\n",
       "      <td id=\"T_9f55b_row96_col0\" class=\"data row96 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row96_col1\" class=\"data row96 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row96_col2\" class=\"data row96 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row96_col3\" class=\"data row96 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row96_col4\" class=\"data row96 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row96_col5\" class=\"data row96 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row97\" class=\"row_heading level0 row97\" >remcos_rat_file_creation_in_remcos_folder.yml</th>\n",
       "      <td id=\"T_9f55b_row97_col0\" class=\"data row97 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row97_col1\" class=\"data row97 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row97_col2\" class=\"data row97 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row97_col3\" class=\"data row97 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row97_col4\" class=\"data row97 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row97_col5\" class=\"data row97 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row98\" class=\"row_heading level0 row98\" >windows_impair_defense_add_xml_applocker_rules.yml</th>\n",
       "      <td id=\"T_9f55b_row98_col0\" class=\"data row98 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row98_col1\" class=\"data row98 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row98_col2\" class=\"data row98 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row98_col3\" class=\"data row98 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row98_col4\" class=\"data row98 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row98_col5\" class=\"data row98 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row99\" class=\"row_heading level0 row99\" >windows_system_discovery_using_qwinsta.yml</th>\n",
       "      <td id=\"T_9f55b_row99_col0\" class=\"data row99 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row99_col1\" class=\"data row99 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row99_col2\" class=\"data row99 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row99_col3\" class=\"data row99 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row99_col4\" class=\"data row99 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row99_col5\" class=\"data row99 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row100\" class=\"row_heading level0 row100\" >wermgr_process_create_executable_file.yml</th>\n",
       "      <td id=\"T_9f55b_row100_col0\" class=\"data row100 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row100_col1\" class=\"data row100 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row100_col2\" class=\"data row100 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row100_col3\" class=\"data row100 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row100_col4\" class=\"data row100 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row100_col5\" class=\"data row100 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row101\" class=\"row_heading level0 row101\" >system_user_discovery_with_whoami.yml</th>\n",
       "      <td id=\"T_9f55b_row101_col0\" class=\"data row101 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row101_col1\" class=\"data row101 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row101_col2\" class=\"data row101 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row101_col3\" class=\"data row101 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row101_col4\" class=\"data row101 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row101_col5\" class=\"data row101 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row102\" class=\"row_heading level0 row102\" >windows_remote_services_allow_remote_assistance.yml</th>\n",
       "      <td id=\"T_9f55b_row102_col0\" class=\"data row102 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row102_col1\" class=\"data row102 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row102_col2\" class=\"data row102 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row102_col3\" class=\"data row102 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row102_col4\" class=\"data row102 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row102_col5\" class=\"data row102 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row103\" class=\"row_heading level0 row103\" >windows_remote_access_software_rms_registry.yml</th>\n",
       "      <td id=\"T_9f55b_row103_col0\" class=\"data row103 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row103_col1\" class=\"data row103 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row103_col2\" class=\"data row103 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row103_col3\" class=\"data row103 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row103_col4\" class=\"data row103 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row103_col5\" class=\"data row103 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row104\" class=\"row_heading level0 row104\" >windows_process_injection_remote_thread.yml</th>\n",
       "      <td id=\"T_9f55b_row104_col0\" class=\"data row104 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row104_col1\" class=\"data row104 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row104_col2\" class=\"data row104 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row104_col3\" class=\"data row104 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row104_col4\" class=\"data row104 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row104_col5\" class=\"data row104 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row105\" class=\"row_heading level0 row105\" >excessive_attempt_to_disable_services.yml</th>\n",
       "      <td id=\"T_9f55b_row105_col0\" class=\"data row105 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row105_col1\" class=\"data row105 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row105_col2\" class=\"data row105 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row105_col3\" class=\"data row105 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row105_col4\" class=\"data row105 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row105_col5\" class=\"data row105 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row106\" class=\"row_heading level0 row106\" >windows_remote_service_rdpwinst_tool_execution.yml</th>\n",
       "      <td id=\"T_9f55b_row106_col0\" class=\"data row106 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row106_col1\" class=\"data row106 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row106_col2\" class=\"data row106 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row106_col3\" class=\"data row106 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row106_col4\" class=\"data row106 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row106_col5\" class=\"data row106 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row107\" class=\"row_heading level0 row107\" >excessive_usage_of_cacls_app.yml</th>\n",
       "      <td id=\"T_9f55b_row107_col0\" class=\"data row107 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row107_col1\" class=\"data row107 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row107_col2\" class=\"data row107 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row107_col3\" class=\"data row107 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row107_col4\" class=\"data row107 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row107_col5\" class=\"data row107 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row108\" class=\"row_heading level0 row108\" >loading_of_dynwrapx_module.yml</th>\n",
       "      <td id=\"T_9f55b_row108_col0\" class=\"data row108 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row108_col1\" class=\"data row108 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row108_col2\" class=\"data row108 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row108_col3\" class=\"data row108 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row108_col4\" class=\"data row108 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row108_col5\" class=\"data row108 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row109\" class=\"row_heading level0 row109\" >possible_browser_pass_view_parameter.yml</th>\n",
       "      <td id=\"T_9f55b_row109_col0\" class=\"data row109 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row109_col1\" class=\"data row109 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row109_col2\" class=\"data row109 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row109_col3\" class=\"data row109 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row109_col4\" class=\"data row109 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row109_col5\" class=\"data row109 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row110\" class=\"row_heading level0 row110\" >excessive_usage_of_net_app.yml</th>\n",
       "      <td id=\"T_9f55b_row110_col0\" class=\"data row110 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row110_col1\" class=\"data row110 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row110_col2\" class=\"data row110 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row110_col3\" class=\"data row110 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row110_col4\" class=\"data row110 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row110_col5\" class=\"data row110 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row111\" class=\"row_heading level0 row111\" >windows_process_injection_wermgr_child_process.yml</th>\n",
       "      <td id=\"T_9f55b_row111_col0\" class=\"data row111 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row111_col1\" class=\"data row111 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row111_col2\" class=\"data row111 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row111_col3\" class=\"data row111 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row111_col4\" class=\"data row111 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row111_col5\" class=\"data row111 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row112\" class=\"row_heading level0 row112\" >vbscript_execution_using_wscript_app.yml</th>\n",
       "      <td id=\"T_9f55b_row112_col0\" class=\"data row112 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row112_col1\" class=\"data row112 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row112_col2\" class=\"data row112 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row112_col3\" class=\"data row112 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row112_col4\" class=\"data row112 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row112_col5\" class=\"data row112 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row113\" class=\"row_heading level0 row113\" >office_product_spawning_mshta.yml</th>\n",
       "      <td id=\"T_9f55b_row113_col0\" class=\"data row113 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row113_col1\" class=\"data row113 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row113_col2\" class=\"data row113 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row113_col3\" class=\"data row113 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row113_col4\" class=\"data row113 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row113_col5\" class=\"data row113 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row114\" class=\"row_heading level0 row114\" >windows_disableantispyware_reg.yml</th>\n",
       "      <td id=\"T_9f55b_row114_col0\" class=\"data row114 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row114_col1\" class=\"data row114 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row114_col2\" class=\"data row114 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row114_col3\" class=\"data row114 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row114_col4\" class=\"data row114 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row114_col5\" class=\"data row114 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row115\" class=\"row_heading level0 row115\" >suspicious_driver_loaded_path.yml</th>\n",
       "      <td id=\"T_9f55b_row115_col0\" class=\"data row115 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row115_col1\" class=\"data row115 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row115_col2\" class=\"data row115 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row115_col3\" class=\"data row115 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row115_col4\" class=\"data row115 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row115_col5\" class=\"data row115 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row116\" class=\"row_heading level0 row116\" >system_processes_run_from_unexpected_locations.yml</th>\n",
       "      <td id=\"T_9f55b_row116_col0\" class=\"data row116 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row116_col1\" class=\"data row116 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row116_col2\" class=\"data row116 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row116_col3\" class=\"data row116 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row116_col4\" class=\"data row116 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row116_col5\" class=\"data row116 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row117\" class=\"row_heading level0 row117\" >trickbot_named_pipe.yml</th>\n",
       "      <td id=\"T_9f55b_row117_col0\" class=\"data row117 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row117_col1\" class=\"data row117 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row117_col2\" class=\"data row117 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row117_col3\" class=\"data row117 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row117_col4\" class=\"data row117 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row117_col5\" class=\"data row117 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row118\" class=\"row_heading level0 row118\" >windows_service_created_with_suspicious_service_path.yml</th>\n",
       "      <td id=\"T_9f55b_row118_col0\" class=\"data row118 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row118_col1\" class=\"data row118 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row118_col2\" class=\"data row118 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row118_col3\" class=\"data row118 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row118_col4\" class=\"data row118 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row118_col5\" class=\"data row118 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row119\" class=\"row_heading level0 row119\" >windows_system_discovery_using_ldap_nslookup.yml</th>\n",
       "      <td id=\"T_9f55b_row119_col0\" class=\"data row119 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row119_col1\" class=\"data row119 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row119_col2\" class=\"data row119 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row119_col3\" class=\"data row119 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row119_col4\" class=\"data row119 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row119_col5\" class=\"data row119 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row120\" class=\"row_heading level0 row120\" >windows_app_layer_protocol_qakbot_namedpipe.yml</th>\n",
       "      <td id=\"T_9f55b_row120_col0\" class=\"data row120 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row120_col1\" class=\"data row120 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row120_col2\" class=\"data row120 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row120_col3\" class=\"data row120 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row120_col4\" class=\"data row120 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row120_col5\" class=\"data row120 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row121\" class=\"row_heading level0 row121\" >recon_using_wmi_class.yml</th>\n",
       "      <td id=\"T_9f55b_row121_col0\" class=\"data row121 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row121_col1\" class=\"data row121 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row121_col2\" class=\"data row121 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row121_col3\" class=\"data row121 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row121_col4\" class=\"data row121 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row121_col5\" class=\"data row121 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row122\" class=\"row_heading level0 row122\" >firewall_allowed_program_enable.yml</th>\n",
       "      <td id=\"T_9f55b_row122_col0\" class=\"data row122 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row122_col1\" class=\"data row122 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row122_col2\" class=\"data row122 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row122_col3\" class=\"data row122 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row122_col4\" class=\"data row122 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row122_col5\" class=\"data row122 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row123\" class=\"row_heading level0 row123\" >windows_command_shell_fetch_env_variables.yml</th>\n",
       "      <td id=\"T_9f55b_row123_col0\" class=\"data row123 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row123_col1\" class=\"data row123 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row123_col2\" class=\"data row123 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row123_col3\" class=\"data row123 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row123_col4\" class=\"data row123 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row123_col5\" class=\"data row123 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row124\" class=\"row_heading level0 row124\" >process_deleting_its_process_file_path.yml</th>\n",
       "      <td id=\"T_9f55b_row124_col0\" class=\"data row124 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row124_col1\" class=\"data row124 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row124_col2\" class=\"data row124 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row124_col3\" class=\"data row124 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row124_col4\" class=\"data row124 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row124_col5\" class=\"data row124 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row125\" class=\"row_heading level0 row125\" >network_discovery_using_route_windows_app.yml</th>\n",
       "      <td id=\"T_9f55b_row125_col0\" class=\"data row125 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row125_col1\" class=\"data row125 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row125_col2\" class=\"data row125 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row125_col3\" class=\"data row125 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row125_col4\" class=\"data row125 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row125_col5\" class=\"data row125 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row126\" class=\"row_heading level0 row126\" >office_product_spawning_windows_script_host.yml</th>\n",
       "      <td id=\"T_9f55b_row126_col0\" class=\"data row126 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row126_col1\" class=\"data row126 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row126_col2\" class=\"data row126 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row126_col3\" class=\"data row126 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row126_col4\" class=\"data row126 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row126_col5\" class=\"data row126 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row127\" class=\"row_heading level0 row127\" >create_local_admin_accounts_using_net_exe.yml</th>\n",
       "      <td id=\"T_9f55b_row127_col0\" class=\"data row127 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row127_col1\" class=\"data row127 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row127_col2\" class=\"data row127 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row127_col3\" class=\"data row127 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row127_col4\" class=\"data row127 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row127_col5\" class=\"data row127 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row128\" class=\"row_heading level0 row128\" >suspicious_image_creation_in_appdata_folder.yml</th>\n",
       "      <td id=\"T_9f55b_row128_col0\" class=\"data row128 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row128_col1\" class=\"data row128 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row128_col2\" class=\"data row128 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row128_col3\" class=\"data row128 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row128_col4\" class=\"data row128 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row128_col5\" class=\"data row128 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row129\" class=\"row_heading level0 row129\" >cobalt_strike_named_pipes.yml</th>\n",
       "      <td id=\"T_9f55b_row129_col0\" class=\"data row129 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row129_col1\" class=\"data row129 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row129_col2\" class=\"data row129 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row129_col3\" class=\"data row129 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row129_col4\" class=\"data row129 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row129_col5\" class=\"data row129 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row130\" class=\"row_heading level0 row130\" >windows_dll_side_loading_in_calc.yml</th>\n",
       "      <td id=\"T_9f55b_row130_col0\" class=\"data row130 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row130_col1\" class=\"data row130 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row130_col2\" class=\"data row130 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row130_col3\" class=\"data row130 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row130_col4\" class=\"data row130 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row130_col5\" class=\"data row130 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row131\" class=\"row_heading level0 row131\" >remcos_client_registry_install_entry.yml</th>\n",
       "      <td id=\"T_9f55b_row131_col0\" class=\"data row131 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row131_col1\" class=\"data row131 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row131_col2\" class=\"data row131 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row131_col3\" class=\"data row131 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row131_col4\" class=\"data row131 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row131_col5\" class=\"data row131 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row132\" class=\"row_heading level0 row132\" >powershell_loading_dotnet_into_memory_via_reflection.yml</th>\n",
       "      <td id=\"T_9f55b_row132_col0\" class=\"data row132 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row132_col1\" class=\"data row132 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row132_col2\" class=\"data row132 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row132_col3\" class=\"data row132 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row132_col4\" class=\"data row132 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row132_col5\" class=\"data row132 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row133\" class=\"row_heading level0 row133\" >suspicious_scheduled_task_from_public_directory.yml</th>\n",
       "      <td id=\"T_9f55b_row133_col0\" class=\"data row133 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row133_col1\" class=\"data row133 col1\" >yes</td>\n",
       "      <td id=\"T_9f55b_row133_col2\" class=\"data row133 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row133_col3\" class=\"data row133 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row133_col4\" class=\"data row133 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row133_col5\" class=\"data row133 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row134\" class=\"row_heading level0 row134\" >recon_avproduct_through_pwh_or_wmi.yml</th>\n",
       "      <td id=\"T_9f55b_row134_col0\" class=\"data row134 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row134_col1\" class=\"data row134 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row134_col2\" class=\"data row134 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row134_col3\" class=\"data row134 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row134_col4\" class=\"data row134 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row134_col5\" class=\"data row134 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row135\" class=\"row_heading level0 row135\" >suspicious_regsvr32_register_suspicious_path.yml</th>\n",
       "      <td id=\"T_9f55b_row135_col0\" class=\"data row135 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row135_col1\" class=\"data row135 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row135_col2\" class=\"data row135 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row135_col3\" class=\"data row135 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row135_col4\" class=\"data row135 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row135_col5\" class=\"data row135 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row136\" class=\"row_heading level0 row136\" >windows_drivers_loaded_by_signature.yml</th>\n",
       "      <td id=\"T_9f55b_row136_col0\" class=\"data row136 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row136_col1\" class=\"data row136 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row136_col2\" class=\"data row136 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row136_col3\" class=\"data row136 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row136_col4\" class=\"data row136 col4\" >yes</td>\n",
       "      <td id=\"T_9f55b_row136_col5\" class=\"data row136 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row137\" class=\"row_heading level0 row137\" >malicious_powershell_process___encoded_command.yml</th>\n",
       "      <td id=\"T_9f55b_row137_col0\" class=\"data row137 col0\" >yes</td>\n",
       "      <td id=\"T_9f55b_row137_col1\" class=\"data row137 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row137_col2\" class=\"data row137 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row137_col3\" class=\"data row137 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row137_col4\" class=\"data row137 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row137_col5\" class=\"data row137 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row138\" class=\"row_heading level0 row138\" >mshta_spawning_rundll32_or_regsvr32_process.yml</th>\n",
       "      <td id=\"T_9f55b_row138_col0\" class=\"data row138 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row138_col1\" class=\"data row138 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row138_col2\" class=\"data row138 col2\" >no</td>\n",
       "      <td id=\"T_9f55b_row138_col3\" class=\"data row138 col3\" >yes</td>\n",
       "      <td id=\"T_9f55b_row138_col4\" class=\"data row138 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row138_col5\" class=\"data row138 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_9f55b_level0_row139\" class=\"row_heading level0 row139\" >malicious_inprocserver32_modification.yml</th>\n",
       "      <td id=\"T_9f55b_row139_col0\" class=\"data row139 col0\" >no</td>\n",
       "      <td id=\"T_9f55b_row139_col1\" class=\"data row139 col1\" >no</td>\n",
       "      <td id=\"T_9f55b_row139_col2\" class=\"data row139 col2\" >yes</td>\n",
       "      <td id=\"T_9f55b_row139_col3\" class=\"data row139 col3\" >no</td>\n",
       "      <td id=\"T_9f55b_row139_col4\" class=\"data row139 col4\" >no</td>\n",
       "      <td id=\"T_9f55b_row139_col5\" class=\"data row139 col5\" >1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c220b50>"
      ]
     },
     "execution_count": 35,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "def yes_no_table(dict_data, story_name_list):\n",
    "    det_by_analytics = defaultdict(list)\n",
    "\n",
    "    for k, v in dict_data.items():\n",
    "        found_list = []\n",
    "        det_ctr = 0\n",
    "        for st in story_name_list:\n",
    "            if st in v:\n",
    "                found_list.append(\"yes\")\n",
    "                det_by_analytics[k].append(\"yes\")\n",
    "                det_ctr += 1\n",
    "            else:\n",
    "                found_list.append(\"no\")\n",
    "                det_by_analytics[k].append(\"no\")\n",
    "        det_by_analytics[k].append(det_ctr)\n",
    "\n",
    "    return det_by_analytics\n",
    "\n",
    "def highlight_rows(x):\n",
    "    if x.total_coverage == 1:\n",
    "        return['background-color: lightgray'] * 6\n",
    "    elif x.total_coverage == 2:\n",
    "        return['background-color: lightblue'] * 6\n",
    "    elif x.total_coverage == 3:\n",
    "        return['background-color: lightgreen'] * 6    \n",
    "    elif x.total_coverage == 4:\n",
    "        return['background-color: orange'] * 6  \n",
    "    elif x.total_coverage == 5:\n",
    "        return['background-color: yellow'] * 6  \n",
    "story_name_list = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]\n",
    "det_by_analytics = yes_no_table(mitre_attack_id_info_dict, story_name_list)\n",
    "tdf = pd.DataFrame.from_dict(det_by_analytics, orient=\"index\")\n",
    "tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n",
    "print(tdf.shape)\n",
    "tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n",
    "tdf.style.apply(highlight_rows, axis=1)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "74485c0e-d4c0-4f26-9e7f-f13a2a9b6b98",
   "metadata": {},
   "source": [
    "### breakdown of detection coverage for 5 malware family or story"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "id": "8d075f5c-818b-4fd6-8fdb-d6a3e75cbfb4",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(4, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_e51f9_row0_col0, #T_e51f9_row0_col1, #T_e51f9_row0_col2, #T_e51f9_row0_col3, #T_e51f9_row0_col4, #T_e51f9_row0_col5, #T_e51f9_row1_col0, #T_e51f9_row1_col1, #T_e51f9_row1_col2, #T_e51f9_row1_col3, #T_e51f9_row1_col4, #T_e51f9_row1_col5, #T_e51f9_row2_col0, #T_e51f9_row2_col1, #T_e51f9_row2_col2, #T_e51f9_row2_col3, #T_e51f9_row2_col4, #T_e51f9_row2_col5, #T_e51f9_row3_col0, #T_e51f9_row3_col1, #T_e51f9_row3_col2, #T_e51f9_row3_col3, #T_e51f9_row3_col4, #T_e51f9_row3_col5 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_e51f9\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_e51f9_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_e51f9_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_e51f9_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_e51f9_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_e51f9_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_e51f9_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_e51f9_level0_row0\" class=\"row_heading level0 row0\" >office_document_executing_macro_code.yml</th>\n",
       "      <td id=\"T_e51f9_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_e51f9_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_e51f9_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_e51f9_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_e51f9_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_e51f9_row0_col5\" class=\"data row0 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e51f9_level0_row1\" class=\"row_heading level0 row1\" >suspicious_process_file_path.yml</th>\n",
       "      <td id=\"T_e51f9_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_e51f9_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_e51f9_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_e51f9_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_e51f9_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_e51f9_row1_col5\" class=\"data row1 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e51f9_level0_row2\" class=\"row_heading level0 row2\" >executables_or_script_creation_in_suspicious_path.yml</th>\n",
       "      <td id=\"T_e51f9_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_e51f9_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_e51f9_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_e51f9_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_e51f9_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_e51f9_row2_col5\" class=\"data row2 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_e51f9_level0_row3\" class=\"row_heading level0 row3\" >office_product_spawn_cmd_process.yml</th>\n",
       "      <td id=\"T_e51f9_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_e51f9_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_e51f9_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_e51f9_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_e51f9_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_e51f9_row3_col5\" class=\"data row3 col5\" >5</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c259a90>"
      ]
     },
     "execution_count": 36,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 5]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "id": "7652ddc4-d9f8-4449-9f6a-d39900e9433f",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(3, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_48a2e_row0_col0, #T_48a2e_row0_col1, #T_48a2e_row0_col2, #T_48a2e_row0_col3, #T_48a2e_row0_col4, #T_48a2e_row0_col5, #T_48a2e_row1_col0, #T_48a2e_row1_col1, #T_48a2e_row1_col2, #T_48a2e_row1_col3, #T_48a2e_row1_col4, #T_48a2e_row1_col5, #T_48a2e_row2_col0, #T_48a2e_row2_col1, #T_48a2e_row2_col2, #T_48a2e_row2_col3, #T_48a2e_row2_col4, #T_48a2e_row2_col5 {\n",
       "  background-color: orange;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_48a2e\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_48a2e_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_48a2e_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_48a2e_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_48a2e_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_48a2e_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_48a2e_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_48a2e_level0_row0\" class=\"row_heading level0 row0\" >windows_phishing_recent_iso_exec_registry.yml</th>\n",
       "      <td id=\"T_48a2e_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_48a2e_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_48a2e_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_48a2e_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_48a2e_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_48a2e_row0_col5\" class=\"data row0 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_48a2e_level0_row1\" class=\"row_heading level0 row1\" >windows_iso_lnk_file_creation.yml</th>\n",
       "      <td id=\"T_48a2e_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_48a2e_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_48a2e_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_48a2e_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_48a2e_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_48a2e_row1_col5\" class=\"data row1 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_48a2e_level0_row2\" class=\"row_heading level0 row2\" >scheduled_task_deleted_or_created_via_cmd.yml</th>\n",
       "      <td id=\"T_48a2e_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_48a2e_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_48a2e_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_48a2e_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_48a2e_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_48a2e_row2_col5\" class=\"data row2 col5\" >4</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c2598e0>"
      ]
     },
     "execution_count": 37,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 4]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "id": "48201916-b89c-4934-bbb4-b1d02ccd7de1",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(4, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_5650c_row0_col0, #T_5650c_row0_col1, #T_5650c_row0_col2, #T_5650c_row0_col3, #T_5650c_row0_col4, #T_5650c_row0_col5, #T_5650c_row1_col0, #T_5650c_row1_col1, #T_5650c_row1_col2, #T_5650c_row1_col3, #T_5650c_row1_col4, #T_5650c_row1_col5, #T_5650c_row2_col0, #T_5650c_row2_col1, #T_5650c_row2_col2, #T_5650c_row2_col3, #T_5650c_row2_col4, #T_5650c_row2_col5, #T_5650c_row3_col0, #T_5650c_row3_col1, #T_5650c_row3_col2, #T_5650c_row3_col3, #T_5650c_row3_col4, #T_5650c_row3_col5 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_5650c\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_5650c_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_5650c_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_5650c_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_5650c_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_5650c_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_5650c_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_5650c_level0_row0\" class=\"row_heading level0 row0\" >registry_keys_used_for_persistence.yml</th>\n",
       "      <td id=\"T_5650c_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_5650c_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_5650c_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_5650c_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_5650c_row0_col4\" class=\"data row0 col4\" >no</td>\n",
       "      <td id=\"T_5650c_row0_col5\" class=\"data row0 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_5650c_level0_row1\" class=\"row_heading level0 row1\" >non_firefox_process_access_firefox_profile_dir.yml</th>\n",
       "      <td id=\"T_5650c_row1_col0\" class=\"data row1 col0\" >no</td>\n",
       "      <td id=\"T_5650c_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_5650c_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_5650c_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_5650c_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_5650c_row1_col5\" class=\"data row1 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_5650c_level0_row2\" class=\"row_heading level0 row2\" >windows_defender_exclusion_registry_entry.yml</th>\n",
       "      <td id=\"T_5650c_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_5650c_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_5650c_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_5650c_row2_col3\" class=\"data row2 col3\" >no</td>\n",
       "      <td id=\"T_5650c_row2_col4\" class=\"data row2 col4\" >no</td>\n",
       "      <td id=\"T_5650c_row2_col5\" class=\"data row2 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_5650c_level0_row3\" class=\"row_heading level0 row3\" >disabling_remote_user_account_control.yml</th>\n",
       "      <td id=\"T_5650c_row3_col0\" class=\"data row3 col0\" >no</td>\n",
       "      <td id=\"T_5650c_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_5650c_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_5650c_row3_col3\" class=\"data row3 col3\" >no</td>\n",
       "      <td id=\"T_5650c_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_5650c_row3_col5\" class=\"data row3 col5\" >3</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c21af70>"
      ]
     },
     "execution_count": 38,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 3]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "id": "8ad5bd62-c881-4f72-8c84-c2f05729e271",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(11, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_eaa59_row0_col0, #T_eaa59_row0_col1, #T_eaa59_row0_col2, #T_eaa59_row0_col3, #T_eaa59_row0_col4, #T_eaa59_row0_col5, #T_eaa59_row1_col0, #T_eaa59_row1_col1, #T_eaa59_row1_col2, #T_eaa59_row1_col3, #T_eaa59_row1_col4, #T_eaa59_row1_col5, #T_eaa59_row2_col0, #T_eaa59_row2_col1, #T_eaa59_row2_col2, #T_eaa59_row2_col3, #T_eaa59_row2_col4, #T_eaa59_row2_col5, #T_eaa59_row3_col0, #T_eaa59_row3_col1, #T_eaa59_row3_col2, #T_eaa59_row3_col3, #T_eaa59_row3_col4, #T_eaa59_row3_col5, #T_eaa59_row4_col0, #T_eaa59_row4_col1, #T_eaa59_row4_col2, #T_eaa59_row4_col3, #T_eaa59_row4_col4, #T_eaa59_row4_col5, #T_eaa59_row5_col0, #T_eaa59_row5_col1, #T_eaa59_row5_col2, #T_eaa59_row5_col3, #T_eaa59_row5_col4, #T_eaa59_row5_col5, #T_eaa59_row6_col0, #T_eaa59_row6_col1, #T_eaa59_row6_col2, #T_eaa59_row6_col3, #T_eaa59_row6_col4, #T_eaa59_row6_col5, #T_eaa59_row7_col0, #T_eaa59_row7_col1, #T_eaa59_row7_col2, #T_eaa59_row7_col3, #T_eaa59_row7_col4, #T_eaa59_row7_col5, #T_eaa59_row8_col0, #T_eaa59_row8_col1, #T_eaa59_row8_col2, #T_eaa59_row8_col3, #T_eaa59_row8_col4, #T_eaa59_row8_col5, #T_eaa59_row9_col0, #T_eaa59_row9_col1, #T_eaa59_row9_col2, #T_eaa59_row9_col3, #T_eaa59_row9_col4, #T_eaa59_row9_col5, #T_eaa59_row10_col0, #T_eaa59_row10_col1, #T_eaa59_row10_col2, #T_eaa59_row10_col3, #T_eaa59_row10_col4, #T_eaa59_row10_col5 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_eaa59\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_eaa59_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_eaa59_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_eaa59_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_eaa59_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_eaa59_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_eaa59_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row0\" class=\"row_heading level0 row0\" >add_or_set_windows_defender_exclusion.yml</th>\n",
       "      <td id=\"T_eaa59_row0_col0\" class=\"data row0 col0\" >no</td>\n",
       "      <td id=\"T_eaa59_row0_col1\" class=\"data row0 col1\" >no</td>\n",
       "      <td id=\"T_eaa59_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_eaa59_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_eaa59_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_eaa59_row0_col5\" class=\"data row0 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row1\" class=\"row_heading level0 row1\" >disable_defender_spynet_reporting.yml</th>\n",
       "      <td id=\"T_eaa59_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_eaa59_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_eaa59_row1_col2\" class=\"data row1 col2\" >no</td>\n",
       "      <td id=\"T_eaa59_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_eaa59_row1_col4\" class=\"data row1 col4\" >no</td>\n",
       "      <td id=\"T_eaa59_row1_col5\" class=\"data row1 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row2\" class=\"row_heading level0 row2\" >office_product_spawning_certutil.yml</th>\n",
       "      <td id=\"T_eaa59_row2_col0\" class=\"data row2 col0\" >no</td>\n",
       "      <td id=\"T_eaa59_row2_col1\" class=\"data row2 col1\" >no</td>\n",
       "      <td id=\"T_eaa59_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_eaa59_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_eaa59_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_eaa59_row2_col5\" class=\"data row2 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row3\" class=\"row_heading level0 row3\" >excessive_usage_of_taskkill.yml</th>\n",
       "      <td id=\"T_eaa59_row3_col0\" class=\"data row3 col0\" >no</td>\n",
       "      <td id=\"T_eaa59_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_eaa59_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_eaa59_row3_col3\" class=\"data row3 col3\" >no</td>\n",
       "      <td id=\"T_eaa59_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_eaa59_row3_col5\" class=\"data row3 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row4\" class=\"row_heading level0 row4\" >regsvr32_with_known_silent_switch_cmdline.yml</th>\n",
       "      <td id=\"T_eaa59_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_eaa59_row4_col1\" class=\"data row4 col1\" >no</td>\n",
       "      <td id=\"T_eaa59_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_eaa59_row4_col3\" class=\"data row4 col3\" >no</td>\n",
       "      <td id=\"T_eaa59_row4_col4\" class=\"data row4 col4\" >no</td>\n",
       "      <td id=\"T_eaa59_row4_col5\" class=\"data row4 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row5\" class=\"row_heading level0 row5\" >cmd_carry_out_string_command_parameter.yml</th>\n",
       "      <td id=\"T_eaa59_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_eaa59_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_eaa59_row5_col2\" class=\"data row5 col2\" >no</td>\n",
       "      <td id=\"T_eaa59_row5_col3\" class=\"data row5 col3\" >no</td>\n",
       "      <td id=\"T_eaa59_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_eaa59_row5_col5\" class=\"data row5 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row6\" class=\"row_heading level0 row6\" >office_application_spawn_rundll32_process.yml</th>\n",
       "      <td id=\"T_eaa59_row6_col0\" class=\"data row6 col0\" >no</td>\n",
       "      <td id=\"T_eaa59_row6_col1\" class=\"data row6 col1\" >no</td>\n",
       "      <td id=\"T_eaa59_row6_col2\" class=\"data row6 col2\" >no</td>\n",
       "      <td id=\"T_eaa59_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
       "      <td id=\"T_eaa59_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_eaa59_row6_col5\" class=\"data row6 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row7\" class=\"row_heading level0 row7\" >powershell_windows_defender_exclusion_commands.yml</th>\n",
       "      <td id=\"T_eaa59_row7_col0\" class=\"data row7 col0\" >no</td>\n",
       "      <td id=\"T_eaa59_row7_col1\" class=\"data row7 col1\" >no</td>\n",
       "      <td id=\"T_eaa59_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
       "      <td id=\"T_eaa59_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_eaa59_row7_col4\" class=\"data row7 col4\" >yes</td>\n",
       "      <td id=\"T_eaa59_row7_col5\" class=\"data row7 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row8\" class=\"row_heading level0 row8\" >attempt_to_stop_security_service.yml</th>\n",
       "      <td id=\"T_eaa59_row8_col0\" class=\"data row8 col0\" >no</td>\n",
       "      <td id=\"T_eaa59_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_eaa59_row8_col2\" class=\"data row8 col2\" >no</td>\n",
       "      <td id=\"T_eaa59_row8_col3\" class=\"data row8 col3\" >yes</td>\n",
       "      <td id=\"T_eaa59_row8_col4\" class=\"data row8 col4\" >no</td>\n",
       "      <td id=\"T_eaa59_row8_col5\" class=\"data row8 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row9\" class=\"row_heading level0 row9\" >wermgr_process_spawned_cmd_or_powershell_process.yml</th>\n",
       "      <td id=\"T_eaa59_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_eaa59_row9_col1\" class=\"data row9 col1\" >no</td>\n",
       "      <td id=\"T_eaa59_row9_col2\" class=\"data row9 col2\" >no</td>\n",
       "      <td id=\"T_eaa59_row9_col3\" class=\"data row9 col3\" >yes</td>\n",
       "      <td id=\"T_eaa59_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_eaa59_row9_col5\" class=\"data row9 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_eaa59_level0_row10\" class=\"row_heading level0 row10\" >non_chrome_process_accessing_chrome_default_dir.yml</th>\n",
       "      <td id=\"T_eaa59_row10_col0\" class=\"data row10 col0\" >no</td>\n",
       "      <td id=\"T_eaa59_row10_col1\" class=\"data row10 col1\" >no</td>\n",
       "      <td id=\"T_eaa59_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
       "      <td id=\"T_eaa59_row10_col3\" class=\"data row10 col3\" >no</td>\n",
       "      <td id=\"T_eaa59_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
       "      <td id=\"T_eaa59_row10_col5\" class=\"data row10 col5\" >2</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c2207f0>"
      ]
     },
     "execution_count": 39,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 2]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "id": "24dec7b8-375d-40cb-9b57-84d44921b1e3",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(118, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_3deed_row0_col0, #T_3deed_row0_col1, #T_3deed_row0_col2, #T_3deed_row0_col3, #T_3deed_row0_col4, #T_3deed_row0_col5, #T_3deed_row1_col0, #T_3deed_row1_col1, #T_3deed_row1_col2, #T_3deed_row1_col3, #T_3deed_row1_col4, #T_3deed_row1_col5, #T_3deed_row2_col0, #T_3deed_row2_col1, #T_3deed_row2_col2, #T_3deed_row2_col3, #T_3deed_row2_col4, #T_3deed_row2_col5, #T_3deed_row3_col0, #T_3deed_row3_col1, #T_3deed_row3_col2, #T_3deed_row3_col3, #T_3deed_row3_col4, #T_3deed_row3_col5, #T_3deed_row4_col0, #T_3deed_row4_col1, #T_3deed_row4_col2, #T_3deed_row4_col3, #T_3deed_row4_col4, #T_3deed_row4_col5, #T_3deed_row5_col0, #T_3deed_row5_col1, #T_3deed_row5_col2, #T_3deed_row5_col3, #T_3deed_row5_col4, #T_3deed_row5_col5, #T_3deed_row6_col0, #T_3deed_row6_col1, #T_3deed_row6_col2, #T_3deed_row6_col3, #T_3deed_row6_col4, #T_3deed_row6_col5, #T_3deed_row7_col0, #T_3deed_row7_col1, #T_3deed_row7_col2, #T_3deed_row7_col3, #T_3deed_row7_col4, #T_3deed_row7_col5, #T_3deed_row8_col0, #T_3deed_row8_col1, #T_3deed_row8_col2, #T_3deed_row8_col3, #T_3deed_row8_col4, #T_3deed_row8_col5, #T_3deed_row9_col0, #T_3deed_row9_col1, #T_3deed_row9_col2, #T_3deed_row9_col3, #T_3deed_row9_col4, #T_3deed_row9_col5, #T_3deed_row10_col0, #T_3deed_row10_col1, #T_3deed_row10_col2, #T_3deed_row10_col3, #T_3deed_row10_col4, #T_3deed_row10_col5, #T_3deed_row11_col0, #T_3deed_row11_col1, #T_3deed_row11_col2, #T_3deed_row11_col3, #T_3deed_row11_col4, #T_3deed_row11_col5, #T_3deed_row12_col0, #T_3deed_row12_col1, #T_3deed_row12_col2, #T_3deed_row12_col3, #T_3deed_row12_col4, #T_3deed_row12_col5, #T_3deed_row13_col0, #T_3deed_row13_col1, #T_3deed_row13_col2, #T_3deed_row13_col3, #T_3deed_row13_col4, #T_3deed_row13_col5, #T_3deed_row14_col0, #T_3deed_row14_col1, #T_3deed_row14_col2, #T_3deed_row14_col3, #T_3deed_row14_col4, #T_3deed_row14_col5, #T_3deed_row15_col0, #T_3deed_row15_col1, #T_3deed_row15_col2, #T_3deed_row15_col3, #T_3deed_row15_col4, #T_3deed_row15_col5, #T_3deed_row16_col0, #T_3deed_row16_col1, #T_3deed_row16_col2, #T_3deed_row16_col3, #T_3deed_row16_col4, #T_3deed_row16_col5, #T_3deed_row17_col0, #T_3deed_row17_col1, #T_3deed_row17_col2, #T_3deed_row17_col3, #T_3deed_row17_col4, #T_3deed_row17_col5, #T_3deed_row18_col0, #T_3deed_row18_col1, #T_3deed_row18_col2, #T_3deed_row18_col3, #T_3deed_row18_col4, #T_3deed_row18_col5, #T_3deed_row19_col0, #T_3deed_row19_col1, #T_3deed_row19_col2, #T_3deed_row19_col3, #T_3deed_row19_col4, #T_3deed_row19_col5, #T_3deed_row20_col0, #T_3deed_row20_col1, #T_3deed_row20_col2, #T_3deed_row20_col3, #T_3deed_row20_col4, #T_3deed_row20_col5, #T_3deed_row21_col0, #T_3deed_row21_col1, #T_3deed_row21_col2, #T_3deed_row21_col3, #T_3deed_row21_col4, #T_3deed_row21_col5, #T_3deed_row22_col0, #T_3deed_row22_col1, #T_3deed_row22_col2, #T_3deed_row22_col3, #T_3deed_row22_col4, #T_3deed_row22_col5, #T_3deed_row23_col0, #T_3deed_row23_col1, #T_3deed_row23_col2, #T_3deed_row23_col3, #T_3deed_row23_col4, #T_3deed_row23_col5, #T_3deed_row24_col0, #T_3deed_row24_col1, #T_3deed_row24_col2, #T_3deed_row24_col3, #T_3deed_row24_col4, #T_3deed_row24_col5, #T_3deed_row25_col0, #T_3deed_row25_col1, #T_3deed_row25_col2, #T_3deed_row25_col3, #T_3deed_row25_col4, #T_3deed_row25_col5, #T_3deed_row26_col0, #T_3deed_row26_col1, #T_3deed_row26_col2, #T_3deed_row26_col3, #T_3deed_row26_col4, #T_3deed_row26_col5, #T_3deed_row27_col0, #T_3deed_row27_col1, #T_3deed_row27_col2, #T_3deed_row27_col3, #T_3deed_row27_col4, #T_3deed_row27_col5, #T_3deed_row28_col0, #T_3deed_row28_col1, #T_3deed_row28_col2, #T_3deed_row28_col3, #T_3deed_row28_col4, #T_3deed_row28_col5, #T_3deed_row29_col0, #T_3deed_row29_col1, #T_3deed_row29_col2, #T_3deed_row29_col3, #T_3deed_row29_col4, #T_3deed_row29_col5, #T_3deed_row30_col0, #T_3deed_row30_col1, #T_3deed_row30_col2, #T_3deed_row30_col3, #T_3deed_row30_col4, #T_3deed_row30_col5, #T_3deed_row31_col0, #T_3deed_row31_col1, #T_3deed_row31_col2, #T_3deed_row31_col3, #T_3deed_row31_col4, #T_3deed_row31_col5, #T_3deed_row32_col0, #T_3deed_row32_col1, #T_3deed_row32_col2, #T_3deed_row32_col3, #T_3deed_row32_col4, #T_3deed_row32_col5, #T_3deed_row33_col0, #T_3deed_row33_col1, #T_3deed_row33_col2, #T_3deed_row33_col3, #T_3deed_row33_col4, #T_3deed_row33_col5, #T_3deed_row34_col0, #T_3deed_row34_col1, #T_3deed_row34_col2, #T_3deed_row34_col3, #T_3deed_row34_col4, #T_3deed_row34_col5, #T_3deed_row35_col0, #T_3deed_row35_col1, #T_3deed_row35_col2, #T_3deed_row35_col3, #T_3deed_row35_col4, #T_3deed_row35_col5, #T_3deed_row36_col0, #T_3deed_row36_col1, #T_3deed_row36_col2, #T_3deed_row36_col3, #T_3deed_row36_col4, #T_3deed_row36_col5, #T_3deed_row37_col0, #T_3deed_row37_col1, #T_3deed_row37_col2, #T_3deed_row37_col3, #T_3deed_row37_col4, #T_3deed_row37_col5, #T_3deed_row38_col0, #T_3deed_row38_col1, #T_3deed_row38_col2, #T_3deed_row38_col3, #T_3deed_row38_col4, #T_3deed_row38_col5, #T_3deed_row39_col0, #T_3deed_row39_col1, #T_3deed_row39_col2, #T_3deed_row39_col3, #T_3deed_row39_col4, #T_3deed_row39_col5, #T_3deed_row40_col0, #T_3deed_row40_col1, #T_3deed_row40_col2, #T_3deed_row40_col3, #T_3deed_row40_col4, #T_3deed_row40_col5, #T_3deed_row41_col0, #T_3deed_row41_col1, #T_3deed_row41_col2, #T_3deed_row41_col3, #T_3deed_row41_col4, #T_3deed_row41_col5, #T_3deed_row42_col0, #T_3deed_row42_col1, #T_3deed_row42_col2, #T_3deed_row42_col3, #T_3deed_row42_col4, #T_3deed_row42_col5, #T_3deed_row43_col0, #T_3deed_row43_col1, #T_3deed_row43_col2, #T_3deed_row43_col3, #T_3deed_row43_col4, #T_3deed_row43_col5, #T_3deed_row44_col0, #T_3deed_row44_col1, #T_3deed_row44_col2, #T_3deed_row44_col3, #T_3deed_row44_col4, #T_3deed_row44_col5, #T_3deed_row45_col0, #T_3deed_row45_col1, #T_3deed_row45_col2, #T_3deed_row45_col3, #T_3deed_row45_col4, #T_3deed_row45_col5, #T_3deed_row46_col0, #T_3deed_row46_col1, #T_3deed_row46_col2, #T_3deed_row46_col3, #T_3deed_row46_col4, #T_3deed_row46_col5, #T_3deed_row47_col0, #T_3deed_row47_col1, #T_3deed_row47_col2, #T_3deed_row47_col3, #T_3deed_row47_col4, #T_3deed_row47_col5, #T_3deed_row48_col0, #T_3deed_row48_col1, #T_3deed_row48_col2, #T_3deed_row48_col3, #T_3deed_row48_col4, #T_3deed_row48_col5, #T_3deed_row49_col0, #T_3deed_row49_col1, #T_3deed_row49_col2, #T_3deed_row49_col3, #T_3deed_row49_col4, #T_3deed_row49_col5, #T_3deed_row50_col0, #T_3deed_row50_col1, #T_3deed_row50_col2, #T_3deed_row50_col3, #T_3deed_row50_col4, #T_3deed_row50_col5, #T_3deed_row51_col0, #T_3deed_row51_col1, #T_3deed_row51_col2, #T_3deed_row51_col3, #T_3deed_row51_col4, #T_3deed_row51_col5, #T_3deed_row52_col0, #T_3deed_row52_col1, #T_3deed_row52_col2, #T_3deed_row52_col3, #T_3deed_row52_col4, #T_3deed_row52_col5, #T_3deed_row53_col0, #T_3deed_row53_col1, #T_3deed_row53_col2, #T_3deed_row53_col3, #T_3deed_row53_col4, #T_3deed_row53_col5, #T_3deed_row54_col0, #T_3deed_row54_col1, #T_3deed_row54_col2, #T_3deed_row54_col3, #T_3deed_row54_col4, #T_3deed_row54_col5, #T_3deed_row55_col0, #T_3deed_row55_col1, #T_3deed_row55_col2, #T_3deed_row55_col3, #T_3deed_row55_col4, #T_3deed_row55_col5, #T_3deed_row56_col0, #T_3deed_row56_col1, #T_3deed_row56_col2, #T_3deed_row56_col3, #T_3deed_row56_col4, #T_3deed_row56_col5, #T_3deed_row57_col0, #T_3deed_row57_col1, #T_3deed_row57_col2, #T_3deed_row57_col3, #T_3deed_row57_col4, #T_3deed_row57_col5, #T_3deed_row58_col0, #T_3deed_row58_col1, #T_3deed_row58_col2, #T_3deed_row58_col3, #T_3deed_row58_col4, #T_3deed_row58_col5, #T_3deed_row59_col0, #T_3deed_row59_col1, #T_3deed_row59_col2, #T_3deed_row59_col3, #T_3deed_row59_col4, #T_3deed_row59_col5, #T_3deed_row60_col0, #T_3deed_row60_col1, #T_3deed_row60_col2, #T_3deed_row60_col3, #T_3deed_row60_col4, #T_3deed_row60_col5, #T_3deed_row61_col0, #T_3deed_row61_col1, #T_3deed_row61_col2, #T_3deed_row61_col3, #T_3deed_row61_col4, #T_3deed_row61_col5, #T_3deed_row62_col0, #T_3deed_row62_col1, #T_3deed_row62_col2, #T_3deed_row62_col3, #T_3deed_row62_col4, #T_3deed_row62_col5, #T_3deed_row63_col0, #T_3deed_row63_col1, #T_3deed_row63_col2, #T_3deed_row63_col3, #T_3deed_row63_col4, #T_3deed_row63_col5, #T_3deed_row64_col0, #T_3deed_row64_col1, #T_3deed_row64_col2, #T_3deed_row64_col3, #T_3deed_row64_col4, #T_3deed_row64_col5, #T_3deed_row65_col0, #T_3deed_row65_col1, #T_3deed_row65_col2, #T_3deed_row65_col3, #T_3deed_row65_col4, #T_3deed_row65_col5, #T_3deed_row66_col0, #T_3deed_row66_col1, #T_3deed_row66_col2, #T_3deed_row66_col3, #T_3deed_row66_col4, #T_3deed_row66_col5, #T_3deed_row67_col0, #T_3deed_row67_col1, #T_3deed_row67_col2, #T_3deed_row67_col3, #T_3deed_row67_col4, #T_3deed_row67_col5, #T_3deed_row68_col0, #T_3deed_row68_col1, #T_3deed_row68_col2, #T_3deed_row68_col3, #T_3deed_row68_col4, #T_3deed_row68_col5, #T_3deed_row69_col0, #T_3deed_row69_col1, #T_3deed_row69_col2, #T_3deed_row69_col3, #T_3deed_row69_col4, #T_3deed_row69_col5, #T_3deed_row70_col0, #T_3deed_row70_col1, #T_3deed_row70_col2, #T_3deed_row70_col3, #T_3deed_row70_col4, #T_3deed_row70_col5, #T_3deed_row71_col0, #T_3deed_row71_col1, #T_3deed_row71_col2, #T_3deed_row71_col3, #T_3deed_row71_col4, #T_3deed_row71_col5, #T_3deed_row72_col0, #T_3deed_row72_col1, #T_3deed_row72_col2, #T_3deed_row72_col3, #T_3deed_row72_col4, #T_3deed_row72_col5, #T_3deed_row73_col0, #T_3deed_row73_col1, #T_3deed_row73_col2, #T_3deed_row73_col3, #T_3deed_row73_col4, #T_3deed_row73_col5, #T_3deed_row74_col0, #T_3deed_row74_col1, #T_3deed_row74_col2, #T_3deed_row74_col3, #T_3deed_row74_col4, #T_3deed_row74_col5, #T_3deed_row75_col0, #T_3deed_row75_col1, #T_3deed_row75_col2, #T_3deed_row75_col3, #T_3deed_row75_col4, #T_3deed_row75_col5, #T_3deed_row76_col0, #T_3deed_row76_col1, #T_3deed_row76_col2, #T_3deed_row76_col3, #T_3deed_row76_col4, #T_3deed_row76_col5, #T_3deed_row77_col0, #T_3deed_row77_col1, #T_3deed_row77_col2, #T_3deed_row77_col3, #T_3deed_row77_col4, #T_3deed_row77_col5, #T_3deed_row78_col0, #T_3deed_row78_col1, #T_3deed_row78_col2, #T_3deed_row78_col3, #T_3deed_row78_col4, #T_3deed_row78_col5, #T_3deed_row79_col0, #T_3deed_row79_col1, #T_3deed_row79_col2, #T_3deed_row79_col3, #T_3deed_row79_col4, #T_3deed_row79_col5, #T_3deed_row80_col0, #T_3deed_row80_col1, #T_3deed_row80_col2, #T_3deed_row80_col3, #T_3deed_row80_col4, #T_3deed_row80_col5, #T_3deed_row81_col0, #T_3deed_row81_col1, #T_3deed_row81_col2, #T_3deed_row81_col3, #T_3deed_row81_col4, #T_3deed_row81_col5, #T_3deed_row82_col0, #T_3deed_row82_col1, #T_3deed_row82_col2, #T_3deed_row82_col3, #T_3deed_row82_col4, #T_3deed_row82_col5, #T_3deed_row83_col0, #T_3deed_row83_col1, #T_3deed_row83_col2, #T_3deed_row83_col3, #T_3deed_row83_col4, #T_3deed_row83_col5, #T_3deed_row84_col0, #T_3deed_row84_col1, #T_3deed_row84_col2, #T_3deed_row84_col3, #T_3deed_row84_col4, #T_3deed_row84_col5, #T_3deed_row85_col0, #T_3deed_row85_col1, #T_3deed_row85_col2, #T_3deed_row85_col3, #T_3deed_row85_col4, #T_3deed_row85_col5, #T_3deed_row86_col0, #T_3deed_row86_col1, #T_3deed_row86_col2, #T_3deed_row86_col3, #T_3deed_row86_col4, #T_3deed_row86_col5, #T_3deed_row87_col0, #T_3deed_row87_col1, #T_3deed_row87_col2, #T_3deed_row87_col3, #T_3deed_row87_col4, #T_3deed_row87_col5, #T_3deed_row88_col0, #T_3deed_row88_col1, #T_3deed_row88_col2, #T_3deed_row88_col3, #T_3deed_row88_col4, #T_3deed_row88_col5, #T_3deed_row89_col0, #T_3deed_row89_col1, #T_3deed_row89_col2, #T_3deed_row89_col3, #T_3deed_row89_col4, #T_3deed_row89_col5, #T_3deed_row90_col0, #T_3deed_row90_col1, #T_3deed_row90_col2, #T_3deed_row90_col3, #T_3deed_row90_col4, #T_3deed_row90_col5, #T_3deed_row91_col0, #T_3deed_row91_col1, #T_3deed_row91_col2, #T_3deed_row91_col3, #T_3deed_row91_col4, #T_3deed_row91_col5, #T_3deed_row92_col0, #T_3deed_row92_col1, #T_3deed_row92_col2, #T_3deed_row92_col3, #T_3deed_row92_col4, #T_3deed_row92_col5, #T_3deed_row93_col0, #T_3deed_row93_col1, #T_3deed_row93_col2, #T_3deed_row93_col3, #T_3deed_row93_col4, #T_3deed_row93_col5, #T_3deed_row94_col0, #T_3deed_row94_col1, #T_3deed_row94_col2, #T_3deed_row94_col3, #T_3deed_row94_col4, #T_3deed_row94_col5, #T_3deed_row95_col0, #T_3deed_row95_col1, #T_3deed_row95_col2, #T_3deed_row95_col3, #T_3deed_row95_col4, #T_3deed_row95_col5, #T_3deed_row96_col0, #T_3deed_row96_col1, #T_3deed_row96_col2, #T_3deed_row96_col3, #T_3deed_row96_col4, #T_3deed_row96_col5, #T_3deed_row97_col0, #T_3deed_row97_col1, #T_3deed_row97_col2, #T_3deed_row97_col3, #T_3deed_row97_col4, #T_3deed_row97_col5, #T_3deed_row98_col0, #T_3deed_row98_col1, #T_3deed_row98_col2, #T_3deed_row98_col3, #T_3deed_row98_col4, #T_3deed_row98_col5, #T_3deed_row99_col0, #T_3deed_row99_col1, #T_3deed_row99_col2, #T_3deed_row99_col3, #T_3deed_row99_col4, #T_3deed_row99_col5, #T_3deed_row100_col0, #T_3deed_row100_col1, #T_3deed_row100_col2, #T_3deed_row100_col3, #T_3deed_row100_col4, #T_3deed_row100_col5, #T_3deed_row101_col0, #T_3deed_row101_col1, #T_3deed_row101_col2, #T_3deed_row101_col3, #T_3deed_row101_col4, #T_3deed_row101_col5, #T_3deed_row102_col0, #T_3deed_row102_col1, #T_3deed_row102_col2, #T_3deed_row102_col3, #T_3deed_row102_col4, #T_3deed_row102_col5, #T_3deed_row103_col0, #T_3deed_row103_col1, #T_3deed_row103_col2, #T_3deed_row103_col3, #T_3deed_row103_col4, #T_3deed_row103_col5, #T_3deed_row104_col0, #T_3deed_row104_col1, #T_3deed_row104_col2, #T_3deed_row104_col3, #T_3deed_row104_col4, #T_3deed_row104_col5, #T_3deed_row105_col0, #T_3deed_row105_col1, #T_3deed_row105_col2, #T_3deed_row105_col3, #T_3deed_row105_col4, #T_3deed_row105_col5, #T_3deed_row106_col0, #T_3deed_row106_col1, #T_3deed_row106_col2, #T_3deed_row106_col3, #T_3deed_row106_col4, #T_3deed_row106_col5, #T_3deed_row107_col0, #T_3deed_row107_col1, #T_3deed_row107_col2, #T_3deed_row107_col3, #T_3deed_row107_col4, #T_3deed_row107_col5, #T_3deed_row108_col0, #T_3deed_row108_col1, #T_3deed_row108_col2, #T_3deed_row108_col3, #T_3deed_row108_col4, #T_3deed_row108_col5, #T_3deed_row109_col0, #T_3deed_row109_col1, #T_3deed_row109_col2, #T_3deed_row109_col3, #T_3deed_row109_col4, #T_3deed_row109_col5, #T_3deed_row110_col0, #T_3deed_row110_col1, #T_3deed_row110_col2, #T_3deed_row110_col3, #T_3deed_row110_col4, #T_3deed_row110_col5, #T_3deed_row111_col0, #T_3deed_row111_col1, #T_3deed_row111_col2, #T_3deed_row111_col3, #T_3deed_row111_col4, #T_3deed_row111_col5, #T_3deed_row112_col0, #T_3deed_row112_col1, #T_3deed_row112_col2, #T_3deed_row112_col3, #T_3deed_row112_col4, #T_3deed_row112_col5, #T_3deed_row113_col0, #T_3deed_row113_col1, #T_3deed_row113_col2, #T_3deed_row113_col3, #T_3deed_row113_col4, #T_3deed_row113_col5, #T_3deed_row114_col0, #T_3deed_row114_col1, #T_3deed_row114_col2, #T_3deed_row114_col3, #T_3deed_row114_col4, #T_3deed_row114_col5, #T_3deed_row115_col0, #T_3deed_row115_col1, #T_3deed_row115_col2, #T_3deed_row115_col3, #T_3deed_row115_col4, #T_3deed_row115_col5, #T_3deed_row116_col0, #T_3deed_row116_col1, #T_3deed_row116_col2, #T_3deed_row116_col3, #T_3deed_row116_col4, #T_3deed_row116_col5, #T_3deed_row117_col0, #T_3deed_row117_col1, #T_3deed_row117_col2, #T_3deed_row117_col3, #T_3deed_row117_col4, #T_3deed_row117_col5 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_3deed\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_3deed_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_3deed_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_3deed_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_3deed_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_3deed_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_3deed_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row0\" class=\"row_heading level0 row0\" >chcp_command_execution.yml</th>\n",
       "      <td id=\"T_3deed_row0_col0\" class=\"data row0 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row0_col4\" class=\"data row0 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row0_col5\" class=\"data row0 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row1\" class=\"row_heading level0 row1\" >jscript_execution_using_cscript_app.yml</th>\n",
       "      <td id=\"T_3deed_row1_col0\" class=\"data row1 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row1_col1\" class=\"data row1 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row1_col4\" class=\"data row1 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row1_col5\" class=\"data row1 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row2\" class=\"row_heading level0 row2\" >wmic_noninteractive_app_uninstallation.yml</th>\n",
       "      <td id=\"T_3deed_row2_col0\" class=\"data row2 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row2_col3\" class=\"data row2 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row2_col4\" class=\"data row2 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row2_col5\" class=\"data row2 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row3\" class=\"row_heading level0 row3\" >executable_file_written_in_administrative_smb_share.yml</th>\n",
       "      <td id=\"T_3deed_row3_col0\" class=\"data row3 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row3_col1\" class=\"data row3 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row3_col4\" class=\"data row3 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row3_col5\" class=\"data row3 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row4\" class=\"row_heading level0 row4\" >windows_powershell_import_applocker_policy.yml</th>\n",
       "      <td id=\"T_3deed_row4_col0\" class=\"data row4 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row4_col2\" class=\"data row4 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row4_col3\" class=\"data row4 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row4_col4\" class=\"data row4 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row4_col5\" class=\"data row4 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row5\" class=\"row_heading level0 row5\" >windows_service_stop_by_deletion.yml</th>\n",
       "      <td id=\"T_3deed_row5_col0\" class=\"data row5 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row5_col2\" class=\"data row5 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row5_col3\" class=\"data row5 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row5_col5\" class=\"data row5 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row6\" class=\"row_heading level0 row6\" >disable_defender_submit_samples_consent_feature.yml</th>\n",
       "      <td id=\"T_3deed_row6_col0\" class=\"data row6 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row6_col2\" class=\"data row6 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row6_col3\" class=\"data row6 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row6_col4\" class=\"data row6 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row6_col5\" class=\"data row6 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row7\" class=\"row_heading level0 row7\" >schedule_task_with_rundll32_command_trigger.yml</th>\n",
       "      <td id=\"T_3deed_row7_col0\" class=\"data row7 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row7_col1\" class=\"data row7 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row7_col2\" class=\"data row7 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row7_col3\" class=\"data row7 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row7_col5\" class=\"data row7 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row8\" class=\"row_heading level0 row8\" >suspicious_copy_on_system32.yml</th>\n",
       "      <td id=\"T_3deed_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row8_col1\" class=\"data row8 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row8_col2\" class=\"data row8 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row8_col4\" class=\"data row8 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row8_col5\" class=\"data row8 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row9\" class=\"row_heading level0 row9\" >detect_html_help_spawn_child_process.yml</th>\n",
       "      <td id=\"T_3deed_row9_col0\" class=\"data row9 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row9_col1\" class=\"data row9 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row9_col2\" class=\"data row9 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row9_col4\" class=\"data row9 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row9_col5\" class=\"data row9 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row10\" class=\"row_heading level0 row10\" >windows_modify_registry_disallow_windows_app.yml</th>\n",
       "      <td id=\"T_3deed_row10_col0\" class=\"data row10 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row10_col2\" class=\"data row10 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row10_col3\" class=\"data row10 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row10_col4\" class=\"data row10 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row10_col5\" class=\"data row10 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row11\" class=\"row_heading level0 row11\" >services_exe_lolbas_execution_process_spawn.yml</th>\n",
       "      <td id=\"T_3deed_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row11_col1\" class=\"data row11 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row11_col2\" class=\"data row11 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row11_col3\" class=\"data row11 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row11_col4\" class=\"data row11 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row11_col5\" class=\"data row11 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row12\" class=\"row_heading level0 row12\" >windows_gather_victim_network_info_through_ip_check_web_services.yml</th>\n",
       "      <td id=\"T_3deed_row12_col0\" class=\"data row12 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row12_col2\" class=\"data row12 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row12_col3\" class=\"data row12 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row12_col4\" class=\"data row12 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row12_col5\" class=\"data row12 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row13\" class=\"row_heading level0 row13\" >suspicious_rundll32_startw.yml</th>\n",
       "      <td id=\"T_3deed_row13_col0\" class=\"data row13 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row13_col1\" class=\"data row13 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row13_col2\" class=\"data row13 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row13_col3\" class=\"data row13 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row13_col4\" class=\"data row13 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row13_col5\" class=\"data row13 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row14\" class=\"row_heading level0 row14\" >windows_regsvr32_renamed_binary.yml</th>\n",
       "      <td id=\"T_3deed_row14_col0\" class=\"data row14 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row14_col1\" class=\"data row14 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row14_col2\" class=\"data row14 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row14_col3\" class=\"data row14 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row14_col4\" class=\"data row14 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row14_col5\" class=\"data row14 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row15\" class=\"row_heading level0 row15\" >winhlp32_spawning_a_process.yml</th>\n",
       "      <td id=\"T_3deed_row15_col0\" class=\"data row15 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row15_col1\" class=\"data row15 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row15_col3\" class=\"data row15 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row15_col4\" class=\"data row15 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row15_col5\" class=\"data row15 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row16\" class=\"row_heading level0 row16\" >account_discovery_with_net_app.yml</th>\n",
       "      <td id=\"T_3deed_row16_col0\" class=\"data row16 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row16_col1\" class=\"data row16 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row16_col2\" class=\"data row16 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row16_col3\" class=\"data row16 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row16_col4\" class=\"data row16 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row16_col5\" class=\"data row16 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row17\" class=\"row_heading level0 row17\" >excessive_usage_of_sc_service_utility.yml</th>\n",
       "      <td id=\"T_3deed_row17_col0\" class=\"data row17 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row17_col2\" class=\"data row17 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row17_col3\" class=\"data row17 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row17_col4\" class=\"data row17 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row17_col5\" class=\"data row17 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row18\" class=\"row_heading level0 row18\" >disable_show_hidden_files.yml</th>\n",
       "      <td id=\"T_3deed_row18_col0\" class=\"data row18 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row18_col2\" class=\"data row18 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row18_col3\" class=\"data row18 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row18_col4\" class=\"data row18 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row18_col5\" class=\"data row18 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row19\" class=\"row_heading level0 row19\" >windows_modify_registry_disable_win_defender_raw_write_notif.yml</th>\n",
       "      <td id=\"T_3deed_row19_col0\" class=\"data row19 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row19_col2\" class=\"data row19 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row19_col3\" class=\"data row19 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row19_col4\" class=\"data row19 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row19_col5\" class=\"data row19 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row20\" class=\"row_heading level0 row20\" >process_writing_dynamicwrapperx.yml</th>\n",
       "      <td id=\"T_3deed_row20_col0\" class=\"data row20 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row20_col1\" class=\"data row20 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row20_col2\" class=\"data row20 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row20_col3\" class=\"data row20 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row20_col4\" class=\"data row20 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row20_col5\" class=\"data row20 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row21\" class=\"row_heading level0 row21\" >detect_use_of_cmd_exe_to_launch_script_interpreters.yml</th>\n",
       "      <td id=\"T_3deed_row21_col0\" class=\"data row21 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row21_col2\" class=\"data row21 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row21_col3\" class=\"data row21 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row21_col4\" class=\"data row21 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row21_col5\" class=\"data row21 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row22\" class=\"row_heading level0 row22\" >windows_valid_account_with_never_expires_password.yml</th>\n",
       "      <td id=\"T_3deed_row22_col0\" class=\"data row22 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row22_col2\" class=\"data row22 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row22_col3\" class=\"data row22 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row22_col4\" class=\"data row22 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row22_col5\" class=\"data row22 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row23\" class=\"row_heading level0 row23\" >windows_schtasks_create_run_as_system.yml</th>\n",
       "      <td id=\"T_3deed_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row23_col1\" class=\"data row23 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row23_col2\" class=\"data row23 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row23_col3\" class=\"data row23 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row23_col4\" class=\"data row23 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row23_col5\" class=\"data row23 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row24\" class=\"row_heading level0 row24\" >windows_driver_load_non_standard_path.yml</th>\n",
       "      <td id=\"T_3deed_row24_col0\" class=\"data row24 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row24_col1\" class=\"data row24 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row24_col2\" class=\"data row24 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row24_col3\" class=\"data row24 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row24_col4\" class=\"data row24 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row24_col5\" class=\"data row24 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row25\" class=\"row_heading level0 row25\" >windows_impair_defense_deny_security_software_with_applocker.yml</th>\n",
       "      <td id=\"T_3deed_row25_col0\" class=\"data row25 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row25_col1\" class=\"data row25 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row25_col2\" class=\"data row25 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row25_col3\" class=\"data row25 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row25_col4\" class=\"data row25 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row25_col5\" class=\"data row25 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row26\" class=\"row_heading level0 row26\" >windows_dll_side_loading_process_child_of_calc.yml</th>\n",
       "      <td id=\"T_3deed_row26_col0\" class=\"data row26 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row26_col1\" class=\"data row26 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row26_col2\" class=\"data row26 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row26_col3\" class=\"data row26 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row26_col4\" class=\"data row26 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row26_col5\" class=\"data row26 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row27\" class=\"row_heading level0 row27\" >windows_modify_registry_disabling_wer_settings.yml</th>\n",
       "      <td id=\"T_3deed_row27_col0\" class=\"data row27 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row27_col1\" class=\"data row27 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row27_col2\" class=\"data row27 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row27_col3\" class=\"data row27 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row27_col4\" class=\"data row27 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row27_col5\" class=\"data row27 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row28\" class=\"row_heading level0 row28\" >net_localgroup_discovery.yml</th>\n",
       "      <td id=\"T_3deed_row28_col0\" class=\"data row28 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row28_col2\" class=\"data row28 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row28_col3\" class=\"data row28 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row28_col4\" class=\"data row28 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row28_col5\" class=\"data row28 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row29\" class=\"row_heading level0 row29\" >windows_dll_search_order_hijacking_hunt_with_sysmon.yml</th>\n",
       "      <td id=\"T_3deed_row29_col0\" class=\"data row29 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row29_col1\" class=\"data row29 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row29_col2\" class=\"data row29 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row29_col3\" class=\"data row29 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row29_col4\" class=\"data row29 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row29_col5\" class=\"data row29 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row30\" class=\"row_heading level0 row30\" >disable_defender_blockatfirstseen_feature.yml</th>\n",
       "      <td id=\"T_3deed_row30_col0\" class=\"data row30 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row30_col1\" class=\"data row30 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row30_col2\" class=\"data row30 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row30_col3\" class=\"data row30 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row30_col4\" class=\"data row30 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row30_col5\" class=\"data row30 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row31\" class=\"row_heading level0 row31\" >powershell___connect_to_internet_with_hidden_window.yml</th>\n",
       "      <td id=\"T_3deed_row31_col0\" class=\"data row31 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row31_col1\" class=\"data row31 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row31_col2\" class=\"data row31 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row31_col3\" class=\"data row31 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row31_col5\" class=\"data row31 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row32\" class=\"row_heading level0 row32\" >wscript_or_cscript_suspicious_child_process.yml</th>\n",
       "      <td id=\"T_3deed_row32_col0\" class=\"data row32 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row32_col1\" class=\"data row32 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row32_col2\" class=\"data row32 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row32_col3\" class=\"data row32 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row32_col4\" class=\"data row32 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row32_col5\" class=\"data row32 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row33\" class=\"row_heading level0 row33\" >hiding_files_and_directories_with_attrib_exe.yml</th>\n",
       "      <td id=\"T_3deed_row33_col0\" class=\"data row33 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row33_col1\" class=\"data row33 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row33_col2\" class=\"data row33 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row33_col3\" class=\"data row33 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row33_col4\" class=\"data row33 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row33_col5\" class=\"data row33 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row34\" class=\"row_heading level0 row34\" >windows_modify_registry_disable_toast_notifications.yml</th>\n",
       "      <td id=\"T_3deed_row34_col0\" class=\"data row34 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row34_col2\" class=\"data row34 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row34_col3\" class=\"data row34 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row34_col4\" class=\"data row34 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row34_col5\" class=\"data row34 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row35\" class=\"row_heading level0 row35\" >windows_modify_registry_disable_windows_security_center_notif.yml</th>\n",
       "      <td id=\"T_3deed_row35_col0\" class=\"data row35 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row35_col1\" class=\"data row35 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row35_col2\" class=\"data row35 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row35_col3\" class=\"data row35 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row35_col4\" class=\"data row35 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row35_col5\" class=\"data row35 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row36\" class=\"row_heading level0 row36\" >windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml</th>\n",
       "      <td id=\"T_3deed_row36_col0\" class=\"data row36 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row36_col1\" class=\"data row36 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row36_col2\" class=\"data row36 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row36_col3\" class=\"data row36 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row36_col4\" class=\"data row36 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row36_col5\" class=\"data row36 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row37\" class=\"row_heading level0 row37\" >windows_wmi_impersonate_token.yml</th>\n",
       "      <td id=\"T_3deed_row37_col0\" class=\"data row37 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row37_col1\" class=\"data row37 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row37_col2\" class=\"data row37 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row37_col3\" class=\"data row37 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row37_col4\" class=\"data row37 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row37_col5\" class=\"data row37 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row38\" class=\"row_heading level0 row38\" >office_application_spawn_regsvr32_process.yml</th>\n",
       "      <td id=\"T_3deed_row38_col0\" class=\"data row38 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row38_col1\" class=\"data row38 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row38_col2\" class=\"data row38 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row38_col3\" class=\"data row38 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row38_col4\" class=\"data row38 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row38_col5\" class=\"data row38 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row39\" class=\"row_heading level0 row39\" >windows_modify_registry_qakbot_binary_data_registry.yml</th>\n",
       "      <td id=\"T_3deed_row39_col0\" class=\"data row39 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row39_col1\" class=\"data row39 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row39_col2\" class=\"data row39 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row39_col3\" class=\"data row39 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row39_col4\" class=\"data row39 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row39_col5\" class=\"data row39 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row40\" class=\"row_heading level0 row40\" >nltest_domain_trust_discovery.yml</th>\n",
       "      <td id=\"T_3deed_row40_col0\" class=\"data row40 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row40_col1\" class=\"data row40 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row40_col2\" class=\"data row40 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row40_col3\" class=\"data row40 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row40_col4\" class=\"data row40 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row40_col5\" class=\"data row40 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row41\" class=\"row_heading level0 row41\" >windows_modify_registry_suppress_win_defender_notif.yml</th>\n",
       "      <td id=\"T_3deed_row41_col0\" class=\"data row41 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row41_col1\" class=\"data row41 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row41_col2\" class=\"data row41 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row41_col3\" class=\"data row41 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row41_col4\" class=\"data row41 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row41_col5\" class=\"data row41 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row42\" class=\"row_heading level0 row42\" >process_creating_lnk_file_in_suspicious_location.yml</th>\n",
       "      <td id=\"T_3deed_row42_col0\" class=\"data row42 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row42_col1\" class=\"data row42 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row42_col2\" class=\"data row42 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row42_col3\" class=\"data row42 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row42_col4\" class=\"data row42 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row42_col5\" class=\"data row42 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row43\" class=\"row_heading level0 row43\" >office_application_drop_executable.yml</th>\n",
       "      <td id=\"T_3deed_row43_col0\" class=\"data row43 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row43_col1\" class=\"data row43 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row43_col2\" class=\"data row43 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row43_col3\" class=\"data row43 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row43_col4\" class=\"data row43 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row43_col5\" class=\"data row43 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row44\" class=\"row_heading level0 row44\" >allow_inbound_traffic_by_firewall_rule_registry.yml</th>\n",
       "      <td id=\"T_3deed_row44_col0\" class=\"data row44 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row44_col1\" class=\"data row44 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row44_col2\" class=\"data row44 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row44_col3\" class=\"data row44 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row44_col4\" class=\"data row44 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row44_col5\" class=\"data row44 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row45\" class=\"row_heading level0 row45\" >disable_defender_enhanced_notification.yml</th>\n",
       "      <td id=\"T_3deed_row45_col0\" class=\"data row45 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row45_col1\" class=\"data row45 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row45_col2\" class=\"data row45 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row45_col3\" class=\"data row45 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row45_col4\" class=\"data row45 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row45_col5\" class=\"data row45 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row46\" class=\"row_heading level0 row46\" >powershell_remote_thread_to_known_windows_process.yml</th>\n",
       "      <td id=\"T_3deed_row46_col0\" class=\"data row46 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row46_col1\" class=\"data row46 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row46_col2\" class=\"data row46 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row46_col3\" class=\"data row46 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row46_col4\" class=\"data row46 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row46_col5\" class=\"data row46 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row47\" class=\"row_heading level0 row47\" >windows_process_injection_of_wermgr_to_known_browser.yml</th>\n",
       "      <td id=\"T_3deed_row47_col0\" class=\"data row47 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row47_col1\" class=\"data row47 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row47_col2\" class=\"data row47 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row47_col3\" class=\"data row47 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row47_col4\" class=\"data row47 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row47_col5\" class=\"data row47 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row48\" class=\"row_heading level0 row48\" >windows_multi_hop_proxy_tor_website_query.yml</th>\n",
       "      <td id=\"T_3deed_row48_col0\" class=\"data row48 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row48_col1\" class=\"data row48 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row48_col2\" class=\"data row48 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row48_col3\" class=\"data row48 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row48_col4\" class=\"data row48 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row48_col5\" class=\"data row48 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row49\" class=\"row_heading level0 row49\" >system_info_gathering_using_dxdiag_application.yml</th>\n",
       "      <td id=\"T_3deed_row49_col0\" class=\"data row49 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row49_col1\" class=\"data row49 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row49_col2\" class=\"data row49 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row49_col3\" class=\"data row49 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row49_col4\" class=\"data row49 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row49_col5\" class=\"data row49 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row50\" class=\"row_heading level0 row50\" >windows_mail_protocol_in_non_common_process_path.yml</th>\n",
       "      <td id=\"T_3deed_row50_col0\" class=\"data row50 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row50_col1\" class=\"data row50 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row50_col2\" class=\"data row50 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row50_col3\" class=\"data row50 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row50_col4\" class=\"data row50 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row50_col5\" class=\"data row50 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row51\" class=\"row_heading level0 row51\" >winevent_windows_task_scheduler_event_action_started.yml</th>\n",
       "      <td id=\"T_3deed_row51_col0\" class=\"data row51 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row51_col1\" class=\"data row51 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row51_col2\" class=\"data row51 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row51_col3\" class=\"data row51 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row51_col4\" class=\"data row51 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row51_col5\" class=\"data row51 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row52\" class=\"row_heading level0 row52\" >regsvr32_silent_and_install_param_dll_loading.yml</th>\n",
       "      <td id=\"T_3deed_row52_col0\" class=\"data row52 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row52_col1\" class=\"data row52 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row52_col2\" class=\"data row52 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row52_col3\" class=\"data row52 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row52_col4\" class=\"data row52 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row52_col5\" class=\"data row52 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row53\" class=\"row_heading level0 row53\" >network_connection_discovery_net.yml</th>\n",
       "      <td id=\"T_3deed_row53_col0\" class=\"data row53 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row53_col1\" class=\"data row53 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row53_col2\" class=\"data row53 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row53_col3\" class=\"data row53 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row53_col4\" class=\"data row53 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row53_col5\" class=\"data row53 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row54\" class=\"row_heading level0 row54\" >windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml</th>\n",
       "      <td id=\"T_3deed_row54_col0\" class=\"data row54 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row54_col1\" class=\"data row54 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row54_col2\" class=\"data row54 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row54_col3\" class=\"data row54 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row54_col4\" class=\"data row54 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row54_col5\" class=\"data row54 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row55\" class=\"row_heading level0 row55\" >sc_exe_manipulating_windows_services.yml</th>\n",
       "      <td id=\"T_3deed_row55_col0\" class=\"data row55 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row55_col2\" class=\"data row55 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row55_col3\" class=\"data row55 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row55_col4\" class=\"data row55 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row55_col5\" class=\"data row55 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row56\" class=\"row_heading level0 row56\" >disable_windows_behavior_monitoring.yml</th>\n",
       "      <td id=\"T_3deed_row56_col0\" class=\"data row56 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row56_col2\" class=\"data row56 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row56_col3\" class=\"data row56 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row56_col4\" class=\"data row56 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row56_col5\" class=\"data row56 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row57\" class=\"row_heading level0 row57\" >create_remote_thread_in_shell_application.yml</th>\n",
       "      <td id=\"T_3deed_row57_col0\" class=\"data row57 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row57_col1\" class=\"data row57 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row57_col2\" class=\"data row57 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row57_col3\" class=\"data row57 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row57_col4\" class=\"data row57 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row57_col5\" class=\"data row57 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row58\" class=\"row_heading level0 row58\" >network_connection_discovery_arp.yml</th>\n",
       "      <td id=\"T_3deed_row58_col0\" class=\"data row58 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row58_col1\" class=\"data row58 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row58_col2\" class=\"data row58 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row58_col3\" class=\"data row58 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row58_col4\" class=\"data row58 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row58_col5\" class=\"data row58 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row59\" class=\"row_heading level0 row59\" >schtasks_run_task_on_demand.yml</th>\n",
       "      <td id=\"T_3deed_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row59_col1\" class=\"data row59 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row59_col2\" class=\"data row59 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row59_col3\" class=\"data row59 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row59_col4\" class=\"data row59 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row59_col5\" class=\"data row59 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row60\" class=\"row_heading level0 row60\" >windows_masquerading_explorer_as_child_process.yml</th>\n",
       "      <td id=\"T_3deed_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row60_col1\" class=\"data row60 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row60_col2\" class=\"data row60 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row60_col3\" class=\"data row60 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row60_col4\" class=\"data row60 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row60_col5\" class=\"data row60 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row61\" class=\"row_heading level0 row61\" >windows_wmi_process_call_create.yml</th>\n",
       "      <td id=\"T_3deed_row61_col0\" class=\"data row61 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row61_col1\" class=\"data row61 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row61_col2\" class=\"data row61 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row61_col3\" class=\"data row61 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row61_col4\" class=\"data row61 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row61_col5\" class=\"data row61 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row62\" class=\"row_heading level0 row62\" >cmdline_tool_not_executed_in_cmd_shell.yml</th>\n",
       "      <td id=\"T_3deed_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row62_col1\" class=\"data row62 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row62_col2\" class=\"data row62 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row62_col3\" class=\"data row62 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row62_col4\" class=\"data row62 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row62_col5\" class=\"data row62 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row63\" class=\"row_heading level0 row63\" >windows_modify_registry_regedit_silent_reg_import.yml</th>\n",
       "      <td id=\"T_3deed_row63_col0\" class=\"data row63 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row63_col1\" class=\"data row63 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row63_col2\" class=\"data row63 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row63_col3\" class=\"data row63 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row63_col4\" class=\"data row63 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row63_col5\" class=\"data row63 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row64\" class=\"row_heading level0 row64\" >windows_file_transfer_protocol_in_non_common_process_path.yml</th>\n",
       "      <td id=\"T_3deed_row64_col0\" class=\"data row64 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row64_col1\" class=\"data row64 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row64_col2\" class=\"data row64 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row64_col3\" class=\"data row64 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row64_col4\" class=\"data row64 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row64_col5\" class=\"data row64 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row65\" class=\"row_heading level0 row65\" >network_connection_discovery_netstat.yml</th>\n",
       "      <td id=\"T_3deed_row65_col0\" class=\"data row65 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row65_col1\" class=\"data row65 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row65_col2\" class=\"data row65 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row65_col3\" class=\"data row65 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row65_col4\" class=\"data row65 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row65_col5\" class=\"data row65 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row66\" class=\"row_heading level0 row66\" >windows_remote_services_rdp_enable.yml</th>\n",
       "      <td id=\"T_3deed_row66_col0\" class=\"data row66 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row66_col1\" class=\"data row66 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row66_col2\" class=\"data row66 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row66_col3\" class=\"data row66 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row66_col4\" class=\"data row66 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row66_col5\" class=\"data row66 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row67\" class=\"row_heading level0 row67\" >suspicious_wav_file_in_appdata_folder.yml</th>\n",
       "      <td id=\"T_3deed_row67_col0\" class=\"data row67 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row67_col1\" class=\"data row67 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row67_col2\" class=\"data row67 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row67_col3\" class=\"data row67 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row67_col4\" class=\"data row67 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row67_col5\" class=\"data row67 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row68\" class=\"row_heading level0 row68\" >allow_operation_with_consent_admin.yml</th>\n",
       "      <td id=\"T_3deed_row68_col0\" class=\"data row68 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row68_col1\" class=\"data row68 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row68_col2\" class=\"data row68 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row68_col3\" class=\"data row68 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row68_col4\" class=\"data row68 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row68_col5\" class=\"data row68 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row69\" class=\"row_heading level0 row69\" >windows_remote_services_allow_rdp_in_firewall.yml</th>\n",
       "      <td id=\"T_3deed_row69_col0\" class=\"data row69 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row69_col1\" class=\"data row69 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row69_col2\" class=\"data row69 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row69_col3\" class=\"data row69 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row69_col4\" class=\"data row69 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row69_col5\" class=\"data row69 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row70\" class=\"row_heading level0 row70\" >suspicious_process_dns_query_known_abuse_web_services.yml</th>\n",
       "      <td id=\"T_3deed_row70_col0\" class=\"data row70 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row70_col1\" class=\"data row70 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row70_col2\" class=\"data row70 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row70_col3\" class=\"data row70 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row70_col4\" class=\"data row70 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row70_col5\" class=\"data row70 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row71\" class=\"row_heading level0 row71\" >icacls_deny_command.yml</th>\n",
       "      <td id=\"T_3deed_row71_col0\" class=\"data row71 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row71_col1\" class=\"data row71 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row71_col2\" class=\"data row71 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row71_col3\" class=\"data row71 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row71_col4\" class=\"data row71 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row71_col5\" class=\"data row71 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row72\" class=\"row_heading level0 row72\" >processes_launching_netsh.yml</th>\n",
       "      <td id=\"T_3deed_row72_col0\" class=\"data row72 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row72_col1\" class=\"data row72 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row72_col2\" class=\"data row72 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row72_col3\" class=\"data row72 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row72_col4\" class=\"data row72 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row72_col5\" class=\"data row72 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row73\" class=\"row_heading level0 row73\" >wermgr_process_connecting_to_ip_check_web_services.yml</th>\n",
       "      <td id=\"T_3deed_row73_col0\" class=\"data row73 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row73_col1\" class=\"data row73 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row73_col2\" class=\"data row73 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row73_col3\" class=\"data row73 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row73_col4\" class=\"data row73 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row73_col5\" class=\"data row73 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row74\" class=\"row_heading level0 row74\" >hide_user_account_from_sign_in_screen.yml</th>\n",
       "      <td id=\"T_3deed_row74_col0\" class=\"data row74 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row74_col1\" class=\"data row74 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row74_col2\" class=\"data row74 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row74_col3\" class=\"data row74 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row74_col4\" class=\"data row74 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row74_col5\" class=\"data row74 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row75\" class=\"row_heading level0 row75\" >remcos_rat_file_creation_in_remcos_folder.yml</th>\n",
       "      <td id=\"T_3deed_row75_col0\" class=\"data row75 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row75_col1\" class=\"data row75 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row75_col2\" class=\"data row75 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row75_col3\" class=\"data row75 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row75_col4\" class=\"data row75 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row75_col5\" class=\"data row75 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row76\" class=\"row_heading level0 row76\" >windows_impair_defense_add_xml_applocker_rules.yml</th>\n",
       "      <td id=\"T_3deed_row76_col0\" class=\"data row76 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row76_col1\" class=\"data row76 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row76_col2\" class=\"data row76 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row76_col3\" class=\"data row76 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row76_col4\" class=\"data row76 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row76_col5\" class=\"data row76 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row77\" class=\"row_heading level0 row77\" >windows_system_discovery_using_qwinsta.yml</th>\n",
       "      <td id=\"T_3deed_row77_col0\" class=\"data row77 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row77_col1\" class=\"data row77 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row77_col2\" class=\"data row77 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row77_col3\" class=\"data row77 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row77_col4\" class=\"data row77 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row77_col5\" class=\"data row77 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row78\" class=\"row_heading level0 row78\" >wermgr_process_create_executable_file.yml</th>\n",
       "      <td id=\"T_3deed_row78_col0\" class=\"data row78 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row78_col1\" class=\"data row78 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row78_col2\" class=\"data row78 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row78_col3\" class=\"data row78 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row78_col4\" class=\"data row78 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row78_col5\" class=\"data row78 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row79\" class=\"row_heading level0 row79\" >system_user_discovery_with_whoami.yml</th>\n",
       "      <td id=\"T_3deed_row79_col0\" class=\"data row79 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row79_col1\" class=\"data row79 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row79_col2\" class=\"data row79 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row79_col3\" class=\"data row79 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row79_col4\" class=\"data row79 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row79_col5\" class=\"data row79 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row80\" class=\"row_heading level0 row80\" >windows_remote_services_allow_remote_assistance.yml</th>\n",
       "      <td id=\"T_3deed_row80_col0\" class=\"data row80 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row80_col1\" class=\"data row80 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row80_col2\" class=\"data row80 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row80_col3\" class=\"data row80 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row80_col4\" class=\"data row80 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row80_col5\" class=\"data row80 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row81\" class=\"row_heading level0 row81\" >windows_remote_access_software_rms_registry.yml</th>\n",
       "      <td id=\"T_3deed_row81_col0\" class=\"data row81 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row81_col1\" class=\"data row81 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row81_col2\" class=\"data row81 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row81_col3\" class=\"data row81 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row81_col4\" class=\"data row81 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row81_col5\" class=\"data row81 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row82\" class=\"row_heading level0 row82\" >windows_process_injection_remote_thread.yml</th>\n",
       "      <td id=\"T_3deed_row82_col0\" class=\"data row82 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row82_col1\" class=\"data row82 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row82_col2\" class=\"data row82 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row82_col3\" class=\"data row82 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row82_col4\" class=\"data row82 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row82_col5\" class=\"data row82 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row83\" class=\"row_heading level0 row83\" >excessive_attempt_to_disable_services.yml</th>\n",
       "      <td id=\"T_3deed_row83_col0\" class=\"data row83 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row83_col1\" class=\"data row83 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row83_col2\" class=\"data row83 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row83_col3\" class=\"data row83 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row83_col4\" class=\"data row83 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row83_col5\" class=\"data row83 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row84\" class=\"row_heading level0 row84\" >windows_remote_service_rdpwinst_tool_execution.yml</th>\n",
       "      <td id=\"T_3deed_row84_col0\" class=\"data row84 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row84_col1\" class=\"data row84 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row84_col2\" class=\"data row84 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row84_col3\" class=\"data row84 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row84_col4\" class=\"data row84 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row84_col5\" class=\"data row84 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row85\" class=\"row_heading level0 row85\" >excessive_usage_of_cacls_app.yml</th>\n",
       "      <td id=\"T_3deed_row85_col0\" class=\"data row85 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row85_col1\" class=\"data row85 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row85_col2\" class=\"data row85 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row85_col3\" class=\"data row85 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row85_col4\" class=\"data row85 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row85_col5\" class=\"data row85 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row86\" class=\"row_heading level0 row86\" >loading_of_dynwrapx_module.yml</th>\n",
       "      <td id=\"T_3deed_row86_col0\" class=\"data row86 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row86_col1\" class=\"data row86 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row86_col2\" class=\"data row86 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row86_col3\" class=\"data row86 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row86_col4\" class=\"data row86 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row86_col5\" class=\"data row86 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row87\" class=\"row_heading level0 row87\" >possible_browser_pass_view_parameter.yml</th>\n",
       "      <td id=\"T_3deed_row87_col0\" class=\"data row87 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row87_col1\" class=\"data row87 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row87_col2\" class=\"data row87 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row87_col3\" class=\"data row87 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row87_col4\" class=\"data row87 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row87_col5\" class=\"data row87 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row88\" class=\"row_heading level0 row88\" >excessive_usage_of_net_app.yml</th>\n",
       "      <td id=\"T_3deed_row88_col0\" class=\"data row88 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row88_col1\" class=\"data row88 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row88_col2\" class=\"data row88 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row88_col3\" class=\"data row88 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row88_col4\" class=\"data row88 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row88_col5\" class=\"data row88 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row89\" class=\"row_heading level0 row89\" >windows_process_injection_wermgr_child_process.yml</th>\n",
       "      <td id=\"T_3deed_row89_col0\" class=\"data row89 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row89_col1\" class=\"data row89 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row89_col2\" class=\"data row89 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row89_col3\" class=\"data row89 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row89_col4\" class=\"data row89 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row89_col5\" class=\"data row89 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row90\" class=\"row_heading level0 row90\" >vbscript_execution_using_wscript_app.yml</th>\n",
       "      <td id=\"T_3deed_row90_col0\" class=\"data row90 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row90_col1\" class=\"data row90 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row90_col2\" class=\"data row90 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row90_col3\" class=\"data row90 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row90_col4\" class=\"data row90 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row90_col5\" class=\"data row90 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row91\" class=\"row_heading level0 row91\" >office_product_spawning_mshta.yml</th>\n",
       "      <td id=\"T_3deed_row91_col0\" class=\"data row91 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row91_col1\" class=\"data row91 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row91_col2\" class=\"data row91 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row91_col3\" class=\"data row91 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row91_col4\" class=\"data row91 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row91_col5\" class=\"data row91 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row92\" class=\"row_heading level0 row92\" >windows_disableantispyware_reg.yml</th>\n",
       "      <td id=\"T_3deed_row92_col0\" class=\"data row92 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row92_col1\" class=\"data row92 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row92_col2\" class=\"data row92 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row92_col3\" class=\"data row92 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row92_col4\" class=\"data row92 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row92_col5\" class=\"data row92 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row93\" class=\"row_heading level0 row93\" >suspicious_driver_loaded_path.yml</th>\n",
       "      <td id=\"T_3deed_row93_col0\" class=\"data row93 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row93_col1\" class=\"data row93 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row93_col2\" class=\"data row93 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row93_col3\" class=\"data row93 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row93_col4\" class=\"data row93 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row93_col5\" class=\"data row93 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row94\" class=\"row_heading level0 row94\" >system_processes_run_from_unexpected_locations.yml</th>\n",
       "      <td id=\"T_3deed_row94_col0\" class=\"data row94 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row94_col1\" class=\"data row94 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row94_col2\" class=\"data row94 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row94_col3\" class=\"data row94 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row94_col4\" class=\"data row94 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row94_col5\" class=\"data row94 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row95\" class=\"row_heading level0 row95\" >trickbot_named_pipe.yml</th>\n",
       "      <td id=\"T_3deed_row95_col0\" class=\"data row95 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row95_col1\" class=\"data row95 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row95_col2\" class=\"data row95 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row95_col3\" class=\"data row95 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row95_col4\" class=\"data row95 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row95_col5\" class=\"data row95 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row96\" class=\"row_heading level0 row96\" >windows_service_created_with_suspicious_service_path.yml</th>\n",
       "      <td id=\"T_3deed_row96_col0\" class=\"data row96 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row96_col1\" class=\"data row96 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row96_col2\" class=\"data row96 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row96_col3\" class=\"data row96 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row96_col4\" class=\"data row96 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row96_col5\" class=\"data row96 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row97\" class=\"row_heading level0 row97\" >windows_system_discovery_using_ldap_nslookup.yml</th>\n",
       "      <td id=\"T_3deed_row97_col0\" class=\"data row97 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row97_col1\" class=\"data row97 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row97_col2\" class=\"data row97 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row97_col3\" class=\"data row97 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row97_col4\" class=\"data row97 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row97_col5\" class=\"data row97 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row98\" class=\"row_heading level0 row98\" >windows_app_layer_protocol_qakbot_namedpipe.yml</th>\n",
       "      <td id=\"T_3deed_row98_col0\" class=\"data row98 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row98_col1\" class=\"data row98 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row98_col2\" class=\"data row98 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row98_col3\" class=\"data row98 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row98_col4\" class=\"data row98 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row98_col5\" class=\"data row98 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row99\" class=\"row_heading level0 row99\" >recon_using_wmi_class.yml</th>\n",
       "      <td id=\"T_3deed_row99_col0\" class=\"data row99 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row99_col1\" class=\"data row99 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row99_col2\" class=\"data row99 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row99_col3\" class=\"data row99 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row99_col4\" class=\"data row99 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row99_col5\" class=\"data row99 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row100\" class=\"row_heading level0 row100\" >firewall_allowed_program_enable.yml</th>\n",
       "      <td id=\"T_3deed_row100_col0\" class=\"data row100 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row100_col1\" class=\"data row100 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row100_col2\" class=\"data row100 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row100_col3\" class=\"data row100 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row100_col4\" class=\"data row100 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row100_col5\" class=\"data row100 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row101\" class=\"row_heading level0 row101\" >windows_command_shell_fetch_env_variables.yml</th>\n",
       "      <td id=\"T_3deed_row101_col0\" class=\"data row101 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row101_col1\" class=\"data row101 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row101_col2\" class=\"data row101 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row101_col3\" class=\"data row101 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row101_col4\" class=\"data row101 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row101_col5\" class=\"data row101 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row102\" class=\"row_heading level0 row102\" >process_deleting_its_process_file_path.yml</th>\n",
       "      <td id=\"T_3deed_row102_col0\" class=\"data row102 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row102_col1\" class=\"data row102 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row102_col2\" class=\"data row102 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row102_col3\" class=\"data row102 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row102_col4\" class=\"data row102 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row102_col5\" class=\"data row102 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row103\" class=\"row_heading level0 row103\" >network_discovery_using_route_windows_app.yml</th>\n",
       "      <td id=\"T_3deed_row103_col0\" class=\"data row103 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row103_col1\" class=\"data row103 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row103_col2\" class=\"data row103 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row103_col3\" class=\"data row103 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row103_col4\" class=\"data row103 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row103_col5\" class=\"data row103 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row104\" class=\"row_heading level0 row104\" >office_product_spawning_windows_script_host.yml</th>\n",
       "      <td id=\"T_3deed_row104_col0\" class=\"data row104 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row104_col1\" class=\"data row104 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row104_col2\" class=\"data row104 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row104_col3\" class=\"data row104 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row104_col4\" class=\"data row104 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row104_col5\" class=\"data row104 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row105\" class=\"row_heading level0 row105\" >create_local_admin_accounts_using_net_exe.yml</th>\n",
       "      <td id=\"T_3deed_row105_col0\" class=\"data row105 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row105_col1\" class=\"data row105 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row105_col2\" class=\"data row105 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row105_col3\" class=\"data row105 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row105_col4\" class=\"data row105 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row105_col5\" class=\"data row105 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row106\" class=\"row_heading level0 row106\" >suspicious_image_creation_in_appdata_folder.yml</th>\n",
       "      <td id=\"T_3deed_row106_col0\" class=\"data row106 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row106_col1\" class=\"data row106 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row106_col2\" class=\"data row106 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row106_col3\" class=\"data row106 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row106_col4\" class=\"data row106 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row106_col5\" class=\"data row106 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row107\" class=\"row_heading level0 row107\" >cobalt_strike_named_pipes.yml</th>\n",
       "      <td id=\"T_3deed_row107_col0\" class=\"data row107 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row107_col1\" class=\"data row107 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row107_col2\" class=\"data row107 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row107_col3\" class=\"data row107 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row107_col4\" class=\"data row107 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row107_col5\" class=\"data row107 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row108\" class=\"row_heading level0 row108\" >windows_dll_side_loading_in_calc.yml</th>\n",
       "      <td id=\"T_3deed_row108_col0\" class=\"data row108 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row108_col1\" class=\"data row108 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row108_col2\" class=\"data row108 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row108_col3\" class=\"data row108 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row108_col4\" class=\"data row108 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row108_col5\" class=\"data row108 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row109\" class=\"row_heading level0 row109\" >remcos_client_registry_install_entry.yml</th>\n",
       "      <td id=\"T_3deed_row109_col0\" class=\"data row109 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row109_col1\" class=\"data row109 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row109_col2\" class=\"data row109 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row109_col3\" class=\"data row109 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row109_col4\" class=\"data row109 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row109_col5\" class=\"data row109 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row110\" class=\"row_heading level0 row110\" >powershell_loading_dotnet_into_memory_via_reflection.yml</th>\n",
       "      <td id=\"T_3deed_row110_col0\" class=\"data row110 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row110_col1\" class=\"data row110 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row110_col2\" class=\"data row110 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row110_col3\" class=\"data row110 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row110_col4\" class=\"data row110 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row110_col5\" class=\"data row110 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row111\" class=\"row_heading level0 row111\" >suspicious_scheduled_task_from_public_directory.yml</th>\n",
       "      <td id=\"T_3deed_row111_col0\" class=\"data row111 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row111_col1\" class=\"data row111 col1\" >yes</td>\n",
       "      <td id=\"T_3deed_row111_col2\" class=\"data row111 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row111_col3\" class=\"data row111 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row111_col4\" class=\"data row111 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row111_col5\" class=\"data row111 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row112\" class=\"row_heading level0 row112\" >recon_avproduct_through_pwh_or_wmi.yml</th>\n",
       "      <td id=\"T_3deed_row112_col0\" class=\"data row112 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row112_col1\" class=\"data row112 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row112_col2\" class=\"data row112 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row112_col3\" class=\"data row112 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row112_col4\" class=\"data row112 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row112_col5\" class=\"data row112 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row113\" class=\"row_heading level0 row113\" >suspicious_regsvr32_register_suspicious_path.yml</th>\n",
       "      <td id=\"T_3deed_row113_col0\" class=\"data row113 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row113_col1\" class=\"data row113 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row113_col2\" class=\"data row113 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row113_col3\" class=\"data row113 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row113_col4\" class=\"data row113 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row113_col5\" class=\"data row113 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row114\" class=\"row_heading level0 row114\" >windows_drivers_loaded_by_signature.yml</th>\n",
       "      <td id=\"T_3deed_row114_col0\" class=\"data row114 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row114_col1\" class=\"data row114 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row114_col2\" class=\"data row114 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row114_col3\" class=\"data row114 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row114_col4\" class=\"data row114 col4\" >yes</td>\n",
       "      <td id=\"T_3deed_row114_col5\" class=\"data row114 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row115\" class=\"row_heading level0 row115\" >malicious_powershell_process___encoded_command.yml</th>\n",
       "      <td id=\"T_3deed_row115_col0\" class=\"data row115 col0\" >yes</td>\n",
       "      <td id=\"T_3deed_row115_col1\" class=\"data row115 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row115_col2\" class=\"data row115 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row115_col3\" class=\"data row115 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row115_col4\" class=\"data row115 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row115_col5\" class=\"data row115 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row116\" class=\"row_heading level0 row116\" >mshta_spawning_rundll32_or_regsvr32_process.yml</th>\n",
       "      <td id=\"T_3deed_row116_col0\" class=\"data row116 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row116_col1\" class=\"data row116 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row116_col2\" class=\"data row116 col2\" >no</td>\n",
       "      <td id=\"T_3deed_row116_col3\" class=\"data row116 col3\" >yes</td>\n",
       "      <td id=\"T_3deed_row116_col4\" class=\"data row116 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row116_col5\" class=\"data row116 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_3deed_level0_row117\" class=\"row_heading level0 row117\" >malicious_inprocserver32_modification.yml</th>\n",
       "      <td id=\"T_3deed_row117_col0\" class=\"data row117 col0\" >no</td>\n",
       "      <td id=\"T_3deed_row117_col1\" class=\"data row117 col1\" >no</td>\n",
       "      <td id=\"T_3deed_row117_col2\" class=\"data row117 col2\" >yes</td>\n",
       "      <td id=\"T_3deed_row117_col3\" class=\"data row117 col3\" >no</td>\n",
       "      <td id=\"T_3deed_row117_col4\" class=\"data row117 col4\" >no</td>\n",
       "      <td id=\"T_3deed_row117_col5\" class=\"data row117 col5\" >1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x10cbbca90>"
      ]
     },
     "execution_count": 40,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 1]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e144114f-2282-4169-a577-d690bfc6dbd9",
   "metadata": {},
   "source": [
    "### truth table mitre attack id vs analytic story (malware family)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "id": "ee827b0f-acff-4bf6-830e-4e0ec732b932",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(74, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_8ad61_row0_col0, #T_8ad61_row0_col1, #T_8ad61_row0_col2, #T_8ad61_row0_col3, #T_8ad61_row0_col4, #T_8ad61_row0_col5, #T_8ad61_row1_col0, #T_8ad61_row1_col1, #T_8ad61_row1_col2, #T_8ad61_row1_col3, #T_8ad61_row1_col4, #T_8ad61_row1_col5, #T_8ad61_row2_col0, #T_8ad61_row2_col1, #T_8ad61_row2_col2, #T_8ad61_row2_col3, #T_8ad61_row2_col4, #T_8ad61_row2_col5, #T_8ad61_row3_col0, #T_8ad61_row3_col1, #T_8ad61_row3_col2, #T_8ad61_row3_col3, #T_8ad61_row3_col4, #T_8ad61_row3_col5, #T_8ad61_row4_col0, #T_8ad61_row4_col1, #T_8ad61_row4_col2, #T_8ad61_row4_col3, #T_8ad61_row4_col4, #T_8ad61_row4_col5, #T_8ad61_row5_col0, #T_8ad61_row5_col1, #T_8ad61_row5_col2, #T_8ad61_row5_col3, #T_8ad61_row5_col4, #T_8ad61_row5_col5, #T_8ad61_row6_col0, #T_8ad61_row6_col1, #T_8ad61_row6_col2, #T_8ad61_row6_col3, #T_8ad61_row6_col4, #T_8ad61_row6_col5 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_8ad61_row7_col0, #T_8ad61_row7_col1, #T_8ad61_row7_col2, #T_8ad61_row7_col3, #T_8ad61_row7_col4, #T_8ad61_row7_col5, #T_8ad61_row8_col0, #T_8ad61_row8_col1, #T_8ad61_row8_col2, #T_8ad61_row8_col3, #T_8ad61_row8_col4, #T_8ad61_row8_col5, #T_8ad61_row9_col0, #T_8ad61_row9_col1, #T_8ad61_row9_col2, #T_8ad61_row9_col3, #T_8ad61_row9_col4, #T_8ad61_row9_col5, #T_8ad61_row10_col0, #T_8ad61_row10_col1, #T_8ad61_row10_col2, #T_8ad61_row10_col3, #T_8ad61_row10_col4, #T_8ad61_row10_col5, #T_8ad61_row11_col0, #T_8ad61_row11_col1, #T_8ad61_row11_col2, #T_8ad61_row11_col3, #T_8ad61_row11_col4, #T_8ad61_row11_col5 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_8ad61_row12_col0, #T_8ad61_row12_col1, #T_8ad61_row12_col2, #T_8ad61_row12_col3, #T_8ad61_row12_col4, #T_8ad61_row12_col5, #T_8ad61_row13_col0, #T_8ad61_row13_col1, #T_8ad61_row13_col2, #T_8ad61_row13_col3, #T_8ad61_row13_col4, #T_8ad61_row13_col5, #T_8ad61_row14_col0, #T_8ad61_row14_col1, #T_8ad61_row14_col2, #T_8ad61_row14_col3, #T_8ad61_row14_col4, #T_8ad61_row14_col5, #T_8ad61_row15_col0, #T_8ad61_row15_col1, #T_8ad61_row15_col2, #T_8ad61_row15_col3, #T_8ad61_row15_col4, #T_8ad61_row15_col5, #T_8ad61_row16_col0, #T_8ad61_row16_col1, #T_8ad61_row16_col2, #T_8ad61_row16_col3, #T_8ad61_row16_col4, #T_8ad61_row16_col5, #T_8ad61_row17_col0, #T_8ad61_row17_col1, #T_8ad61_row17_col2, #T_8ad61_row17_col3, #T_8ad61_row17_col4, #T_8ad61_row17_col5, #T_8ad61_row18_col0, #T_8ad61_row18_col1, #T_8ad61_row18_col2, #T_8ad61_row18_col3, #T_8ad61_row18_col4, #T_8ad61_row18_col5, #T_8ad61_row19_col0, #T_8ad61_row19_col1, #T_8ad61_row19_col2, #T_8ad61_row19_col3, #T_8ad61_row19_col4, #T_8ad61_row19_col5, #T_8ad61_row20_col0, #T_8ad61_row20_col1, #T_8ad61_row20_col2, #T_8ad61_row20_col3, #T_8ad61_row20_col4, #T_8ad61_row20_col5, #T_8ad61_row21_col0, #T_8ad61_row21_col1, #T_8ad61_row21_col2, #T_8ad61_row21_col3, #T_8ad61_row21_col4, #T_8ad61_row21_col5, #T_8ad61_row22_col0, #T_8ad61_row22_col1, #T_8ad61_row22_col2, #T_8ad61_row22_col3, #T_8ad61_row22_col4, #T_8ad61_row22_col5 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_8ad61_row23_col0, #T_8ad61_row23_col1, #T_8ad61_row23_col2, #T_8ad61_row23_col3, #T_8ad61_row23_col4, #T_8ad61_row23_col5, #T_8ad61_row24_col0, #T_8ad61_row24_col1, #T_8ad61_row24_col2, #T_8ad61_row24_col3, #T_8ad61_row24_col4, #T_8ad61_row24_col5, #T_8ad61_row25_col0, #T_8ad61_row25_col1, #T_8ad61_row25_col2, #T_8ad61_row25_col3, #T_8ad61_row25_col4, #T_8ad61_row25_col5, #T_8ad61_row26_col0, #T_8ad61_row26_col1, #T_8ad61_row26_col2, #T_8ad61_row26_col3, #T_8ad61_row26_col4, #T_8ad61_row26_col5, #T_8ad61_row27_col0, #T_8ad61_row27_col1, #T_8ad61_row27_col2, #T_8ad61_row27_col3, #T_8ad61_row27_col4, #T_8ad61_row27_col5, #T_8ad61_row28_col0, #T_8ad61_row28_col1, #T_8ad61_row28_col2, #T_8ad61_row28_col3, #T_8ad61_row28_col4, #T_8ad61_row28_col5, #T_8ad61_row29_col0, #T_8ad61_row29_col1, #T_8ad61_row29_col2, #T_8ad61_row29_col3, #T_8ad61_row29_col4, #T_8ad61_row29_col5, #T_8ad61_row30_col0, #T_8ad61_row30_col1, #T_8ad61_row30_col2, #T_8ad61_row30_col3, #T_8ad61_row30_col4, #T_8ad61_row30_col5, #T_8ad61_row31_col0, #T_8ad61_row31_col1, #T_8ad61_row31_col2, #T_8ad61_row31_col3, #T_8ad61_row31_col4, #T_8ad61_row31_col5, #T_8ad61_row32_col0, #T_8ad61_row32_col1, #T_8ad61_row32_col2, #T_8ad61_row32_col3, #T_8ad61_row32_col4, #T_8ad61_row32_col5, #T_8ad61_row33_col0, #T_8ad61_row33_col1, #T_8ad61_row33_col2, #T_8ad61_row33_col3, #T_8ad61_row33_col4, #T_8ad61_row33_col5, #T_8ad61_row34_col0, #T_8ad61_row34_col1, #T_8ad61_row34_col2, #T_8ad61_row34_col3, #T_8ad61_row34_col4, #T_8ad61_row34_col5 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_8ad61_row35_col0, #T_8ad61_row35_col1, #T_8ad61_row35_col2, #T_8ad61_row35_col3, #T_8ad61_row35_col4, #T_8ad61_row35_col5, #T_8ad61_row36_col0, #T_8ad61_row36_col1, #T_8ad61_row36_col2, #T_8ad61_row36_col3, #T_8ad61_row36_col4, #T_8ad61_row36_col5, #T_8ad61_row37_col0, #T_8ad61_row37_col1, #T_8ad61_row37_col2, #T_8ad61_row37_col3, #T_8ad61_row37_col4, #T_8ad61_row37_col5, #T_8ad61_row38_col0, #T_8ad61_row38_col1, #T_8ad61_row38_col2, #T_8ad61_row38_col3, #T_8ad61_row38_col4, #T_8ad61_row38_col5, #T_8ad61_row39_col0, #T_8ad61_row39_col1, #T_8ad61_row39_col2, #T_8ad61_row39_col3, #T_8ad61_row39_col4, #T_8ad61_row39_col5, #T_8ad61_row40_col0, #T_8ad61_row40_col1, #T_8ad61_row40_col2, #T_8ad61_row40_col3, #T_8ad61_row40_col4, #T_8ad61_row40_col5, #T_8ad61_row41_col0, #T_8ad61_row41_col1, #T_8ad61_row41_col2, #T_8ad61_row41_col3, #T_8ad61_row41_col4, #T_8ad61_row41_col5, #T_8ad61_row42_col0, #T_8ad61_row42_col1, #T_8ad61_row42_col2, #T_8ad61_row42_col3, #T_8ad61_row42_col4, #T_8ad61_row42_col5, #T_8ad61_row43_col0, #T_8ad61_row43_col1, #T_8ad61_row43_col2, #T_8ad61_row43_col3, #T_8ad61_row43_col4, #T_8ad61_row43_col5, #T_8ad61_row44_col0, #T_8ad61_row44_col1, #T_8ad61_row44_col2, #T_8ad61_row44_col3, #T_8ad61_row44_col4, #T_8ad61_row44_col5, #T_8ad61_row45_col0, #T_8ad61_row45_col1, #T_8ad61_row45_col2, #T_8ad61_row45_col3, #T_8ad61_row45_col4, #T_8ad61_row45_col5, #T_8ad61_row46_col0, #T_8ad61_row46_col1, #T_8ad61_row46_col2, #T_8ad61_row46_col3, #T_8ad61_row46_col4, #T_8ad61_row46_col5, #T_8ad61_row47_col0, #T_8ad61_row47_col1, #T_8ad61_row47_col2, #T_8ad61_row47_col3, #T_8ad61_row47_col4, #T_8ad61_row47_col5, #T_8ad61_row48_col0, #T_8ad61_row48_col1, #T_8ad61_row48_col2, #T_8ad61_row48_col3, #T_8ad61_row48_col4, #T_8ad61_row48_col5, #T_8ad61_row49_col0, #T_8ad61_row49_col1, #T_8ad61_row49_col2, #T_8ad61_row49_col3, #T_8ad61_row49_col4, #T_8ad61_row49_col5, #T_8ad61_row50_col0, #T_8ad61_row50_col1, #T_8ad61_row50_col2, #T_8ad61_row50_col3, #T_8ad61_row50_col4, #T_8ad61_row50_col5, #T_8ad61_row51_col0, #T_8ad61_row51_col1, #T_8ad61_row51_col2, #T_8ad61_row51_col3, #T_8ad61_row51_col4, #T_8ad61_row51_col5, #T_8ad61_row52_col0, #T_8ad61_row52_col1, #T_8ad61_row52_col2, #T_8ad61_row52_col3, #T_8ad61_row52_col4, #T_8ad61_row52_col5, #T_8ad61_row53_col0, #T_8ad61_row53_col1, #T_8ad61_row53_col2, #T_8ad61_row53_col3, #T_8ad61_row53_col4, #T_8ad61_row53_col5, #T_8ad61_row54_col0, #T_8ad61_row54_col1, #T_8ad61_row54_col2, #T_8ad61_row54_col3, #T_8ad61_row54_col4, #T_8ad61_row54_col5, #T_8ad61_row55_col0, #T_8ad61_row55_col1, #T_8ad61_row55_col2, #T_8ad61_row55_col3, #T_8ad61_row55_col4, #T_8ad61_row55_col5, #T_8ad61_row56_col0, #T_8ad61_row56_col1, #T_8ad61_row56_col2, #T_8ad61_row56_col3, #T_8ad61_row56_col4, #T_8ad61_row56_col5, #T_8ad61_row57_col0, #T_8ad61_row57_col1, #T_8ad61_row57_col2, #T_8ad61_row57_col3, #T_8ad61_row57_col4, #T_8ad61_row57_col5, #T_8ad61_row58_col0, #T_8ad61_row58_col1, #T_8ad61_row58_col2, #T_8ad61_row58_col3, #T_8ad61_row58_col4, #T_8ad61_row58_col5, #T_8ad61_row59_col0, #T_8ad61_row59_col1, #T_8ad61_row59_col2, #T_8ad61_row59_col3, #T_8ad61_row59_col4, #T_8ad61_row59_col5, #T_8ad61_row60_col0, #T_8ad61_row60_col1, #T_8ad61_row60_col2, #T_8ad61_row60_col3, #T_8ad61_row60_col4, #T_8ad61_row60_col5, #T_8ad61_row61_col0, #T_8ad61_row61_col1, #T_8ad61_row61_col2, #T_8ad61_row61_col3, #T_8ad61_row61_col4, #T_8ad61_row61_col5, #T_8ad61_row62_col0, #T_8ad61_row62_col1, #T_8ad61_row62_col2, #T_8ad61_row62_col3, #T_8ad61_row62_col4, #T_8ad61_row62_col5, #T_8ad61_row63_col0, #T_8ad61_row63_col1, #T_8ad61_row63_col2, #T_8ad61_row63_col3, #T_8ad61_row63_col4, #T_8ad61_row63_col5, #T_8ad61_row64_col0, #T_8ad61_row64_col1, #T_8ad61_row64_col2, #T_8ad61_row64_col3, #T_8ad61_row64_col4, #T_8ad61_row64_col5, #T_8ad61_row65_col0, #T_8ad61_row65_col1, #T_8ad61_row65_col2, #T_8ad61_row65_col3, #T_8ad61_row65_col4, #T_8ad61_row65_col5, #T_8ad61_row66_col0, #T_8ad61_row66_col1, #T_8ad61_row66_col2, #T_8ad61_row66_col3, #T_8ad61_row66_col4, #T_8ad61_row66_col5, #T_8ad61_row67_col0, #T_8ad61_row67_col1, #T_8ad61_row67_col2, #T_8ad61_row67_col3, #T_8ad61_row67_col4, #T_8ad61_row67_col5, #T_8ad61_row68_col0, #T_8ad61_row68_col1, #T_8ad61_row68_col2, #T_8ad61_row68_col3, #T_8ad61_row68_col4, #T_8ad61_row68_col5, #T_8ad61_row69_col0, #T_8ad61_row69_col1, #T_8ad61_row69_col2, #T_8ad61_row69_col3, #T_8ad61_row69_col4, #T_8ad61_row69_col5, #T_8ad61_row70_col0, #T_8ad61_row70_col1, #T_8ad61_row70_col2, #T_8ad61_row70_col3, #T_8ad61_row70_col4, #T_8ad61_row70_col5, #T_8ad61_row71_col0, #T_8ad61_row71_col1, #T_8ad61_row71_col2, #T_8ad61_row71_col3, #T_8ad61_row71_col4, #T_8ad61_row71_col5, #T_8ad61_row72_col0, #T_8ad61_row72_col1, #T_8ad61_row72_col2, #T_8ad61_row72_col3, #T_8ad61_row72_col4, #T_8ad61_row72_col5, #T_8ad61_row73_col0, #T_8ad61_row73_col1, #T_8ad61_row73_col2, #T_8ad61_row73_col3, #T_8ad61_row73_col4, #T_8ad61_row73_col5 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_8ad61\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_8ad61_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_8ad61_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_8ad61_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_8ad61_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_8ad61_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_8ad61_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row0\" class=\"row_heading level0 row0\" >T1562.001</th>\n",
       "      <td id=\"T_8ad61_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row0_col5\" class=\"data row0 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row1\" class=\"row_heading level0 row1\" >T1036</th>\n",
       "      <td id=\"T_8ad61_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row1_col5\" class=\"data row1 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row2\" class=\"row_heading level0 row2\" >T1566</th>\n",
       "      <td id=\"T_8ad61_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row2_col5\" class=\"data row2 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row3\" class=\"row_heading level0 row3\" >T1566.001</th>\n",
       "      <td id=\"T_8ad61_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row3_col5\" class=\"data row3 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row4\" class=\"row_heading level0 row4\" >T1562</th>\n",
       "      <td id=\"T_8ad61_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row4_col5\" class=\"data row4 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row5\" class=\"row_heading level0 row5\" >T1543</th>\n",
       "      <td id=\"T_8ad61_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row5_col5\" class=\"data row5 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row6\" class=\"row_heading level0 row6\" >T1059</th>\n",
       "      <td id=\"T_8ad61_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row6_col5\" class=\"data row6 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row7\" class=\"row_heading level0 row7\" >T1053.005</th>\n",
       "      <td id=\"T_8ad61_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row7_col2\" class=\"data row7 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row7_col3\" class=\"data row7 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row7_col4\" class=\"data row7 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row7_col5\" class=\"data row7 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row8\" class=\"row_heading level0 row8\" >T1204.001</th>\n",
       "      <td id=\"T_8ad61_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row8_col5\" class=\"data row8 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row9\" class=\"row_heading level0 row9\" >T1204</th>\n",
       "      <td id=\"T_8ad61_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row9_col4\" class=\"data row9 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row9_col5\" class=\"data row9 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row10\" class=\"row_heading level0 row10\" >T1053</th>\n",
       "      <td id=\"T_8ad61_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row10_col2\" class=\"data row10 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row10_col5\" class=\"data row10 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row11\" class=\"row_heading level0 row11\" >T1218</th>\n",
       "      <td id=\"T_8ad61_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row11_col1\" class=\"data row11 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row11_col3\" class=\"data row11 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row11_col4\" class=\"data row11 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row11_col5\" class=\"data row11 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row12\" class=\"row_heading level0 row12\" >T1543.003</th>\n",
       "      <td id=\"T_8ad61_row12_col0\" class=\"data row12 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row12_col2\" class=\"data row12 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row12_col3\" class=\"data row12 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row12_col4\" class=\"data row12 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row12_col5\" class=\"data row12 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row13\" class=\"row_heading level0 row13\" >T1548.002</th>\n",
       "      <td id=\"T_8ad61_row13_col0\" class=\"data row13 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row13_col1\" class=\"data row13 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row13_col2\" class=\"data row13 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row13_col3\" class=\"data row13 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row13_col4\" class=\"data row13 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row13_col5\" class=\"data row13 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row14\" class=\"row_heading level0 row14\" >T1059.001</th>\n",
       "      <td id=\"T_8ad61_row14_col0\" class=\"data row14 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row14_col2\" class=\"data row14 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row14_col3\" class=\"data row14 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row14_col4\" class=\"data row14 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row14_col5\" class=\"data row14 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row15\" class=\"row_heading level0 row15\" >T1548</th>\n",
       "      <td id=\"T_8ad61_row15_col0\" class=\"data row15 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row15_col3\" class=\"data row15 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row15_col4\" class=\"data row15 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row15_col5\" class=\"data row15 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row16\" class=\"row_heading level0 row16\" >T1555</th>\n",
       "      <td id=\"T_8ad61_row16_col0\" class=\"data row16 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row16_col1\" class=\"data row16 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row16_col3\" class=\"data row16 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row16_col4\" class=\"data row16 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row16_col5\" class=\"data row16 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row17\" class=\"row_heading level0 row17\" >T1547.001</th>\n",
       "      <td id=\"T_8ad61_row17_col0\" class=\"data row17 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row17_col2\" class=\"data row17 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row17_col3\" class=\"data row17 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row17_col4\" class=\"data row17 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row17_col5\" class=\"data row17 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row18\" class=\"row_heading level0 row18\" >T1555.003</th>\n",
       "      <td id=\"T_8ad61_row18_col0\" class=\"data row18 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row18_col2\" class=\"data row18 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row18_col3\" class=\"data row18 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row18_col4\" class=\"data row18 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row18_col5\" class=\"data row18 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row19\" class=\"row_heading level0 row19\" >T1112</th>\n",
       "      <td id=\"T_8ad61_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row19_col2\" class=\"data row19 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row19_col3\" class=\"data row19 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row19_col4\" class=\"data row19 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row19_col5\" class=\"data row19 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row20\" class=\"row_heading level0 row20\" >T1071</th>\n",
       "      <td id=\"T_8ad61_row20_col0\" class=\"data row20 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row20_col2\" class=\"data row20 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row20_col3\" class=\"data row20 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row20_col4\" class=\"data row20 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row20_col5\" class=\"data row20 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row21\" class=\"row_heading level0 row21\" >T1547</th>\n",
       "      <td id=\"T_8ad61_row21_col0\" class=\"data row21 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row21_col2\" class=\"data row21 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row21_col3\" class=\"data row21 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row21_col4\" class=\"data row21 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row21_col5\" class=\"data row21 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row22\" class=\"row_heading level0 row22\" >T1055</th>\n",
       "      <td id=\"T_8ad61_row22_col0\" class=\"data row22 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row22_col1\" class=\"data row22 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row22_col2\" class=\"data row22 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row22_col3\" class=\"data row22 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row22_col4\" class=\"data row22 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row22_col5\" class=\"data row22 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row23\" class=\"row_heading level0 row23\" >T1049</th>\n",
       "      <td id=\"T_8ad61_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row23_col1\" class=\"data row23 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row23_col2\" class=\"data row23 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row23_col3\" class=\"data row23 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row23_col4\" class=\"data row23 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row23_col5\" class=\"data row23 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row24\" class=\"row_heading level0 row24\" >T1592</th>\n",
       "      <td id=\"T_8ad61_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row24_col1\" class=\"data row24 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row24_col2\" class=\"data row24 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row24_col3\" class=\"data row24 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row24_col4\" class=\"data row24 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row24_col5\" class=\"data row24 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row25\" class=\"row_heading level0 row25\" >T1021</th>\n",
       "      <td id=\"T_8ad61_row25_col0\" class=\"data row25 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row25_col1\" class=\"data row25 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row25_col2\" class=\"data row25 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row25_col3\" class=\"data row25 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row25_col4\" class=\"data row25 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row25_col5\" class=\"data row25 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row26\" class=\"row_heading level0 row26\" >T1027</th>\n",
       "      <td id=\"T_8ad61_row26_col0\" class=\"data row26 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row26_col1\" class=\"data row26 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row26_col2\" class=\"data row26 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row26_col3\" class=\"data row26 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row26_col4\" class=\"data row26 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row26_col5\" class=\"data row26 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row27\" class=\"row_heading level0 row27\" >T1055.001</th>\n",
       "      <td id=\"T_8ad61_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row27_col1\" class=\"data row27 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row27_col2\" class=\"data row27 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row27_col3\" class=\"data row27 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row27_col4\" class=\"data row27 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row27_col5\" class=\"data row27 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row28\" class=\"row_heading level0 row28\" >T1590</th>\n",
       "      <td id=\"T_8ad61_row28_col0\" class=\"data row28 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row28_col2\" class=\"data row28 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row28_col3\" class=\"data row28 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row28_col4\" class=\"data row28 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row28_col5\" class=\"data row28 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row29\" class=\"row_heading level0 row29\" >T1059.003</th>\n",
       "      <td id=\"T_8ad61_row29_col0\" class=\"data row29 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row29_col1\" class=\"data row29 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row29_col2\" class=\"data row29 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row29_col3\" class=\"data row29 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row29_col4\" class=\"data row29 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row29_col5\" class=\"data row29 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row30\" class=\"row_heading level0 row30\" >T1218.010</th>\n",
       "      <td id=\"T_8ad61_row30_col0\" class=\"data row30 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row30_col1\" class=\"data row30 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row30_col2\" class=\"data row30 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row30_col3\" class=\"data row30 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row30_col4\" class=\"data row30 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row30_col5\" class=\"data row30 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row31\" class=\"row_heading level0 row31\" >T1590.005</th>\n",
       "      <td id=\"T_8ad61_row31_col0\" class=\"data row31 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row31_col1\" class=\"data row31 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row31_col2\" class=\"data row31 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row31_col3\" class=\"data row31 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row31_col4\" class=\"data row31 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row31_col5\" class=\"data row31 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row32\" class=\"row_heading level0 row32\" >T1059.007</th>\n",
       "      <td id=\"T_8ad61_row32_col0\" class=\"data row32 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row32_col1\" class=\"data row32 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row32_col2\" class=\"data row32 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row32_col3\" class=\"data row32 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row32_col4\" class=\"data row32 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row32_col5\" class=\"data row32 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row33\" class=\"row_heading level0 row33\" >T1569</th>\n",
       "      <td id=\"T_8ad61_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row33_col1\" class=\"data row33 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row33_col2\" class=\"data row33 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row33_col3\" class=\"data row33 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row33_col4\" class=\"data row33 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row33_col5\" class=\"data row33 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row34\" class=\"row_heading level0 row34\" >T1569.002</th>\n",
       "      <td id=\"T_8ad61_row34_col0\" class=\"data row34 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row34_col2\" class=\"data row34 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row34_col3\" class=\"data row34 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row34_col4\" class=\"data row34 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row34_col5\" class=\"data row34 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row35\" class=\"row_heading level0 row35\" >T1087.002</th>\n",
       "      <td id=\"T_8ad61_row35_col0\" class=\"data row35 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row35_col1\" class=\"data row35 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row35_col2\" class=\"data row35 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row35_col3\" class=\"data row35 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row35_col4\" class=\"data row35 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row35_col5\" class=\"data row35 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row36\" class=\"row_heading level0 row36\" >T1087</th>\n",
       "      <td id=\"T_8ad61_row36_col0\" class=\"data row36 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row36_col1\" class=\"data row36 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row36_col2\" class=\"data row36 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row36_col3\" class=\"data row36 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row36_col4\" class=\"data row36 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row36_col5\" class=\"data row36 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row37\" class=\"row_heading level0 row37\" >T1218.011</th>\n",
       "      <td id=\"T_8ad61_row37_col0\" class=\"data row37 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row37_col1\" class=\"data row37 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row37_col2\" class=\"data row37 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row37_col3\" class=\"data row37 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row37_col4\" class=\"data row37 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row37_col5\" class=\"data row37 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row38\" class=\"row_heading level0 row38\" >T1218.001</th>\n",
       "      <td id=\"T_8ad61_row38_col0\" class=\"data row38 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row38_col1\" class=\"data row38 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row38_col2\" class=\"data row38 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row38_col3\" class=\"data row38 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row38_col4\" class=\"data row38 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row38_col5\" class=\"data row38 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row39\" class=\"row_heading level0 row39\" >T1021.002</th>\n",
       "      <td id=\"T_8ad61_row39_col0\" class=\"data row39 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row39_col1\" class=\"data row39 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row39_col2\" class=\"data row39 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row39_col3\" class=\"data row39 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row39_col4\" class=\"data row39 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row39_col5\" class=\"data row39 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row40\" class=\"row_heading level0 row40\" >T1564.001</th>\n",
       "      <td id=\"T_8ad61_row40_col0\" class=\"data row40 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row40_col1\" class=\"data row40 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row40_col2\" class=\"data row40 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row40_col3\" class=\"data row40 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row40_col4\" class=\"data row40 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row40_col5\" class=\"data row40 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row41\" class=\"row_heading level0 row41\" >T1482</th>\n",
       "      <td id=\"T_8ad61_row41_col0\" class=\"data row41 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row41_col1\" class=\"data row41 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row41_col2\" class=\"data row41 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row41_col3\" class=\"data row41 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row41_col4\" class=\"data row41 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row41_col5\" class=\"data row41 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row42\" class=\"row_heading level0 row42\" >T1564</th>\n",
       "      <td id=\"T_8ad61_row42_col0\" class=\"data row42 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row42_col1\" class=\"data row42 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row42_col2\" class=\"data row42 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row42_col3\" class=\"data row42 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row42_col4\" class=\"data row42 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row42_col5\" class=\"data row42 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row43\" class=\"row_heading level0 row43\" >T1559.001</th>\n",
       "      <td id=\"T_8ad61_row43_col0\" class=\"data row43 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row43_col1\" class=\"data row43 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row43_col2\" class=\"data row43 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row43_col3\" class=\"data row43 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row43_col4\" class=\"data row43 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row43_col5\" class=\"data row43 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row44\" class=\"row_heading level0 row44\" >T1566.002</th>\n",
       "      <td id=\"T_8ad61_row44_col0\" class=\"data row44 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row44_col1\" class=\"data row44 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row44_col2\" class=\"data row44 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row44_col3\" class=\"data row44 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row44_col4\" class=\"data row44 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row44_col5\" class=\"data row44 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row45\" class=\"row_heading level0 row45\" >T1222.001</th>\n",
       "      <td id=\"T_8ad61_row45_col0\" class=\"data row45 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row45_col1\" class=\"data row45 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row45_col2\" class=\"data row45 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row45_col3\" class=\"data row45 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row45_col4\" class=\"data row45 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row45_col5\" class=\"data row45 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row46\" class=\"row_heading level0 row46\" >T1134.004</th>\n",
       "      <td id=\"T_8ad61_row46_col0\" class=\"data row46 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row46_col1\" class=\"data row46 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row46_col2\" class=\"data row46 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row46_col3\" class=\"data row46 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row46_col4\" class=\"data row46 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row46_col5\" class=\"data row46 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row47\" class=\"row_heading level0 row47\" >T1134</th>\n",
       "      <td id=\"T_8ad61_row47_col0\" class=\"data row47 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row47_col1\" class=\"data row47 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row47_col2\" class=\"data row47 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row47_col3\" class=\"data row47 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row47_col4\" class=\"data row47 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row47_col5\" class=\"data row47 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row48\" class=\"row_heading level0 row48\" >T1574.001</th>\n",
       "      <td id=\"T_8ad61_row48_col0\" class=\"data row48 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row48_col1\" class=\"data row48 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row48_col2\" class=\"data row48 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row48_col3\" class=\"data row48 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row48_col4\" class=\"data row48 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row48_col5\" class=\"data row48 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row49\" class=\"row_heading level0 row49\" >T1069</th>\n",
       "      <td id=\"T_8ad61_row49_col0\" class=\"data row49 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row49_col1\" class=\"data row49 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row49_col2\" class=\"data row49 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row49_col3\" class=\"data row49 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row49_col4\" class=\"data row49 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row49_col5\" class=\"data row49 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row50\" class=\"row_heading level0 row50\" >T1069.001</th>\n",
       "      <td id=\"T_8ad61_row50_col0\" class=\"data row50 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row50_col1\" class=\"data row50 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row50_col2\" class=\"data row50 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row50_col3\" class=\"data row50 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row50_col4\" class=\"data row50 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row50_col5\" class=\"data row50 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row51\" class=\"row_heading level0 row51\" >T1059.005</th>\n",
       "      <td id=\"T_8ad61_row51_col0\" class=\"data row51 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row51_col1\" class=\"data row51 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row51_col2\" class=\"data row51 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row51_col3\" class=\"data row51 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row51_col4\" class=\"data row51 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row51_col5\" class=\"data row51 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row52\" class=\"row_heading level0 row52\" >T1021.001</th>\n",
       "      <td id=\"T_8ad61_row52_col0\" class=\"data row52 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row52_col1\" class=\"data row52 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row52_col2\" class=\"data row52 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row52_col3\" class=\"data row52 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row52_col4\" class=\"data row52 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row52_col5\" class=\"data row52 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row53\" class=\"row_heading level0 row53\" >T1531</th>\n",
       "      <td id=\"T_8ad61_row53_col0\" class=\"data row53 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row53_col1\" class=\"data row53 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row53_col2\" class=\"data row53 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row53_col3\" class=\"data row53 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row53_col4\" class=\"data row53 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row53_col5\" class=\"data row53 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row54\" class=\"row_heading level0 row54\" >T1036.003</th>\n",
       "      <td id=\"T_8ad61_row54_col0\" class=\"data row54 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row54_col1\" class=\"data row54 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row54_col2\" class=\"data row54 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row54_col3\" class=\"data row54 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row54_col4\" class=\"data row54 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row54_col5\" class=\"data row54 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row55\" class=\"row_heading level0 row55\" >T1489</th>\n",
       "      <td id=\"T_8ad61_row55_col0\" class=\"data row55 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row55_col2\" class=\"data row55 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row55_col3\" class=\"data row55 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row55_col4\" class=\"data row55 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row55_col5\" class=\"data row55 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row56\" class=\"row_heading level0 row56\" >T1222</th>\n",
       "      <td id=\"T_8ad61_row56_col0\" class=\"data row56 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row56_col2\" class=\"data row56 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row56_col3\" class=\"data row56 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row56_col4\" class=\"data row56 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row56_col5\" class=\"data row56 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row57\" class=\"row_heading level0 row57\" >T1562.004</th>\n",
       "      <td id=\"T_8ad61_row57_col0\" class=\"data row57 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row57_col1\" class=\"data row57 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row57_col2\" class=\"data row57 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row57_col3\" class=\"data row57 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row57_col4\" class=\"data row57 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row57_col5\" class=\"data row57 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row58\" class=\"row_heading level0 row58\" >T1047</th>\n",
       "      <td id=\"T_8ad61_row58_col0\" class=\"data row58 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row58_col1\" class=\"data row58 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row58_col2\" class=\"data row58 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row58_col3\" class=\"data row58 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row58_col4\" class=\"data row58 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row58_col5\" class=\"data row58 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row59\" class=\"row_heading level0 row59\" >T1574.002</th>\n",
       "      <td id=\"T_8ad61_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row59_col1\" class=\"data row59 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row59_col2\" class=\"data row59 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row59_col3\" class=\"data row59 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row59_col4\" class=\"data row59 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row59_col5\" class=\"data row59 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row60\" class=\"row_heading level0 row60\" >T1574</th>\n",
       "      <td id=\"T_8ad61_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row60_col1\" class=\"data row60 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row60_col2\" class=\"data row60 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row60_col3\" class=\"data row60 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row60_col4\" class=\"data row60 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row60_col5\" class=\"data row60 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row61\" class=\"row_heading level0 row61\" >T1113</th>\n",
       "      <td id=\"T_8ad61_row61_col0\" class=\"data row61 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row61_col1\" class=\"data row61 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row61_col2\" class=\"data row61 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row61_col3\" class=\"data row61 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row61_col4\" class=\"data row61 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row61_col5\" class=\"data row61 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row62\" class=\"row_heading level0 row62\" >T1016</th>\n",
       "      <td id=\"T_8ad61_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row62_col1\" class=\"data row62 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row62_col2\" class=\"data row62 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row62_col3\" class=\"data row62 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row62_col4\" class=\"data row62 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row62_col5\" class=\"data row62 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row63\" class=\"row_heading level0 row63\" >T1033</th>\n",
       "      <td id=\"T_8ad61_row63_col0\" class=\"data row63 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row63_col1\" class=\"data row63 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row63_col2\" class=\"data row63 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row63_col3\" class=\"data row63 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row63_col4\" class=\"data row63 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row63_col5\" class=\"data row63 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row64\" class=\"row_heading level0 row64\" >T1218.005</th>\n",
       "      <td id=\"T_8ad61_row64_col0\" class=\"data row64 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row64_col1\" class=\"data row64 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row64_col2\" class=\"data row64 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row64_col3\" class=\"data row64 col3\" >yes</td>\n",
       "      <td id=\"T_8ad61_row64_col4\" class=\"data row64 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row64_col5\" class=\"data row64 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row65\" class=\"row_heading level0 row65\" >T1014</th>\n",
       "      <td id=\"T_8ad61_row65_col0\" class=\"data row65 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row65_col1\" class=\"data row65 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row65_col2\" class=\"data row65 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row65_col3\" class=\"data row65 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row65_col4\" class=\"data row65 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row65_col5\" class=\"data row65 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row66\" class=\"row_heading level0 row66\" >T1068</th>\n",
       "      <td id=\"T_8ad61_row66_col0\" class=\"data row66 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row66_col1\" class=\"data row66 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row66_col2\" class=\"data row66 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row66_col3\" class=\"data row66 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row66_col4\" class=\"data row66 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row66_col5\" class=\"data row66 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row67\" class=\"row_heading level0 row67\" >T1219</th>\n",
       "      <td id=\"T_8ad61_row67_col0\" class=\"data row67 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row67_col1\" class=\"data row67 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row67_col2\" class=\"data row67 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row67_col3\" class=\"data row67 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row67_col4\" class=\"data row67 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row67_col5\" class=\"data row67 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row68\" class=\"row_heading level0 row68\" >T1055.002</th>\n",
       "      <td id=\"T_8ad61_row68_col0\" class=\"data row68 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row68_col1\" class=\"data row68 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row68_col2\" class=\"data row68 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row68_col3\" class=\"data row68 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row68_col4\" class=\"data row68 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row68_col5\" class=\"data row68 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row69\" class=\"row_heading level0 row69\" >T1136.001</th>\n",
       "      <td id=\"T_8ad61_row69_col0\" class=\"data row69 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row69_col1\" class=\"data row69 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row69_col2\" class=\"data row69 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row69_col3\" class=\"data row69 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row69_col4\" class=\"data row69 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row69_col5\" class=\"data row69 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row70\" class=\"row_heading level0 row70\" >T1136</th>\n",
       "      <td id=\"T_8ad61_row70_col0\" class=\"data row70 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row70_col1\" class=\"data row70 col1\" >yes</td>\n",
       "      <td id=\"T_8ad61_row70_col2\" class=\"data row70 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row70_col3\" class=\"data row70 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row70_col4\" class=\"data row70 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row70_col5\" class=\"data row70 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row71\" class=\"row_heading level0 row71\" >T1070</th>\n",
       "      <td id=\"T_8ad61_row71_col0\" class=\"data row71 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row71_col1\" class=\"data row71 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row71_col2\" class=\"data row71 col2\" >yes</td>\n",
       "      <td id=\"T_8ad61_row71_col3\" class=\"data row71 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row71_col4\" class=\"data row71 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row71_col5\" class=\"data row71 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row72\" class=\"row_heading level0 row72\" >T1071.003</th>\n",
       "      <td id=\"T_8ad61_row72_col0\" class=\"data row72 col0\" >no</td>\n",
       "      <td id=\"T_8ad61_row72_col1\" class=\"data row72 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row72_col2\" class=\"data row72 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row72_col3\" class=\"data row72 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row72_col4\" class=\"data row72 col4\" >yes</td>\n",
       "      <td id=\"T_8ad61_row72_col5\" class=\"data row72 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_8ad61_level0_row73\" class=\"row_heading level0 row73\" >T1016.001</th>\n",
       "      <td id=\"T_8ad61_row73_col0\" class=\"data row73 col0\" >yes</td>\n",
       "      <td id=\"T_8ad61_row73_col1\" class=\"data row73 col1\" >no</td>\n",
       "      <td id=\"T_8ad61_row73_col2\" class=\"data row73 col2\" >no</td>\n",
       "      <td id=\"T_8ad61_row73_col3\" class=\"data row73 col3\" >no</td>\n",
       "      <td id=\"T_8ad61_row73_col4\" class=\"data row73 col4\" >no</td>\n",
       "      <td id=\"T_8ad61_row73_col5\" class=\"data row73 col5\" >1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c1f3e80>"
      ]
     },
     "execution_count": 41,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "new_table = yes_no_table(mitre_attack_tid_dict, story_name_list)\n",
    "tdf = pd.DataFrame.from_dict(new_table, orient=\"index\")\n",
    "tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n",
    "print(tdf.shape)\n",
    "tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n",
    "tdf.style.apply(highlight_rows, axis=1) \n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "id": "2f2a22c4-4204-4673-8130-9fa9a99cfa12",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(7, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_30260_row0_col0, #T_30260_row0_col1, #T_30260_row0_col2, #T_30260_row0_col3, #T_30260_row0_col4, #T_30260_row0_col5, #T_30260_row1_col0, #T_30260_row1_col1, #T_30260_row1_col2, #T_30260_row1_col3, #T_30260_row1_col4, #T_30260_row1_col5, #T_30260_row2_col0, #T_30260_row2_col1, #T_30260_row2_col2, #T_30260_row2_col3, #T_30260_row2_col4, #T_30260_row2_col5, #T_30260_row3_col0, #T_30260_row3_col1, #T_30260_row3_col2, #T_30260_row3_col3, #T_30260_row3_col4, #T_30260_row3_col5, #T_30260_row4_col0, #T_30260_row4_col1, #T_30260_row4_col2, #T_30260_row4_col3, #T_30260_row4_col4, #T_30260_row4_col5, #T_30260_row5_col0, #T_30260_row5_col1, #T_30260_row5_col2, #T_30260_row5_col3, #T_30260_row5_col4, #T_30260_row5_col5, #T_30260_row6_col0, #T_30260_row6_col1, #T_30260_row6_col2, #T_30260_row6_col3, #T_30260_row6_col4, #T_30260_row6_col5 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_30260\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_30260_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_30260_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_30260_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_30260_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_30260_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_30260_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_30260_level0_row0\" class=\"row_heading level0 row0\" >T1562.001</th>\n",
       "      <td id=\"T_30260_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_30260_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_30260_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_30260_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_30260_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_30260_row0_col5\" class=\"data row0 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_30260_level0_row1\" class=\"row_heading level0 row1\" >T1036</th>\n",
       "      <td id=\"T_30260_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_30260_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_30260_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_30260_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_30260_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_30260_row1_col5\" class=\"data row1 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_30260_level0_row2\" class=\"row_heading level0 row2\" >T1566</th>\n",
       "      <td id=\"T_30260_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_30260_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_30260_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_30260_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_30260_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_30260_row2_col5\" class=\"data row2 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_30260_level0_row3\" class=\"row_heading level0 row3\" >T1566.001</th>\n",
       "      <td id=\"T_30260_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_30260_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_30260_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_30260_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_30260_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_30260_row3_col5\" class=\"data row3 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_30260_level0_row4\" class=\"row_heading level0 row4\" >T1562</th>\n",
       "      <td id=\"T_30260_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_30260_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_30260_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_30260_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_30260_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_30260_row4_col5\" class=\"data row4 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_30260_level0_row5\" class=\"row_heading level0 row5\" >T1543</th>\n",
       "      <td id=\"T_30260_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_30260_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_30260_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
       "      <td id=\"T_30260_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
       "      <td id=\"T_30260_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
       "      <td id=\"T_30260_row5_col5\" class=\"data row5 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_30260_level0_row6\" class=\"row_heading level0 row6\" >T1059</th>\n",
       "      <td id=\"T_30260_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_30260_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_30260_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
       "      <td id=\"T_30260_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
       "      <td id=\"T_30260_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_30260_row6_col5\" class=\"data row6 col5\" >5</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c220d60>"
      ]
     },
     "execution_count": 42,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 5]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "id": "e8d0e149-6e69-4a04-be98-51bac29a15af",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(5, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_d3547_row0_col0, #T_d3547_row0_col1, #T_d3547_row0_col2, #T_d3547_row0_col3, #T_d3547_row0_col4, #T_d3547_row0_col5, #T_d3547_row1_col0, #T_d3547_row1_col1, #T_d3547_row1_col2, #T_d3547_row1_col3, #T_d3547_row1_col4, #T_d3547_row1_col5, #T_d3547_row2_col0, #T_d3547_row2_col1, #T_d3547_row2_col2, #T_d3547_row2_col3, #T_d3547_row2_col4, #T_d3547_row2_col5, #T_d3547_row3_col0, #T_d3547_row3_col1, #T_d3547_row3_col2, #T_d3547_row3_col3, #T_d3547_row3_col4, #T_d3547_row3_col5, #T_d3547_row4_col0, #T_d3547_row4_col1, #T_d3547_row4_col2, #T_d3547_row4_col3, #T_d3547_row4_col4, #T_d3547_row4_col5 {\n",
       "  background-color: orange;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_d3547\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_d3547_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_d3547_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_d3547_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_d3547_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_d3547_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_d3547_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_d3547_level0_row0\" class=\"row_heading level0 row0\" >T1053.005</th>\n",
       "      <td id=\"T_d3547_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_d3547_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_d3547_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_d3547_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_d3547_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_d3547_row0_col5\" class=\"data row0 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_d3547_level0_row1\" class=\"row_heading level0 row1\" >T1204.001</th>\n",
       "      <td id=\"T_d3547_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_d3547_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_d3547_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_d3547_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_d3547_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_d3547_row1_col5\" class=\"data row1 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_d3547_level0_row2\" class=\"row_heading level0 row2\" >T1204</th>\n",
       "      <td id=\"T_d3547_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_d3547_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_d3547_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_d3547_row2_col3\" class=\"data row2 col3\" >no</td>\n",
       "      <td id=\"T_d3547_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_d3547_row2_col5\" class=\"data row2 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_d3547_level0_row3\" class=\"row_heading level0 row3\" >T1053</th>\n",
       "      <td id=\"T_d3547_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_d3547_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_d3547_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_d3547_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_d3547_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_d3547_row3_col5\" class=\"data row3 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_d3547_level0_row4\" class=\"row_heading level0 row4\" >T1218</th>\n",
       "      <td id=\"T_d3547_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_d3547_row4_col1\" class=\"data row4 col1\" >no</td>\n",
       "      <td id=\"T_d3547_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_d3547_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_d3547_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_d3547_row4_col5\" class=\"data row4 col5\" >4</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c21a940>"
      ]
     },
     "execution_count": 43,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 4]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "id": "9e5fa653-ce25-4616-8962-8350e858a6af",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(11, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_13364_row0_col0, #T_13364_row0_col1, #T_13364_row0_col2, #T_13364_row0_col3, #T_13364_row0_col4, #T_13364_row0_col5, #T_13364_row1_col0, #T_13364_row1_col1, #T_13364_row1_col2, #T_13364_row1_col3, #T_13364_row1_col4, #T_13364_row1_col5, #T_13364_row2_col0, #T_13364_row2_col1, #T_13364_row2_col2, #T_13364_row2_col3, #T_13364_row2_col4, #T_13364_row2_col5, #T_13364_row3_col0, #T_13364_row3_col1, #T_13364_row3_col2, #T_13364_row3_col3, #T_13364_row3_col4, #T_13364_row3_col5, #T_13364_row4_col0, #T_13364_row4_col1, #T_13364_row4_col2, #T_13364_row4_col3, #T_13364_row4_col4, #T_13364_row4_col5, #T_13364_row5_col0, #T_13364_row5_col1, #T_13364_row5_col2, #T_13364_row5_col3, #T_13364_row5_col4, #T_13364_row5_col5, #T_13364_row6_col0, #T_13364_row6_col1, #T_13364_row6_col2, #T_13364_row6_col3, #T_13364_row6_col4, #T_13364_row6_col5, #T_13364_row7_col0, #T_13364_row7_col1, #T_13364_row7_col2, #T_13364_row7_col3, #T_13364_row7_col4, #T_13364_row7_col5, #T_13364_row8_col0, #T_13364_row8_col1, #T_13364_row8_col2, #T_13364_row8_col3, #T_13364_row8_col4, #T_13364_row8_col5, #T_13364_row9_col0, #T_13364_row9_col1, #T_13364_row9_col2, #T_13364_row9_col3, #T_13364_row9_col4, #T_13364_row9_col5, #T_13364_row10_col0, #T_13364_row10_col1, #T_13364_row10_col2, #T_13364_row10_col3, #T_13364_row10_col4, #T_13364_row10_col5 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_13364\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_13364_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_13364_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_13364_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_13364_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_13364_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_13364_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row0\" class=\"row_heading level0 row0\" >T1543.003</th>\n",
       "      <td id=\"T_13364_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_13364_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_13364_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_13364_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_13364_row0_col5\" class=\"data row0 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row1\" class=\"row_heading level0 row1\" >T1548.002</th>\n",
       "      <td id=\"T_13364_row1_col0\" class=\"data row1 col0\" >no</td>\n",
       "      <td id=\"T_13364_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_13364_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_13364_row1_col5\" class=\"data row1 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row2\" class=\"row_heading level0 row2\" >T1059.001</th>\n",
       "      <td id=\"T_13364_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_13364_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_13364_row2_col3\" class=\"data row2 col3\" >no</td>\n",
       "      <td id=\"T_13364_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_13364_row2_col5\" class=\"data row2 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row3\" class=\"row_heading level0 row3\" >T1548</th>\n",
       "      <td id=\"T_13364_row3_col0\" class=\"data row3 col0\" >no</td>\n",
       "      <td id=\"T_13364_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row3_col3\" class=\"data row3 col3\" >no</td>\n",
       "      <td id=\"T_13364_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_13364_row3_col5\" class=\"data row3 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row4\" class=\"row_heading level0 row4\" >T1555</th>\n",
       "      <td id=\"T_13364_row4_col0\" class=\"data row4 col0\" >no</td>\n",
       "      <td id=\"T_13364_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row4_col3\" class=\"data row4 col3\" >no</td>\n",
       "      <td id=\"T_13364_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_13364_row4_col5\" class=\"data row4 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row5\" class=\"row_heading level0 row5\" >T1547.001</th>\n",
       "      <td id=\"T_13364_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_13364_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row5_col3\" class=\"data row5 col3\" >no</td>\n",
       "      <td id=\"T_13364_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_13364_row5_col5\" class=\"data row5 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row6\" class=\"row_heading level0 row6\" >T1555.003</th>\n",
       "      <td id=\"T_13364_row6_col0\" class=\"data row6 col0\" >no</td>\n",
       "      <td id=\"T_13364_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row6_col3\" class=\"data row6 col3\" >no</td>\n",
       "      <td id=\"T_13364_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_13364_row6_col5\" class=\"data row6 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row7\" class=\"row_heading level0 row7\" >T1112</th>\n",
       "      <td id=\"T_13364_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
       "      <td id=\"T_13364_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_13364_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_13364_row7_col5\" class=\"data row7 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row8\" class=\"row_heading level0 row8\" >T1071</th>\n",
       "      <td id=\"T_13364_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
       "      <td id=\"T_13364_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row8_col2\" class=\"data row8 col2\" >no</td>\n",
       "      <td id=\"T_13364_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_13364_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
       "      <td id=\"T_13364_row8_col5\" class=\"data row8 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row9\" class=\"row_heading level0 row9\" >T1547</th>\n",
       "      <td id=\"T_13364_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_13364_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
       "      <td id=\"T_13364_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_13364_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_13364_row9_col5\" class=\"data row9 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_13364_level0_row10\" class=\"row_heading level0 row10\" >T1055</th>\n",
       "      <td id=\"T_13364_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
       "      <td id=\"T_13364_row10_col1\" class=\"data row10 col1\" >no</td>\n",
       "      <td id=\"T_13364_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
       "      <td id=\"T_13364_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
       "      <td id=\"T_13364_row10_col4\" class=\"data row10 col4\" >no</td>\n",
       "      <td id=\"T_13364_row10_col5\" class=\"data row10 col5\" >3</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c220880>"
      ]
     },
     "execution_count": 44,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 3]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "id": "56b64501-cc50-4d5b-849b-2a0f917de6d0",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(12, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_7058b_row0_col0, #T_7058b_row0_col1, #T_7058b_row0_col2, #T_7058b_row0_col3, #T_7058b_row0_col4, #T_7058b_row0_col5, #T_7058b_row1_col0, #T_7058b_row1_col1, #T_7058b_row1_col2, #T_7058b_row1_col3, #T_7058b_row1_col4, #T_7058b_row1_col5, #T_7058b_row2_col0, #T_7058b_row2_col1, #T_7058b_row2_col2, #T_7058b_row2_col3, #T_7058b_row2_col4, #T_7058b_row2_col5, #T_7058b_row3_col0, #T_7058b_row3_col1, #T_7058b_row3_col2, #T_7058b_row3_col3, #T_7058b_row3_col4, #T_7058b_row3_col5, #T_7058b_row4_col0, #T_7058b_row4_col1, #T_7058b_row4_col2, #T_7058b_row4_col3, #T_7058b_row4_col4, #T_7058b_row4_col5, #T_7058b_row5_col0, #T_7058b_row5_col1, #T_7058b_row5_col2, #T_7058b_row5_col3, #T_7058b_row5_col4, #T_7058b_row5_col5, #T_7058b_row6_col0, #T_7058b_row6_col1, #T_7058b_row6_col2, #T_7058b_row6_col3, #T_7058b_row6_col4, #T_7058b_row6_col5, #T_7058b_row7_col0, #T_7058b_row7_col1, #T_7058b_row7_col2, #T_7058b_row7_col3, #T_7058b_row7_col4, #T_7058b_row7_col5, #T_7058b_row8_col0, #T_7058b_row8_col1, #T_7058b_row8_col2, #T_7058b_row8_col3, #T_7058b_row8_col4, #T_7058b_row8_col5, #T_7058b_row9_col0, #T_7058b_row9_col1, #T_7058b_row9_col2, #T_7058b_row9_col3, #T_7058b_row9_col4, #T_7058b_row9_col5, #T_7058b_row10_col0, #T_7058b_row10_col1, #T_7058b_row10_col2, #T_7058b_row10_col3, #T_7058b_row10_col4, #T_7058b_row10_col5, #T_7058b_row11_col0, #T_7058b_row11_col1, #T_7058b_row11_col2, #T_7058b_row11_col3, #T_7058b_row11_col4, #T_7058b_row11_col5 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_7058b\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_7058b_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_7058b_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_7058b_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_7058b_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_7058b_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_7058b_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row0\" class=\"row_heading level0 row0\" >T1049</th>\n",
       "      <td id=\"T_7058b_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_7058b_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row0_col4\" class=\"data row0 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row0_col5\" class=\"data row0 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row1\" class=\"row_heading level0 row1\" >T1592</th>\n",
       "      <td id=\"T_7058b_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row1_col1\" class=\"data row1 col1\" >no</td>\n",
       "      <td id=\"T_7058b_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_7058b_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row1_col4\" class=\"data row1 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row1_col5\" class=\"data row1 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row2\" class=\"row_heading level0 row2\" >T1021</th>\n",
       "      <td id=\"T_7058b_row2_col0\" class=\"data row2 col0\" >no</td>\n",
       "      <td id=\"T_7058b_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_7058b_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_7058b_row2_col4\" class=\"data row2 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row2_col5\" class=\"data row2 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row3\" class=\"row_heading level0 row3\" >T1027</th>\n",
       "      <td id=\"T_7058b_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row3_col1\" class=\"data row3 col1\" >no</td>\n",
       "      <td id=\"T_7058b_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_7058b_row3_col4\" class=\"data row3 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row3_col5\" class=\"data row3 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row4\" class=\"row_heading level0 row4\" >T1055.001</th>\n",
       "      <td id=\"T_7058b_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row4_col1\" class=\"data row4 col1\" >no</td>\n",
       "      <td id=\"T_7058b_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_7058b_row4_col3\" class=\"data row4 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row4_col4\" class=\"data row4 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row4_col5\" class=\"data row4 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row5\" class=\"row_heading level0 row5\" >T1590</th>\n",
       "      <td id=\"T_7058b_row5_col0\" class=\"data row5 col0\" >no</td>\n",
       "      <td id=\"T_7058b_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_7058b_row5_col2\" class=\"data row5 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
       "      <td id=\"T_7058b_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row5_col5\" class=\"data row5 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row6\" class=\"row_heading level0 row6\" >T1059.003</th>\n",
       "      <td id=\"T_7058b_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_7058b_row6_col2\" class=\"data row6 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row6_col3\" class=\"data row6 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row6_col4\" class=\"data row6 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row6_col5\" class=\"data row6 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row7\" class=\"row_heading level0 row7\" >T1218.010</th>\n",
       "      <td id=\"T_7058b_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row7_col1\" class=\"data row7 col1\" >no</td>\n",
       "      <td id=\"T_7058b_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
       "      <td id=\"T_7058b_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row7_col5\" class=\"data row7 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row8\" class=\"row_heading level0 row8\" >T1590.005</th>\n",
       "      <td id=\"T_7058b_row8_col0\" class=\"data row8 col0\" >no</td>\n",
       "      <td id=\"T_7058b_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_7058b_row8_col2\" class=\"data row8 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row8_col3\" class=\"data row8 col3\" >yes</td>\n",
       "      <td id=\"T_7058b_row8_col4\" class=\"data row8 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row8_col5\" class=\"data row8 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row9\" class=\"row_heading level0 row9\" >T1059.007</th>\n",
       "      <td id=\"T_7058b_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row9_col1\" class=\"data row9 col1\" >no</td>\n",
       "      <td id=\"T_7058b_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
       "      <td id=\"T_7058b_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row9_col5\" class=\"data row9 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row10\" class=\"row_heading level0 row10\" >T1569</th>\n",
       "      <td id=\"T_7058b_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_7058b_row10_col2\" class=\"data row10 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row10_col3\" class=\"data row10 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row10_col4\" class=\"data row10 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row10_col5\" class=\"data row10 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_7058b_level0_row11\" class=\"row_heading level0 row11\" >T1569.002</th>\n",
       "      <td id=\"T_7058b_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
       "      <td id=\"T_7058b_row11_col1\" class=\"data row11 col1\" >yes</td>\n",
       "      <td id=\"T_7058b_row11_col2\" class=\"data row11 col2\" >no</td>\n",
       "      <td id=\"T_7058b_row11_col3\" class=\"data row11 col3\" >no</td>\n",
       "      <td id=\"T_7058b_row11_col4\" class=\"data row11 col4\" >no</td>\n",
       "      <td id=\"T_7058b_row11_col5\" class=\"data row11 col5\" >2</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12bfedd90>"
      ]
     },
     "execution_count": 45,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 2]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "id": "3f9a2ef2-1f38-40a7-98fa-e7e0b92a24da",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(39, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_cacfb_row0_col0, #T_cacfb_row0_col1, #T_cacfb_row0_col2, #T_cacfb_row0_col3, #T_cacfb_row0_col4, #T_cacfb_row0_col5, #T_cacfb_row1_col0, #T_cacfb_row1_col1, #T_cacfb_row1_col2, #T_cacfb_row1_col3, #T_cacfb_row1_col4, #T_cacfb_row1_col5, #T_cacfb_row2_col0, #T_cacfb_row2_col1, #T_cacfb_row2_col2, #T_cacfb_row2_col3, #T_cacfb_row2_col4, #T_cacfb_row2_col5, #T_cacfb_row3_col0, #T_cacfb_row3_col1, #T_cacfb_row3_col2, #T_cacfb_row3_col3, #T_cacfb_row3_col4, #T_cacfb_row3_col5, #T_cacfb_row4_col0, #T_cacfb_row4_col1, #T_cacfb_row4_col2, #T_cacfb_row4_col3, #T_cacfb_row4_col4, #T_cacfb_row4_col5, #T_cacfb_row5_col0, #T_cacfb_row5_col1, #T_cacfb_row5_col2, #T_cacfb_row5_col3, #T_cacfb_row5_col4, #T_cacfb_row5_col5, #T_cacfb_row6_col0, #T_cacfb_row6_col1, #T_cacfb_row6_col2, #T_cacfb_row6_col3, #T_cacfb_row6_col4, #T_cacfb_row6_col5, #T_cacfb_row7_col0, #T_cacfb_row7_col1, #T_cacfb_row7_col2, #T_cacfb_row7_col3, #T_cacfb_row7_col4, #T_cacfb_row7_col5, #T_cacfb_row8_col0, #T_cacfb_row8_col1, #T_cacfb_row8_col2, #T_cacfb_row8_col3, #T_cacfb_row8_col4, #T_cacfb_row8_col5, #T_cacfb_row9_col0, #T_cacfb_row9_col1, #T_cacfb_row9_col2, #T_cacfb_row9_col3, #T_cacfb_row9_col4, #T_cacfb_row9_col5, #T_cacfb_row10_col0, #T_cacfb_row10_col1, #T_cacfb_row10_col2, #T_cacfb_row10_col3, #T_cacfb_row10_col4, #T_cacfb_row10_col5, #T_cacfb_row11_col0, #T_cacfb_row11_col1, #T_cacfb_row11_col2, #T_cacfb_row11_col3, #T_cacfb_row11_col4, #T_cacfb_row11_col5, #T_cacfb_row12_col0, #T_cacfb_row12_col1, #T_cacfb_row12_col2, #T_cacfb_row12_col3, #T_cacfb_row12_col4, #T_cacfb_row12_col5, #T_cacfb_row13_col0, #T_cacfb_row13_col1, #T_cacfb_row13_col2, #T_cacfb_row13_col3, #T_cacfb_row13_col4, #T_cacfb_row13_col5, #T_cacfb_row14_col0, #T_cacfb_row14_col1, #T_cacfb_row14_col2, #T_cacfb_row14_col3, #T_cacfb_row14_col4, #T_cacfb_row14_col5, #T_cacfb_row15_col0, #T_cacfb_row15_col1, #T_cacfb_row15_col2, #T_cacfb_row15_col3, #T_cacfb_row15_col4, #T_cacfb_row15_col5, #T_cacfb_row16_col0, #T_cacfb_row16_col1, #T_cacfb_row16_col2, #T_cacfb_row16_col3, #T_cacfb_row16_col4, #T_cacfb_row16_col5, #T_cacfb_row17_col0, #T_cacfb_row17_col1, #T_cacfb_row17_col2, #T_cacfb_row17_col3, #T_cacfb_row17_col4, #T_cacfb_row17_col5, #T_cacfb_row18_col0, #T_cacfb_row18_col1, #T_cacfb_row18_col2, #T_cacfb_row18_col3, #T_cacfb_row18_col4, #T_cacfb_row18_col5, #T_cacfb_row19_col0, #T_cacfb_row19_col1, #T_cacfb_row19_col2, #T_cacfb_row19_col3, #T_cacfb_row19_col4, #T_cacfb_row19_col5, #T_cacfb_row20_col0, #T_cacfb_row20_col1, #T_cacfb_row20_col2, #T_cacfb_row20_col3, #T_cacfb_row20_col4, #T_cacfb_row20_col5, #T_cacfb_row21_col0, #T_cacfb_row21_col1, #T_cacfb_row21_col2, #T_cacfb_row21_col3, #T_cacfb_row21_col4, #T_cacfb_row21_col5, #T_cacfb_row22_col0, #T_cacfb_row22_col1, #T_cacfb_row22_col2, #T_cacfb_row22_col3, #T_cacfb_row22_col4, #T_cacfb_row22_col5, #T_cacfb_row23_col0, #T_cacfb_row23_col1, #T_cacfb_row23_col2, #T_cacfb_row23_col3, #T_cacfb_row23_col4, #T_cacfb_row23_col5, #T_cacfb_row24_col0, #T_cacfb_row24_col1, #T_cacfb_row24_col2, #T_cacfb_row24_col3, #T_cacfb_row24_col4, #T_cacfb_row24_col5, #T_cacfb_row25_col0, #T_cacfb_row25_col1, #T_cacfb_row25_col2, #T_cacfb_row25_col3, #T_cacfb_row25_col4, #T_cacfb_row25_col5, #T_cacfb_row26_col0, #T_cacfb_row26_col1, #T_cacfb_row26_col2, #T_cacfb_row26_col3, #T_cacfb_row26_col4, #T_cacfb_row26_col5, #T_cacfb_row27_col0, #T_cacfb_row27_col1, #T_cacfb_row27_col2, #T_cacfb_row27_col3, #T_cacfb_row27_col4, #T_cacfb_row27_col5, #T_cacfb_row28_col0, #T_cacfb_row28_col1, #T_cacfb_row28_col2, #T_cacfb_row28_col3, #T_cacfb_row28_col4, #T_cacfb_row28_col5, #T_cacfb_row29_col0, #T_cacfb_row29_col1, #T_cacfb_row29_col2, #T_cacfb_row29_col3, #T_cacfb_row29_col4, #T_cacfb_row29_col5, #T_cacfb_row30_col0, #T_cacfb_row30_col1, #T_cacfb_row30_col2, #T_cacfb_row30_col3, #T_cacfb_row30_col4, #T_cacfb_row30_col5, #T_cacfb_row31_col0, #T_cacfb_row31_col1, #T_cacfb_row31_col2, #T_cacfb_row31_col3, #T_cacfb_row31_col4, #T_cacfb_row31_col5, #T_cacfb_row32_col0, #T_cacfb_row32_col1, #T_cacfb_row32_col2, #T_cacfb_row32_col3, #T_cacfb_row32_col4, #T_cacfb_row32_col5, #T_cacfb_row33_col0, #T_cacfb_row33_col1, #T_cacfb_row33_col2, #T_cacfb_row33_col3, #T_cacfb_row33_col4, #T_cacfb_row33_col5, #T_cacfb_row34_col0, #T_cacfb_row34_col1, #T_cacfb_row34_col2, #T_cacfb_row34_col3, #T_cacfb_row34_col4, #T_cacfb_row34_col5, #T_cacfb_row35_col0, #T_cacfb_row35_col1, #T_cacfb_row35_col2, #T_cacfb_row35_col3, #T_cacfb_row35_col4, #T_cacfb_row35_col5, #T_cacfb_row36_col0, #T_cacfb_row36_col1, #T_cacfb_row36_col2, #T_cacfb_row36_col3, #T_cacfb_row36_col4, #T_cacfb_row36_col5, #T_cacfb_row37_col0, #T_cacfb_row37_col1, #T_cacfb_row37_col2, #T_cacfb_row37_col3, #T_cacfb_row37_col4, #T_cacfb_row37_col5, #T_cacfb_row38_col0, #T_cacfb_row38_col1, #T_cacfb_row38_col2, #T_cacfb_row38_col3, #T_cacfb_row38_col4, #T_cacfb_row38_col5 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_cacfb\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_cacfb_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_cacfb_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_cacfb_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_cacfb_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_cacfb_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_cacfb_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row0\" class=\"row_heading level0 row0\" >T1087.002</th>\n",
       "      <td id=\"T_cacfb_row0_col0\" class=\"data row0 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row0_col1\" class=\"data row0 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_cacfb_row0_col4\" class=\"data row0 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row0_col5\" class=\"data row0 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row1\" class=\"row_heading level0 row1\" >T1087</th>\n",
       "      <td id=\"T_cacfb_row1_col0\" class=\"data row1 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row1_col1\" class=\"data row1 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row1_col2\" class=\"data row1 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_cacfb_row1_col4\" class=\"data row1 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row1_col5\" class=\"data row1 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row2\" class=\"row_heading level0 row2\" >T1218.011</th>\n",
       "      <td id=\"T_cacfb_row2_col0\" class=\"data row2 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row2_col1\" class=\"data row2 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_cacfb_row2_col4\" class=\"data row2 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row2_col5\" class=\"data row2 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row3\" class=\"row_heading level0 row3\" >T1218.001</th>\n",
       "      <td id=\"T_cacfb_row3_col0\" class=\"data row3 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row3_col1\" class=\"data row3 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row3_col3\" class=\"data row3 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_cacfb_row3_col5\" class=\"data row3 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row4\" class=\"row_heading level0 row4\" >T1021.002</th>\n",
       "      <td id=\"T_cacfb_row4_col0\" class=\"data row4 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row4_col1\" class=\"data row4 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row4_col2\" class=\"data row4 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_cacfb_row4_col4\" class=\"data row4 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row4_col5\" class=\"data row4 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row5\" class=\"row_heading level0 row5\" >T1564.001</th>\n",
       "      <td id=\"T_cacfb_row5_col0\" class=\"data row5 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row5_col2\" class=\"data row5 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row5_col3\" class=\"data row5 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row5_col5\" class=\"data row5 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row6\" class=\"row_heading level0 row6\" >T1482</th>\n",
       "      <td id=\"T_cacfb_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row6_col1\" class=\"data row6 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row6_col2\" class=\"data row6 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row6_col3\" class=\"data row6 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row6_col4\" class=\"data row6 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row6_col5\" class=\"data row6 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row7\" class=\"row_heading level0 row7\" >T1564</th>\n",
       "      <td id=\"T_cacfb_row7_col0\" class=\"data row7 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row7_col2\" class=\"data row7 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row7_col5\" class=\"data row7 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row8\" class=\"row_heading level0 row8\" >T1559.001</th>\n",
       "      <td id=\"T_cacfb_row8_col0\" class=\"data row8 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row8_col1\" class=\"data row8 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
       "      <td id=\"T_cacfb_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row8_col4\" class=\"data row8 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row8_col5\" class=\"data row8 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row9\" class=\"row_heading level0 row9\" >T1566.002</th>\n",
       "      <td id=\"T_cacfb_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row9_col1\" class=\"data row9 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row9_col2\" class=\"data row9 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row9_col5\" class=\"data row9 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row10\" class=\"row_heading level0 row10\" >T1222.001</th>\n",
       "      <td id=\"T_cacfb_row10_col0\" class=\"data row10 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row10_col2\" class=\"data row10 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row10_col3\" class=\"data row10 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row10_col4\" class=\"data row10 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row10_col5\" class=\"data row10 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row11\" class=\"row_heading level0 row11\" >T1134.004</th>\n",
       "      <td id=\"T_cacfb_row11_col0\" class=\"data row11 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row11_col1\" class=\"data row11 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
       "      <td id=\"T_cacfb_row11_col3\" class=\"data row11 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row11_col4\" class=\"data row11 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row11_col5\" class=\"data row11 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row12\" class=\"row_heading level0 row12\" >T1134</th>\n",
       "      <td id=\"T_cacfb_row12_col0\" class=\"data row12 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row12_col1\" class=\"data row12 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row12_col2\" class=\"data row12 col2\" >yes</td>\n",
       "      <td id=\"T_cacfb_row12_col3\" class=\"data row12 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row12_col4\" class=\"data row12 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row12_col5\" class=\"data row12 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row13\" class=\"row_heading level0 row13\" >T1574.001</th>\n",
       "      <td id=\"T_cacfb_row13_col0\" class=\"data row13 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row13_col1\" class=\"data row13 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row13_col2\" class=\"data row13 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row13_col3\" class=\"data row13 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row13_col4\" class=\"data row13 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row13_col5\" class=\"data row13 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row14\" class=\"row_heading level0 row14\" >T1069</th>\n",
       "      <td id=\"T_cacfb_row14_col0\" class=\"data row14 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row14_col2\" class=\"data row14 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row14_col3\" class=\"data row14 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row14_col4\" class=\"data row14 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row14_col5\" class=\"data row14 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row15\" class=\"row_heading level0 row15\" >T1069.001</th>\n",
       "      <td id=\"T_cacfb_row15_col0\" class=\"data row15 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row15_col2\" class=\"data row15 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row15_col3\" class=\"data row15 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row15_col4\" class=\"data row15 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row15_col5\" class=\"data row15 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row16\" class=\"row_heading level0 row16\" >T1059.005</th>\n",
       "      <td id=\"T_cacfb_row16_col0\" class=\"data row16 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row16_col1\" class=\"data row16 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
       "      <td id=\"T_cacfb_row16_col3\" class=\"data row16 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row16_col4\" class=\"data row16 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row16_col5\" class=\"data row16 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row17\" class=\"row_heading level0 row17\" >T1021.001</th>\n",
       "      <td id=\"T_cacfb_row17_col0\" class=\"data row17 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row17_col2\" class=\"data row17 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row17_col3\" class=\"data row17 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row17_col4\" class=\"data row17 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row17_col5\" class=\"data row17 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row18\" class=\"row_heading level0 row18\" >T1531</th>\n",
       "      <td id=\"T_cacfb_row18_col0\" class=\"data row18 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row18_col2\" class=\"data row18 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row18_col3\" class=\"data row18 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row18_col4\" class=\"data row18 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row18_col5\" class=\"data row18 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row19\" class=\"row_heading level0 row19\" >T1036.003</th>\n",
       "      <td id=\"T_cacfb_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row19_col1\" class=\"data row19 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row19_col2\" class=\"data row19 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row19_col3\" class=\"data row19 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row19_col4\" class=\"data row19 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row19_col5\" class=\"data row19 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row20\" class=\"row_heading level0 row20\" >T1489</th>\n",
       "      <td id=\"T_cacfb_row20_col0\" class=\"data row20 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row20_col2\" class=\"data row20 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row20_col3\" class=\"data row20 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row20_col4\" class=\"data row20 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row20_col5\" class=\"data row20 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row21\" class=\"row_heading level0 row21\" >T1222</th>\n",
       "      <td id=\"T_cacfb_row21_col0\" class=\"data row21 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row21_col2\" class=\"data row21 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row21_col3\" class=\"data row21 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row21_col4\" class=\"data row21 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row21_col5\" class=\"data row21 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row22\" class=\"row_heading level0 row22\" >T1562.004</th>\n",
       "      <td id=\"T_cacfb_row22_col0\" class=\"data row22 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row22_col2\" class=\"data row22 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row22_col3\" class=\"data row22 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row22_col4\" class=\"data row22 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row22_col5\" class=\"data row22 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row23\" class=\"row_heading level0 row23\" >T1047</th>\n",
       "      <td id=\"T_cacfb_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row23_col1\" class=\"data row23 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row23_col2\" class=\"data row23 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row23_col3\" class=\"data row23 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row23_col4\" class=\"data row23 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row23_col5\" class=\"data row23 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row24\" class=\"row_heading level0 row24\" >T1574.002</th>\n",
       "      <td id=\"T_cacfb_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row24_col1\" class=\"data row24 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row24_col2\" class=\"data row24 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row24_col3\" class=\"data row24 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row24_col4\" class=\"data row24 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row24_col5\" class=\"data row24 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row25\" class=\"row_heading level0 row25\" >T1574</th>\n",
       "      <td id=\"T_cacfb_row25_col0\" class=\"data row25 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row25_col1\" class=\"data row25 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row25_col2\" class=\"data row25 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row25_col3\" class=\"data row25 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row25_col4\" class=\"data row25 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row25_col5\" class=\"data row25 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row26\" class=\"row_heading level0 row26\" >T1113</th>\n",
       "      <td id=\"T_cacfb_row26_col0\" class=\"data row26 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row26_col1\" class=\"data row26 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row26_col2\" class=\"data row26 col2\" >yes</td>\n",
       "      <td id=\"T_cacfb_row26_col3\" class=\"data row26 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row26_col4\" class=\"data row26 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row26_col5\" class=\"data row26 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row27\" class=\"row_heading level0 row27\" >T1016</th>\n",
       "      <td id=\"T_cacfb_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row27_col1\" class=\"data row27 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row27_col2\" class=\"data row27 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row27_col3\" class=\"data row27 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row27_col4\" class=\"data row27 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row27_col5\" class=\"data row27 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row28\" class=\"row_heading level0 row28\" >T1033</th>\n",
       "      <td id=\"T_cacfb_row28_col0\" class=\"data row28 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row28_col1\" class=\"data row28 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row28_col2\" class=\"data row28 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row28_col3\" class=\"data row28 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row28_col4\" class=\"data row28 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row28_col5\" class=\"data row28 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row29\" class=\"row_heading level0 row29\" >T1218.005</th>\n",
       "      <td id=\"T_cacfb_row29_col0\" class=\"data row29 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row29_col1\" class=\"data row29 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row29_col2\" class=\"data row29 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row29_col3\" class=\"data row29 col3\" >yes</td>\n",
       "      <td id=\"T_cacfb_row29_col4\" class=\"data row29 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row29_col5\" class=\"data row29 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row30\" class=\"row_heading level0 row30\" >T1014</th>\n",
       "      <td id=\"T_cacfb_row30_col0\" class=\"data row30 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row30_col1\" class=\"data row30 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row30_col2\" class=\"data row30 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row30_col3\" class=\"data row30 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row30_col4\" class=\"data row30 col4\" >yes</td>\n",
       "      <td id=\"T_cacfb_row30_col5\" class=\"data row30 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row31\" class=\"row_heading level0 row31\" >T1068</th>\n",
       "      <td id=\"T_cacfb_row31_col0\" class=\"data row31 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row31_col1\" class=\"data row31 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row31_col2\" class=\"data row31 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row31_col3\" class=\"data row31 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
       "      <td id=\"T_cacfb_row31_col5\" class=\"data row31 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row32\" class=\"row_heading level0 row32\" >T1219</th>\n",
       "      <td id=\"T_cacfb_row32_col0\" class=\"data row32 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row32_col1\" class=\"data row32 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row32_col2\" class=\"data row32 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row32_col3\" class=\"data row32 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row32_col4\" class=\"data row32 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row32_col5\" class=\"data row32 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row33\" class=\"row_heading level0 row33\" >T1055.002</th>\n",
       "      <td id=\"T_cacfb_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row33_col1\" class=\"data row33 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row33_col2\" class=\"data row33 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row33_col3\" class=\"data row33 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row33_col4\" class=\"data row33 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row33_col5\" class=\"data row33 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row34\" class=\"row_heading level0 row34\" >T1136.001</th>\n",
       "      <td id=\"T_cacfb_row34_col0\" class=\"data row34 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row34_col2\" class=\"data row34 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row34_col3\" class=\"data row34 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row34_col4\" class=\"data row34 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row34_col5\" class=\"data row34 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row35\" class=\"row_heading level0 row35\" >T1136</th>\n",
       "      <td id=\"T_cacfb_row35_col0\" class=\"data row35 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row35_col1\" class=\"data row35 col1\" >yes</td>\n",
       "      <td id=\"T_cacfb_row35_col2\" class=\"data row35 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row35_col3\" class=\"data row35 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row35_col4\" class=\"data row35 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row35_col5\" class=\"data row35 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row36\" class=\"row_heading level0 row36\" >T1070</th>\n",
       "      <td id=\"T_cacfb_row36_col0\" class=\"data row36 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row36_col1\" class=\"data row36 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row36_col2\" class=\"data row36 col2\" >yes</td>\n",
       "      <td id=\"T_cacfb_row36_col3\" class=\"data row36 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row36_col4\" class=\"data row36 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row36_col5\" class=\"data row36 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row37\" class=\"row_heading level0 row37\" >T1071.003</th>\n",
       "      <td id=\"T_cacfb_row37_col0\" class=\"data row37 col0\" >no</td>\n",
       "      <td id=\"T_cacfb_row37_col1\" class=\"data row37 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row37_col2\" class=\"data row37 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row37_col3\" class=\"data row37 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row37_col4\" class=\"data row37 col4\" >yes</td>\n",
       "      <td id=\"T_cacfb_row37_col5\" class=\"data row37 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_cacfb_level0_row38\" class=\"row_heading level0 row38\" >T1016.001</th>\n",
       "      <td id=\"T_cacfb_row38_col0\" class=\"data row38 col0\" >yes</td>\n",
       "      <td id=\"T_cacfb_row38_col1\" class=\"data row38 col1\" >no</td>\n",
       "      <td id=\"T_cacfb_row38_col2\" class=\"data row38 col2\" >no</td>\n",
       "      <td id=\"T_cacfb_row38_col3\" class=\"data row38 col3\" >no</td>\n",
       "      <td id=\"T_cacfb_row38_col4\" class=\"data row38 col4\" >no</td>\n",
       "      <td id=\"T_cacfb_row38_col5\" class=\"data row38 col5\" >1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c220f40>"
      ]
     },
     "execution_count": 46,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 1]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "030119bf-4cef-4270-ba19-d9c9b2ea17f0",
   "metadata": {},
   "source": [
    "### truth table mitre attack id 0technique vs analytic story(malware family)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "id": "e6ccea82-34f5-49d5-b43d-82d29313e0ee",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(74, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_a833d_row0_col0, #T_a833d_row0_col1, #T_a833d_row0_col2, #T_a833d_row0_col3, #T_a833d_row0_col4, #T_a833d_row0_col5, #T_a833d_row1_col0, #T_a833d_row1_col1, #T_a833d_row1_col2, #T_a833d_row1_col3, #T_a833d_row1_col4, #T_a833d_row1_col5, #T_a833d_row2_col0, #T_a833d_row2_col1, #T_a833d_row2_col2, #T_a833d_row2_col3, #T_a833d_row2_col4, #T_a833d_row2_col5, #T_a833d_row3_col0, #T_a833d_row3_col1, #T_a833d_row3_col2, #T_a833d_row3_col3, #T_a833d_row3_col4, #T_a833d_row3_col5, #T_a833d_row4_col0, #T_a833d_row4_col1, #T_a833d_row4_col2, #T_a833d_row4_col3, #T_a833d_row4_col4, #T_a833d_row4_col5, #T_a833d_row5_col0, #T_a833d_row5_col1, #T_a833d_row5_col2, #T_a833d_row5_col3, #T_a833d_row5_col4, #T_a833d_row5_col5, #T_a833d_row6_col0, #T_a833d_row6_col1, #T_a833d_row6_col2, #T_a833d_row6_col3, #T_a833d_row6_col4, #T_a833d_row6_col5 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "#T_a833d_row7_col0, #T_a833d_row7_col1, #T_a833d_row7_col2, #T_a833d_row7_col3, #T_a833d_row7_col4, #T_a833d_row7_col5, #T_a833d_row8_col0, #T_a833d_row8_col1, #T_a833d_row8_col2, #T_a833d_row8_col3, #T_a833d_row8_col4, #T_a833d_row8_col5, #T_a833d_row9_col0, #T_a833d_row9_col1, #T_a833d_row9_col2, #T_a833d_row9_col3, #T_a833d_row9_col4, #T_a833d_row9_col5, #T_a833d_row10_col0, #T_a833d_row10_col1, #T_a833d_row10_col2, #T_a833d_row10_col3, #T_a833d_row10_col4, #T_a833d_row10_col5, #T_a833d_row11_col0, #T_a833d_row11_col1, #T_a833d_row11_col2, #T_a833d_row11_col3, #T_a833d_row11_col4, #T_a833d_row11_col5 {\n",
       "  background-color: orange;\n",
       "}\n",
       "#T_a833d_row12_col0, #T_a833d_row12_col1, #T_a833d_row12_col2, #T_a833d_row12_col3, #T_a833d_row12_col4, #T_a833d_row12_col5, #T_a833d_row13_col0, #T_a833d_row13_col1, #T_a833d_row13_col2, #T_a833d_row13_col3, #T_a833d_row13_col4, #T_a833d_row13_col5, #T_a833d_row14_col0, #T_a833d_row14_col1, #T_a833d_row14_col2, #T_a833d_row14_col3, #T_a833d_row14_col4, #T_a833d_row14_col5, #T_a833d_row15_col0, #T_a833d_row15_col1, #T_a833d_row15_col2, #T_a833d_row15_col3, #T_a833d_row15_col4, #T_a833d_row15_col5, #T_a833d_row16_col0, #T_a833d_row16_col1, #T_a833d_row16_col2, #T_a833d_row16_col3, #T_a833d_row16_col4, #T_a833d_row16_col5, #T_a833d_row17_col0, #T_a833d_row17_col1, #T_a833d_row17_col2, #T_a833d_row17_col3, #T_a833d_row17_col4, #T_a833d_row17_col5, #T_a833d_row18_col0, #T_a833d_row18_col1, #T_a833d_row18_col2, #T_a833d_row18_col3, #T_a833d_row18_col4, #T_a833d_row18_col5, #T_a833d_row19_col0, #T_a833d_row19_col1, #T_a833d_row19_col2, #T_a833d_row19_col3, #T_a833d_row19_col4, #T_a833d_row19_col5, #T_a833d_row20_col0, #T_a833d_row20_col1, #T_a833d_row20_col2, #T_a833d_row20_col3, #T_a833d_row20_col4, #T_a833d_row20_col5, #T_a833d_row21_col0, #T_a833d_row21_col1, #T_a833d_row21_col2, #T_a833d_row21_col3, #T_a833d_row21_col4, #T_a833d_row21_col5, #T_a833d_row22_col0, #T_a833d_row22_col1, #T_a833d_row22_col2, #T_a833d_row22_col3, #T_a833d_row22_col4, #T_a833d_row22_col5 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "#T_a833d_row23_col0, #T_a833d_row23_col1, #T_a833d_row23_col2, #T_a833d_row23_col3, #T_a833d_row23_col4, #T_a833d_row23_col5, #T_a833d_row24_col0, #T_a833d_row24_col1, #T_a833d_row24_col2, #T_a833d_row24_col3, #T_a833d_row24_col4, #T_a833d_row24_col5, #T_a833d_row25_col0, #T_a833d_row25_col1, #T_a833d_row25_col2, #T_a833d_row25_col3, #T_a833d_row25_col4, #T_a833d_row25_col5, #T_a833d_row26_col0, #T_a833d_row26_col1, #T_a833d_row26_col2, #T_a833d_row26_col3, #T_a833d_row26_col4, #T_a833d_row26_col5, #T_a833d_row27_col0, #T_a833d_row27_col1, #T_a833d_row27_col2, #T_a833d_row27_col3, #T_a833d_row27_col4, #T_a833d_row27_col5, #T_a833d_row28_col0, #T_a833d_row28_col1, #T_a833d_row28_col2, #T_a833d_row28_col3, #T_a833d_row28_col4, #T_a833d_row28_col5, #T_a833d_row29_col0, #T_a833d_row29_col1, #T_a833d_row29_col2, #T_a833d_row29_col3, #T_a833d_row29_col4, #T_a833d_row29_col5, #T_a833d_row30_col0, #T_a833d_row30_col1, #T_a833d_row30_col2, #T_a833d_row30_col3, #T_a833d_row30_col4, #T_a833d_row30_col5, #T_a833d_row31_col0, #T_a833d_row31_col1, #T_a833d_row31_col2, #T_a833d_row31_col3, #T_a833d_row31_col4, #T_a833d_row31_col5, #T_a833d_row32_col0, #T_a833d_row32_col1, #T_a833d_row32_col2, #T_a833d_row32_col3, #T_a833d_row32_col4, #T_a833d_row32_col5, #T_a833d_row33_col0, #T_a833d_row33_col1, #T_a833d_row33_col2, #T_a833d_row33_col3, #T_a833d_row33_col4, #T_a833d_row33_col5, #T_a833d_row34_col0, #T_a833d_row34_col1, #T_a833d_row34_col2, #T_a833d_row34_col3, #T_a833d_row34_col4, #T_a833d_row34_col5 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "#T_a833d_row35_col0, #T_a833d_row35_col1, #T_a833d_row35_col2, #T_a833d_row35_col3, #T_a833d_row35_col4, #T_a833d_row35_col5, #T_a833d_row36_col0, #T_a833d_row36_col1, #T_a833d_row36_col2, #T_a833d_row36_col3, #T_a833d_row36_col4, #T_a833d_row36_col5, #T_a833d_row37_col0, #T_a833d_row37_col1, #T_a833d_row37_col2, #T_a833d_row37_col3, #T_a833d_row37_col4, #T_a833d_row37_col5, #T_a833d_row38_col0, #T_a833d_row38_col1, #T_a833d_row38_col2, #T_a833d_row38_col3, #T_a833d_row38_col4, #T_a833d_row38_col5, #T_a833d_row39_col0, #T_a833d_row39_col1, #T_a833d_row39_col2, #T_a833d_row39_col3, #T_a833d_row39_col4, #T_a833d_row39_col5, #T_a833d_row40_col0, #T_a833d_row40_col1, #T_a833d_row40_col2, #T_a833d_row40_col3, #T_a833d_row40_col4, #T_a833d_row40_col5, #T_a833d_row41_col0, #T_a833d_row41_col1, #T_a833d_row41_col2, #T_a833d_row41_col3, #T_a833d_row41_col4, #T_a833d_row41_col5, #T_a833d_row42_col0, #T_a833d_row42_col1, #T_a833d_row42_col2, #T_a833d_row42_col3, #T_a833d_row42_col4, #T_a833d_row42_col5, #T_a833d_row43_col0, #T_a833d_row43_col1, #T_a833d_row43_col2, #T_a833d_row43_col3, #T_a833d_row43_col4, #T_a833d_row43_col5, #T_a833d_row44_col0, #T_a833d_row44_col1, #T_a833d_row44_col2, #T_a833d_row44_col3, #T_a833d_row44_col4, #T_a833d_row44_col5, #T_a833d_row45_col0, #T_a833d_row45_col1, #T_a833d_row45_col2, #T_a833d_row45_col3, #T_a833d_row45_col4, #T_a833d_row45_col5, #T_a833d_row46_col0, #T_a833d_row46_col1, #T_a833d_row46_col2, #T_a833d_row46_col3, #T_a833d_row46_col4, #T_a833d_row46_col5, #T_a833d_row47_col0, #T_a833d_row47_col1, #T_a833d_row47_col2, #T_a833d_row47_col3, #T_a833d_row47_col4, #T_a833d_row47_col5, #T_a833d_row48_col0, #T_a833d_row48_col1, #T_a833d_row48_col2, #T_a833d_row48_col3, #T_a833d_row48_col4, #T_a833d_row48_col5, #T_a833d_row49_col0, #T_a833d_row49_col1, #T_a833d_row49_col2, #T_a833d_row49_col3, #T_a833d_row49_col4, #T_a833d_row49_col5, #T_a833d_row50_col0, #T_a833d_row50_col1, #T_a833d_row50_col2, #T_a833d_row50_col3, #T_a833d_row50_col4, #T_a833d_row50_col5, #T_a833d_row51_col0, #T_a833d_row51_col1, #T_a833d_row51_col2, #T_a833d_row51_col3, #T_a833d_row51_col4, #T_a833d_row51_col5, #T_a833d_row52_col0, #T_a833d_row52_col1, #T_a833d_row52_col2, #T_a833d_row52_col3, #T_a833d_row52_col4, #T_a833d_row52_col5, #T_a833d_row53_col0, #T_a833d_row53_col1, #T_a833d_row53_col2, #T_a833d_row53_col3, #T_a833d_row53_col4, #T_a833d_row53_col5, #T_a833d_row54_col0, #T_a833d_row54_col1, #T_a833d_row54_col2, #T_a833d_row54_col3, #T_a833d_row54_col4, #T_a833d_row54_col5, #T_a833d_row55_col0, #T_a833d_row55_col1, #T_a833d_row55_col2, #T_a833d_row55_col3, #T_a833d_row55_col4, #T_a833d_row55_col5, #T_a833d_row56_col0, #T_a833d_row56_col1, #T_a833d_row56_col2, #T_a833d_row56_col3, #T_a833d_row56_col4, #T_a833d_row56_col5, #T_a833d_row57_col0, #T_a833d_row57_col1, #T_a833d_row57_col2, #T_a833d_row57_col3, #T_a833d_row57_col4, #T_a833d_row57_col5, #T_a833d_row58_col0, #T_a833d_row58_col1, #T_a833d_row58_col2, #T_a833d_row58_col3, #T_a833d_row58_col4, #T_a833d_row58_col5, #T_a833d_row59_col0, #T_a833d_row59_col1, #T_a833d_row59_col2, #T_a833d_row59_col3, #T_a833d_row59_col4, #T_a833d_row59_col5, #T_a833d_row60_col0, #T_a833d_row60_col1, #T_a833d_row60_col2, #T_a833d_row60_col3, #T_a833d_row60_col4, #T_a833d_row60_col5, #T_a833d_row61_col0, #T_a833d_row61_col1, #T_a833d_row61_col2, #T_a833d_row61_col3, #T_a833d_row61_col4, #T_a833d_row61_col5, #T_a833d_row62_col0, #T_a833d_row62_col1, #T_a833d_row62_col2, #T_a833d_row62_col3, #T_a833d_row62_col4, #T_a833d_row62_col5, #T_a833d_row63_col0, #T_a833d_row63_col1, #T_a833d_row63_col2, #T_a833d_row63_col3, #T_a833d_row63_col4, #T_a833d_row63_col5, #T_a833d_row64_col0, #T_a833d_row64_col1, #T_a833d_row64_col2, #T_a833d_row64_col3, #T_a833d_row64_col4, #T_a833d_row64_col5, #T_a833d_row65_col0, #T_a833d_row65_col1, #T_a833d_row65_col2, #T_a833d_row65_col3, #T_a833d_row65_col4, #T_a833d_row65_col5, #T_a833d_row66_col0, #T_a833d_row66_col1, #T_a833d_row66_col2, #T_a833d_row66_col3, #T_a833d_row66_col4, #T_a833d_row66_col5, #T_a833d_row67_col0, #T_a833d_row67_col1, #T_a833d_row67_col2, #T_a833d_row67_col3, #T_a833d_row67_col4, #T_a833d_row67_col5, #T_a833d_row68_col0, #T_a833d_row68_col1, #T_a833d_row68_col2, #T_a833d_row68_col3, #T_a833d_row68_col4, #T_a833d_row68_col5, #T_a833d_row69_col0, #T_a833d_row69_col1, #T_a833d_row69_col2, #T_a833d_row69_col3, #T_a833d_row69_col4, #T_a833d_row69_col5, #T_a833d_row70_col0, #T_a833d_row70_col1, #T_a833d_row70_col2, #T_a833d_row70_col3, #T_a833d_row70_col4, #T_a833d_row70_col5, #T_a833d_row71_col0, #T_a833d_row71_col1, #T_a833d_row71_col2, #T_a833d_row71_col3, #T_a833d_row71_col4, #T_a833d_row71_col5, #T_a833d_row72_col0, #T_a833d_row72_col1, #T_a833d_row72_col2, #T_a833d_row72_col3, #T_a833d_row72_col4, #T_a833d_row72_col5, #T_a833d_row73_col0, #T_a833d_row73_col1, #T_a833d_row73_col2, #T_a833d_row73_col3, #T_a833d_row73_col4, #T_a833d_row73_col5 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_a833d\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_a833d_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_a833d_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_a833d_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_a833d_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_a833d_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_a833d_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row0\" class=\"row_heading level0 row0\" >T1562.001-Disable_or_Modify_Tools</th>\n",
       "      <td id=\"T_a833d_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row0_col5\" class=\"data row0 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row1\" class=\"row_heading level0 row1\" >T1036-Masquerading&nbsp;<sub>(7)</sub></th>\n",
       "      <td id=\"T_a833d_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row1_col5\" class=\"data row1 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row2\" class=\"row_heading level0 row2\" >T1566-Phishing&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_a833d_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row2_col5\" class=\"data row2 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row3\" class=\"row_heading level0 row3\" >T1566.001-Spearphishing_Attachment</th>\n",
       "      <td id=\"T_a833d_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row3_col5\" class=\"data row3 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row4\" class=\"row_heading level0 row4\" >T1562-Impair_Defenses&nbsp;<sub>(9)</sub></th>\n",
       "      <td id=\"T_a833d_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row4_col5\" class=\"data row4 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row5\" class=\"row_heading level0 row5\" >T1543-Create_or_Modify_System_Process&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_a833d_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row5_col5\" class=\"data row5 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row6\" class=\"row_heading level0 row6\" >T1059-Command_and_Scripting_Interpreter&nbsp;<sub>(8)</sub></th>\n",
       "      <td id=\"T_a833d_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row6_col5\" class=\"data row6 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row7\" class=\"row_heading level0 row7\" >T1053.005-Scheduled_Task</th>\n",
       "      <td id=\"T_a833d_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row7_col2\" class=\"data row7 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row7_col3\" class=\"data row7 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row7_col4\" class=\"data row7 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row7_col5\" class=\"data row7 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row8\" class=\"row_heading level0 row8\" >T1204.001-Malicious_Link</th>\n",
       "      <td id=\"T_a833d_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row8_col5\" class=\"data row8 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row9\" class=\"row_heading level0 row9\" >T1204-User_Execution&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_a833d_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row9_col4\" class=\"data row9 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row9_col5\" class=\"data row9 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row10\" class=\"row_heading level0 row10\" >T1053-Scheduled_Task/Job&nbsp;<sub>(5)</sub></th>\n",
       "      <td id=\"T_a833d_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row10_col2\" class=\"data row10 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row10_col5\" class=\"data row10 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row11\" class=\"row_heading level0 row11\" >T1218-System_Binary_Proxy_Execution&nbsp;<sub>(13)</sub></th>\n",
       "      <td id=\"T_a833d_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row11_col1\" class=\"data row11 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row11_col3\" class=\"data row11 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row11_col4\" class=\"data row11 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row11_col5\" class=\"data row11 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row12\" class=\"row_heading level0 row12\" >T1543.003-Windows_Service</th>\n",
       "      <td id=\"T_a833d_row12_col0\" class=\"data row12 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row12_col2\" class=\"data row12 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row12_col3\" class=\"data row12 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row12_col4\" class=\"data row12 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row12_col5\" class=\"data row12 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row13\" class=\"row_heading level0 row13\" >T1548.002-Bypass_User_Account_Control</th>\n",
       "      <td id=\"T_a833d_row13_col0\" class=\"data row13 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row13_col1\" class=\"data row13 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row13_col2\" class=\"data row13 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row13_col3\" class=\"data row13 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row13_col4\" class=\"data row13 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row13_col5\" class=\"data row13 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row14\" class=\"row_heading level0 row14\" >T1059.001-PowerShell</th>\n",
       "      <td id=\"T_a833d_row14_col0\" class=\"data row14 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row14_col2\" class=\"data row14 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row14_col3\" class=\"data row14 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row14_col4\" class=\"data row14 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row14_col5\" class=\"data row14 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row15\" class=\"row_heading level0 row15\" >T1548-Abuse_Elevation_Control_Mechanism&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_a833d_row15_col0\" class=\"data row15 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row15_col3\" class=\"data row15 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row15_col4\" class=\"data row15 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row15_col5\" class=\"data row15 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row16\" class=\"row_heading level0 row16\" >T1555-Credentials_from_Password_Stores&nbsp;<sub>(5)</sub></th>\n",
       "      <td id=\"T_a833d_row16_col0\" class=\"data row16 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row16_col1\" class=\"data row16 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row16_col3\" class=\"data row16 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row16_col4\" class=\"data row16 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row16_col5\" class=\"data row16 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row17\" class=\"row_heading level0 row17\" >T1547.001-Registry_Run_Keys_/_Startup_Folder</th>\n",
       "      <td id=\"T_a833d_row17_col0\" class=\"data row17 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row17_col2\" class=\"data row17 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row17_col3\" class=\"data row17 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row17_col4\" class=\"data row17 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row17_col5\" class=\"data row17 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row18\" class=\"row_heading level0 row18\" >T1555.003-Credentials_from_Web_Browsers</th>\n",
       "      <td id=\"T_a833d_row18_col0\" class=\"data row18 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row18_col2\" class=\"data row18 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row18_col3\" class=\"data row18 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row18_col4\" class=\"data row18 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row18_col5\" class=\"data row18 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row19\" class=\"row_heading level0 row19\" >T1112-Modify_Registry</th>\n",
       "      <td id=\"T_a833d_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row19_col2\" class=\"data row19 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row19_col3\" class=\"data row19 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row19_col4\" class=\"data row19 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row19_col5\" class=\"data row19 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row20\" class=\"row_heading level0 row20\" >T1071-Application_Layer_Protocol&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_a833d_row20_col0\" class=\"data row20 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row20_col2\" class=\"data row20 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row20_col3\" class=\"data row20 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row20_col4\" class=\"data row20 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row20_col5\" class=\"data row20 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row21\" class=\"row_heading level0 row21\" >T1547-Boot_or_Logon_Autostart_Execution&nbsp;<sub>(14)</sub></th>\n",
       "      <td id=\"T_a833d_row21_col0\" class=\"data row21 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row21_col2\" class=\"data row21 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row21_col3\" class=\"data row21 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row21_col4\" class=\"data row21 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row21_col5\" class=\"data row21 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row22\" class=\"row_heading level0 row22\" >T1055-Process_Injection&nbsp;<sub>(12)</sub></th>\n",
       "      <td id=\"T_a833d_row22_col0\" class=\"data row22 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row22_col1\" class=\"data row22 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row22_col2\" class=\"data row22 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row22_col3\" class=\"data row22 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row22_col4\" class=\"data row22 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row22_col5\" class=\"data row22 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row23\" class=\"row_heading level0 row23\" >T1049-System_Network_Connections_Discovery</th>\n",
       "      <td id=\"T_a833d_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row23_col1\" class=\"data row23 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row23_col2\" class=\"data row23 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row23_col3\" class=\"data row23 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row23_col4\" class=\"data row23 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row23_col5\" class=\"data row23 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row24\" class=\"row_heading level0 row24\" >T1592-Gather_Victim_Host_Information&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_a833d_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row24_col1\" class=\"data row24 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row24_col2\" class=\"data row24 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row24_col3\" class=\"data row24 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row24_col4\" class=\"data row24 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row24_col5\" class=\"data row24 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row25\" class=\"row_heading level0 row25\" >T1021-Remote_Services&nbsp;<sub>(6)</sub></th>\n",
       "      <td id=\"T_a833d_row25_col0\" class=\"data row25 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row25_col1\" class=\"data row25 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row25_col2\" class=\"data row25 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row25_col3\" class=\"data row25 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row25_col4\" class=\"data row25 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row25_col5\" class=\"data row25 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row26\" class=\"row_heading level0 row26\" >T1027-Obfuscated_Files_or_Information&nbsp;<sub>(9)</sub></th>\n",
       "      <td id=\"T_a833d_row26_col0\" class=\"data row26 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row26_col1\" class=\"data row26 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row26_col2\" class=\"data row26 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row26_col3\" class=\"data row26 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row26_col4\" class=\"data row26 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row26_col5\" class=\"data row26 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row27\" class=\"row_heading level0 row27\" >T1055.001-Dynamic-link_Library_Injection</th>\n",
       "      <td id=\"T_a833d_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row27_col1\" class=\"data row27 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row27_col2\" class=\"data row27 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row27_col3\" class=\"data row27 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row27_col4\" class=\"data row27 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row27_col5\" class=\"data row27 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row28\" class=\"row_heading level0 row28\" >T1590-Gather_Victim_Network_Information&nbsp;<sub>(6)</sub></th>\n",
       "      <td id=\"T_a833d_row28_col0\" class=\"data row28 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row28_col2\" class=\"data row28 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row28_col3\" class=\"data row28 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row28_col4\" class=\"data row28 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row28_col5\" class=\"data row28 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row29\" class=\"row_heading level0 row29\" >T1059.003-Windows_Command_Shell</th>\n",
       "      <td id=\"T_a833d_row29_col0\" class=\"data row29 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row29_col1\" class=\"data row29 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row29_col2\" class=\"data row29 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row29_col3\" class=\"data row29 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row29_col4\" class=\"data row29 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row29_col5\" class=\"data row29 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row30\" class=\"row_heading level0 row30\" >T1218.010-Regsvr32</th>\n",
       "      <td id=\"T_a833d_row30_col0\" class=\"data row30 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row30_col1\" class=\"data row30 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row30_col2\" class=\"data row30 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row30_col3\" class=\"data row30 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row30_col4\" class=\"data row30 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row30_col5\" class=\"data row30 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row31\" class=\"row_heading level0 row31\" >T1590.005-IP_Addresses</th>\n",
       "      <td id=\"T_a833d_row31_col0\" class=\"data row31 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row31_col1\" class=\"data row31 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row31_col2\" class=\"data row31 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row31_col3\" class=\"data row31 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row31_col4\" class=\"data row31 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row31_col5\" class=\"data row31 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row32\" class=\"row_heading level0 row32\" >T1059.007-JavaScript</th>\n",
       "      <td id=\"T_a833d_row32_col0\" class=\"data row32 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row32_col1\" class=\"data row32 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row32_col2\" class=\"data row32 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row32_col3\" class=\"data row32 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row32_col4\" class=\"data row32 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row32_col5\" class=\"data row32 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row33\" class=\"row_heading level0 row33\" >T1569-System_Services&nbsp;<sub>(2)</sub></th>\n",
       "      <td id=\"T_a833d_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row33_col1\" class=\"data row33 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row33_col2\" class=\"data row33 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row33_col3\" class=\"data row33 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row33_col4\" class=\"data row33 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row33_col5\" class=\"data row33 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row34\" class=\"row_heading level0 row34\" >T1569.002-Service_Execution</th>\n",
       "      <td id=\"T_a833d_row34_col0\" class=\"data row34 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row34_col2\" class=\"data row34 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row34_col3\" class=\"data row34 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row34_col4\" class=\"data row34 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row34_col5\" class=\"data row34 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row35\" class=\"row_heading level0 row35\" >T1087.002-Domain_Account</th>\n",
       "      <td id=\"T_a833d_row35_col0\" class=\"data row35 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row35_col1\" class=\"data row35 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row35_col2\" class=\"data row35 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row35_col3\" class=\"data row35 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row35_col4\" class=\"data row35 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row35_col5\" class=\"data row35 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row36\" class=\"row_heading level0 row36\" >T1087-Account_Discovery&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_a833d_row36_col0\" class=\"data row36 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row36_col1\" class=\"data row36 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row36_col2\" class=\"data row36 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row36_col3\" class=\"data row36 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row36_col4\" class=\"data row36 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row36_col5\" class=\"data row36 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row37\" class=\"row_heading level0 row37\" >T1218.011-Rundll32</th>\n",
       "      <td id=\"T_a833d_row37_col0\" class=\"data row37 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row37_col1\" class=\"data row37 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row37_col2\" class=\"data row37 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row37_col3\" class=\"data row37 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row37_col4\" class=\"data row37 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row37_col5\" class=\"data row37 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row38\" class=\"row_heading level0 row38\" >T1218.001-Compiled_HTML_File</th>\n",
       "      <td id=\"T_a833d_row38_col0\" class=\"data row38 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row38_col1\" class=\"data row38 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row38_col2\" class=\"data row38 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row38_col3\" class=\"data row38 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row38_col4\" class=\"data row38 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row38_col5\" class=\"data row38 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row39\" class=\"row_heading level0 row39\" >T1021.002-SMB/Windows_Admin_Shares</th>\n",
       "      <td id=\"T_a833d_row39_col0\" class=\"data row39 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row39_col1\" class=\"data row39 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row39_col2\" class=\"data row39 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row39_col3\" class=\"data row39 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row39_col4\" class=\"data row39 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row39_col5\" class=\"data row39 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row40\" class=\"row_heading level0 row40\" >T1564.001-Hidden_Files_and_Directories</th>\n",
       "      <td id=\"T_a833d_row40_col0\" class=\"data row40 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row40_col1\" class=\"data row40 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row40_col2\" class=\"data row40 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row40_col3\" class=\"data row40 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row40_col4\" class=\"data row40 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row40_col5\" class=\"data row40 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row41\" class=\"row_heading level0 row41\" >T1482-Domain_Trust_Discovery</th>\n",
       "      <td id=\"T_a833d_row41_col0\" class=\"data row41 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row41_col1\" class=\"data row41 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row41_col2\" class=\"data row41 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row41_col3\" class=\"data row41 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row41_col4\" class=\"data row41 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row41_col5\" class=\"data row41 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row42\" class=\"row_heading level0 row42\" >T1564-Hide_Artifacts&nbsp;<sub>(10)</sub></th>\n",
       "      <td id=\"T_a833d_row42_col0\" class=\"data row42 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row42_col1\" class=\"data row42 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row42_col2\" class=\"data row42 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row42_col3\" class=\"data row42 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row42_col4\" class=\"data row42 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row42_col5\" class=\"data row42 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row43\" class=\"row_heading level0 row43\" >T1559.001-Component_Object_Model</th>\n",
       "      <td id=\"T_a833d_row43_col0\" class=\"data row43 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row43_col1\" class=\"data row43 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row43_col2\" class=\"data row43 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row43_col3\" class=\"data row43 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row43_col4\" class=\"data row43 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row43_col5\" class=\"data row43 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row44\" class=\"row_heading level0 row44\" >T1566.002-Spearphishing_Link</th>\n",
       "      <td id=\"T_a833d_row44_col0\" class=\"data row44 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row44_col1\" class=\"data row44 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row44_col2\" class=\"data row44 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row44_col3\" class=\"data row44 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row44_col4\" class=\"data row44 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row44_col5\" class=\"data row44 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row45\" class=\"row_heading level0 row45\" >T1222.001-Windows_File_and_Directory_Permissions_Modification</th>\n",
       "      <td id=\"T_a833d_row45_col0\" class=\"data row45 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row45_col1\" class=\"data row45 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row45_col2\" class=\"data row45 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row45_col3\" class=\"data row45 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row45_col4\" class=\"data row45 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row45_col5\" class=\"data row45 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row46\" class=\"row_heading level0 row46\" >T1134.004-Parent_PID_Spoofing</th>\n",
       "      <td id=\"T_a833d_row46_col0\" class=\"data row46 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row46_col1\" class=\"data row46 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row46_col2\" class=\"data row46 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row46_col3\" class=\"data row46 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row46_col4\" class=\"data row46 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row46_col5\" class=\"data row46 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row47\" class=\"row_heading level0 row47\" >T1134-Access_Token_Manipulation&nbsp;<sub>(5)</sub></th>\n",
       "      <td id=\"T_a833d_row47_col0\" class=\"data row47 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row47_col1\" class=\"data row47 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row47_col2\" class=\"data row47 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row47_col3\" class=\"data row47 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row47_col4\" class=\"data row47 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row47_col5\" class=\"data row47 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row48\" class=\"row_heading level0 row48\" >T1574.001-DLL_Search_Order_Hijacking</th>\n",
       "      <td id=\"T_a833d_row48_col0\" class=\"data row48 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row48_col1\" class=\"data row48 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row48_col2\" class=\"data row48 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row48_col3\" class=\"data row48 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row48_col4\" class=\"data row48 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row48_col5\" class=\"data row48 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row49\" class=\"row_heading level0 row49\" >T1069-Permission_Groups_Discovery&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_a833d_row49_col0\" class=\"data row49 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row49_col1\" class=\"data row49 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row49_col2\" class=\"data row49 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row49_col3\" class=\"data row49 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row49_col4\" class=\"data row49 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row49_col5\" class=\"data row49 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row50\" class=\"row_heading level0 row50\" >T1069.001-Local_Groups</th>\n",
       "      <td id=\"T_a833d_row50_col0\" class=\"data row50 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row50_col1\" class=\"data row50 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row50_col2\" class=\"data row50 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row50_col3\" class=\"data row50 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row50_col4\" class=\"data row50 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row50_col5\" class=\"data row50 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row51\" class=\"row_heading level0 row51\" >T1059.005-Visual_Basic</th>\n",
       "      <td id=\"T_a833d_row51_col0\" class=\"data row51 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row51_col1\" class=\"data row51 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row51_col2\" class=\"data row51 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row51_col3\" class=\"data row51 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row51_col4\" class=\"data row51 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row51_col5\" class=\"data row51 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row52\" class=\"row_heading level0 row52\" >T1021.001-Remote_Desktop_Protocol</th>\n",
       "      <td id=\"T_a833d_row52_col0\" class=\"data row52 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row52_col1\" class=\"data row52 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row52_col2\" class=\"data row52 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row52_col3\" class=\"data row52 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row52_col4\" class=\"data row52 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row52_col5\" class=\"data row52 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row53\" class=\"row_heading level0 row53\" >T1531-Account_Access_Removal</th>\n",
       "      <td id=\"T_a833d_row53_col0\" class=\"data row53 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row53_col1\" class=\"data row53 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row53_col2\" class=\"data row53 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row53_col3\" class=\"data row53 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row53_col4\" class=\"data row53 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row53_col5\" class=\"data row53 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row54\" class=\"row_heading level0 row54\" >T1036.003-Rename_System_Utilities</th>\n",
       "      <td id=\"T_a833d_row54_col0\" class=\"data row54 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row54_col1\" class=\"data row54 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row54_col2\" class=\"data row54 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row54_col3\" class=\"data row54 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row54_col4\" class=\"data row54 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row54_col5\" class=\"data row54 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row55\" class=\"row_heading level0 row55\" >T1489-Service_Stop</th>\n",
       "      <td id=\"T_a833d_row55_col0\" class=\"data row55 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row55_col2\" class=\"data row55 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row55_col3\" class=\"data row55 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row55_col4\" class=\"data row55 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row55_col5\" class=\"data row55 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row56\" class=\"row_heading level0 row56\" >T1222-File_and_Directory_Permissions_Modification&nbsp;<sub>(2)</sub></th>\n",
       "      <td id=\"T_a833d_row56_col0\" class=\"data row56 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row56_col2\" class=\"data row56 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row56_col3\" class=\"data row56 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row56_col4\" class=\"data row56 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row56_col5\" class=\"data row56 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row57\" class=\"row_heading level0 row57\" >T1562.004-Disable_or_Modify_System_Firewall</th>\n",
       "      <td id=\"T_a833d_row57_col0\" class=\"data row57 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row57_col1\" class=\"data row57 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row57_col2\" class=\"data row57 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row57_col3\" class=\"data row57 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row57_col4\" class=\"data row57 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row57_col5\" class=\"data row57 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row58\" class=\"row_heading level0 row58\" >T1047-Windows_Management_Instrumentation</th>\n",
       "      <td id=\"T_a833d_row58_col0\" class=\"data row58 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row58_col1\" class=\"data row58 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row58_col2\" class=\"data row58 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row58_col3\" class=\"data row58 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row58_col4\" class=\"data row58 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row58_col5\" class=\"data row58 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row59\" class=\"row_heading level0 row59\" >T1574.002-DLL_Side-Loading</th>\n",
       "      <td id=\"T_a833d_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row59_col1\" class=\"data row59 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row59_col2\" class=\"data row59 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row59_col3\" class=\"data row59 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row59_col4\" class=\"data row59 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row59_col5\" class=\"data row59 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row60\" class=\"row_heading level0 row60\" >T1574-Hijack_Execution_Flow&nbsp;<sub>(12)</sub></th>\n",
       "      <td id=\"T_a833d_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row60_col1\" class=\"data row60 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row60_col2\" class=\"data row60 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row60_col3\" class=\"data row60 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row60_col4\" class=\"data row60 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row60_col5\" class=\"data row60 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row61\" class=\"row_heading level0 row61\" >T1113-Screen_Capture</th>\n",
       "      <td id=\"T_a833d_row61_col0\" class=\"data row61 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row61_col1\" class=\"data row61 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row61_col2\" class=\"data row61 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row61_col3\" class=\"data row61 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row61_col4\" class=\"data row61 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row61_col5\" class=\"data row61 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row62\" class=\"row_heading level0 row62\" >T1016-System_Network_Configuration_Discovery&nbsp;<sub>(1)</sub></th>\n",
       "      <td id=\"T_a833d_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row62_col1\" class=\"data row62 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row62_col2\" class=\"data row62 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row62_col3\" class=\"data row62 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row62_col4\" class=\"data row62 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row62_col5\" class=\"data row62 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row63\" class=\"row_heading level0 row63\" >T1033-System_Owner/User_Discovery</th>\n",
       "      <td id=\"T_a833d_row63_col0\" class=\"data row63 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row63_col1\" class=\"data row63 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row63_col2\" class=\"data row63 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row63_col3\" class=\"data row63 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row63_col4\" class=\"data row63 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row63_col5\" class=\"data row63 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row64\" class=\"row_heading level0 row64\" >T1218.005-Mshta</th>\n",
       "      <td id=\"T_a833d_row64_col0\" class=\"data row64 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row64_col1\" class=\"data row64 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row64_col2\" class=\"data row64 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row64_col3\" class=\"data row64 col3\" >yes</td>\n",
       "      <td id=\"T_a833d_row64_col4\" class=\"data row64 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row64_col5\" class=\"data row64 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row65\" class=\"row_heading level0 row65\" >T1014-Rootkit</th>\n",
       "      <td id=\"T_a833d_row65_col0\" class=\"data row65 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row65_col1\" class=\"data row65 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row65_col2\" class=\"data row65 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row65_col3\" class=\"data row65 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row65_col4\" class=\"data row65 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row65_col5\" class=\"data row65 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row66\" class=\"row_heading level0 row66\" >T1068-Exploitation_for_Privilege_Escalation</th>\n",
       "      <td id=\"T_a833d_row66_col0\" class=\"data row66 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row66_col1\" class=\"data row66 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row66_col2\" class=\"data row66 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row66_col3\" class=\"data row66 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row66_col4\" class=\"data row66 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row66_col5\" class=\"data row66 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row67\" class=\"row_heading level0 row67\" >T1219-Remote_Access_Software</th>\n",
       "      <td id=\"T_a833d_row67_col0\" class=\"data row67 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row67_col1\" class=\"data row67 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row67_col2\" class=\"data row67 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row67_col3\" class=\"data row67 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row67_col4\" class=\"data row67 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row67_col5\" class=\"data row67 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row68\" class=\"row_heading level0 row68\" >T1055.002-Portable_Executable_Injection</th>\n",
       "      <td id=\"T_a833d_row68_col0\" class=\"data row68 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row68_col1\" class=\"data row68 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row68_col2\" class=\"data row68 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row68_col3\" class=\"data row68 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row68_col4\" class=\"data row68 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row68_col5\" class=\"data row68 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row69\" class=\"row_heading level0 row69\" >T1136.001-Local_Account</th>\n",
       "      <td id=\"T_a833d_row69_col0\" class=\"data row69 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row69_col1\" class=\"data row69 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row69_col2\" class=\"data row69 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row69_col3\" class=\"data row69 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row69_col4\" class=\"data row69 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row69_col5\" class=\"data row69 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row70\" class=\"row_heading level0 row70\" >T1136-Create_Account&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_a833d_row70_col0\" class=\"data row70 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row70_col1\" class=\"data row70 col1\" >yes</td>\n",
       "      <td id=\"T_a833d_row70_col2\" class=\"data row70 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row70_col3\" class=\"data row70 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row70_col4\" class=\"data row70 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row70_col5\" class=\"data row70 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row71\" class=\"row_heading level0 row71\" >T1070-Indicator_Removal&nbsp;<sub>(9)</sub></th>\n",
       "      <td id=\"T_a833d_row71_col0\" class=\"data row71 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row71_col1\" class=\"data row71 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row71_col2\" class=\"data row71 col2\" >yes</td>\n",
       "      <td id=\"T_a833d_row71_col3\" class=\"data row71 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row71_col4\" class=\"data row71 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row71_col5\" class=\"data row71 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row72\" class=\"row_heading level0 row72\" >T1071.003-Mail_Protocols</th>\n",
       "      <td id=\"T_a833d_row72_col0\" class=\"data row72 col0\" >no</td>\n",
       "      <td id=\"T_a833d_row72_col1\" class=\"data row72 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row72_col2\" class=\"data row72 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row72_col3\" class=\"data row72 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row72_col4\" class=\"data row72 col4\" >yes</td>\n",
       "      <td id=\"T_a833d_row72_col5\" class=\"data row72 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_a833d_level0_row73\" class=\"row_heading level0 row73\" >T1016.001-Internet_Connection_Discovery</th>\n",
       "      <td id=\"T_a833d_row73_col0\" class=\"data row73 col0\" >yes</td>\n",
       "      <td id=\"T_a833d_row73_col1\" class=\"data row73 col1\" >no</td>\n",
       "      <td id=\"T_a833d_row73_col2\" class=\"data row73 col2\" >no</td>\n",
       "      <td id=\"T_a833d_row73_col3\" class=\"data row73 col3\" >no</td>\n",
       "      <td id=\"T_a833d_row73_col4\" class=\"data row73 col4\" >no</td>\n",
       "      <td id=\"T_a833d_row73_col5\" class=\"data row73 col5\" >1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c2527f0>"
      ]
     },
     "execution_count": 47,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "\n",
    "\n",
    "new_table = yes_no_table(mitre_attack_tid_name_dict, story_name_list)\n",
    "tdf = pd.DataFrame.from_dict(new_table, orient=\"index\")\n",
    "tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n",
    "print(tdf.shape)\n",
    "tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n",
    "tdf.style.apply(highlight_rows, axis=1) "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "id": "3f48e979-531c-466c-a299-1282cff990df",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(7, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_f136c_row0_col0, #T_f136c_row0_col1, #T_f136c_row0_col2, #T_f136c_row0_col3, #T_f136c_row0_col4, #T_f136c_row0_col5, #T_f136c_row1_col0, #T_f136c_row1_col1, #T_f136c_row1_col2, #T_f136c_row1_col3, #T_f136c_row1_col4, #T_f136c_row1_col5, #T_f136c_row2_col0, #T_f136c_row2_col1, #T_f136c_row2_col2, #T_f136c_row2_col3, #T_f136c_row2_col4, #T_f136c_row2_col5, #T_f136c_row3_col0, #T_f136c_row3_col1, #T_f136c_row3_col2, #T_f136c_row3_col3, #T_f136c_row3_col4, #T_f136c_row3_col5, #T_f136c_row4_col0, #T_f136c_row4_col1, #T_f136c_row4_col2, #T_f136c_row4_col3, #T_f136c_row4_col4, #T_f136c_row4_col5, #T_f136c_row5_col0, #T_f136c_row5_col1, #T_f136c_row5_col2, #T_f136c_row5_col3, #T_f136c_row5_col4, #T_f136c_row5_col5, #T_f136c_row6_col0, #T_f136c_row6_col1, #T_f136c_row6_col2, #T_f136c_row6_col3, #T_f136c_row6_col4, #T_f136c_row6_col5 {\n",
       "  background-color: yellow;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_f136c\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_f136c_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_f136c_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_f136c_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_f136c_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_f136c_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_f136c_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_f136c_level0_row0\" class=\"row_heading level0 row0\" >T1562.001-Disable_or_Modify_Tools</th>\n",
       "      <td id=\"T_f136c_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_f136c_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_f136c_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
       "      <td id=\"T_f136c_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_f136c_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_f136c_row0_col5\" class=\"data row0 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_f136c_level0_row1\" class=\"row_heading level0 row1\" >T1036-Masquerading&nbsp;<sub>(7)</sub></th>\n",
       "      <td id=\"T_f136c_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_f136c_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_f136c_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_f136c_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_f136c_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_f136c_row1_col5\" class=\"data row1 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_f136c_level0_row2\" class=\"row_heading level0 row2\" >T1566-Phishing&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_f136c_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_f136c_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_f136c_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_f136c_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_f136c_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_f136c_row2_col5\" class=\"data row2 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_f136c_level0_row3\" class=\"row_heading level0 row3\" >T1566.001-Spearphishing_Attachment</th>\n",
       "      <td id=\"T_f136c_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_f136c_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_f136c_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_f136c_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_f136c_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_f136c_row3_col5\" class=\"data row3 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_f136c_level0_row4\" class=\"row_heading level0 row4\" >T1562-Impair_Defenses&nbsp;<sub>(9)</sub></th>\n",
       "      <td id=\"T_f136c_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_f136c_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_f136c_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_f136c_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_f136c_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_f136c_row4_col5\" class=\"data row4 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_f136c_level0_row5\" class=\"row_heading level0 row5\" >T1543-Create_or_Modify_System_Process&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_f136c_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_f136c_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_f136c_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
       "      <td id=\"T_f136c_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
       "      <td id=\"T_f136c_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
       "      <td id=\"T_f136c_row5_col5\" class=\"data row5 col5\" >5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_f136c_level0_row6\" class=\"row_heading level0 row6\" >T1059-Command_and_Scripting_Interpreter&nbsp;<sub>(8)</sub></th>\n",
       "      <td id=\"T_f136c_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_f136c_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_f136c_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
       "      <td id=\"T_f136c_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
       "      <td id=\"T_f136c_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_f136c_row6_col5\" class=\"data row6 col5\" >5</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c221ca0>"
      ]
     },
     "execution_count": 48,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 5]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "id": "21f3b96f-b020-49ee-97a9-579196ba6a99",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(5, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_5ffcc_row0_col0, #T_5ffcc_row0_col1, #T_5ffcc_row0_col2, #T_5ffcc_row0_col3, #T_5ffcc_row0_col4, #T_5ffcc_row0_col5, #T_5ffcc_row1_col0, #T_5ffcc_row1_col1, #T_5ffcc_row1_col2, #T_5ffcc_row1_col3, #T_5ffcc_row1_col4, #T_5ffcc_row1_col5, #T_5ffcc_row2_col0, #T_5ffcc_row2_col1, #T_5ffcc_row2_col2, #T_5ffcc_row2_col3, #T_5ffcc_row2_col4, #T_5ffcc_row2_col5, #T_5ffcc_row3_col0, #T_5ffcc_row3_col1, #T_5ffcc_row3_col2, #T_5ffcc_row3_col3, #T_5ffcc_row3_col4, #T_5ffcc_row3_col5, #T_5ffcc_row4_col0, #T_5ffcc_row4_col1, #T_5ffcc_row4_col2, #T_5ffcc_row4_col3, #T_5ffcc_row4_col4, #T_5ffcc_row4_col5 {\n",
       "  background-color: orange;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_5ffcc\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_5ffcc_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_5ffcc_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_5ffcc_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_5ffcc_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_5ffcc_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_5ffcc_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_5ffcc_level0_row0\" class=\"row_heading level0 row0\" >T1053.005-Scheduled_Task</th>\n",
       "      <td id=\"T_5ffcc_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_5ffcc_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row0_col5\" class=\"data row0 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_5ffcc_level0_row1\" class=\"row_heading level0 row1\" >T1204.001-Malicious_Link</th>\n",
       "      <td id=\"T_5ffcc_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_5ffcc_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row1_col5\" class=\"data row1 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_5ffcc_level0_row2\" class=\"row_heading level0 row2\" >T1204-User_Execution&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_5ffcc_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row2_col3\" class=\"data row2 col3\" >no</td>\n",
       "      <td id=\"T_5ffcc_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row2_col5\" class=\"data row2 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_5ffcc_level0_row3\" class=\"row_heading level0 row3\" >T1053-Scheduled_Task/Job&nbsp;<sub>(5)</sub></th>\n",
       "      <td id=\"T_5ffcc_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_5ffcc_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row3_col5\" class=\"data row3 col5\" >4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_5ffcc_level0_row4\" class=\"row_heading level0 row4\" >T1218-System_Binary_Proxy_Execution&nbsp;<sub>(13)</sub></th>\n",
       "      <td id=\"T_5ffcc_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row4_col1\" class=\"data row4 col1\" >no</td>\n",
       "      <td id=\"T_5ffcc_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_5ffcc_row4_col5\" class=\"data row4 col5\" >4</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c25b400>"
      ]
     },
     "execution_count": 49,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 4]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "id": "22b8ad1c-1a53-41ba-bdff-6d5ed29f8ad5",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(11, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_99af6_row0_col0, #T_99af6_row0_col1, #T_99af6_row0_col2, #T_99af6_row0_col3, #T_99af6_row0_col4, #T_99af6_row0_col5, #T_99af6_row1_col0, #T_99af6_row1_col1, #T_99af6_row1_col2, #T_99af6_row1_col3, #T_99af6_row1_col4, #T_99af6_row1_col5, #T_99af6_row2_col0, #T_99af6_row2_col1, #T_99af6_row2_col2, #T_99af6_row2_col3, #T_99af6_row2_col4, #T_99af6_row2_col5, #T_99af6_row3_col0, #T_99af6_row3_col1, #T_99af6_row3_col2, #T_99af6_row3_col3, #T_99af6_row3_col4, #T_99af6_row3_col5, #T_99af6_row4_col0, #T_99af6_row4_col1, #T_99af6_row4_col2, #T_99af6_row4_col3, #T_99af6_row4_col4, #T_99af6_row4_col5, #T_99af6_row5_col0, #T_99af6_row5_col1, #T_99af6_row5_col2, #T_99af6_row5_col3, #T_99af6_row5_col4, #T_99af6_row5_col5, #T_99af6_row6_col0, #T_99af6_row6_col1, #T_99af6_row6_col2, #T_99af6_row6_col3, #T_99af6_row6_col4, #T_99af6_row6_col5, #T_99af6_row7_col0, #T_99af6_row7_col1, #T_99af6_row7_col2, #T_99af6_row7_col3, #T_99af6_row7_col4, #T_99af6_row7_col5, #T_99af6_row8_col0, #T_99af6_row8_col1, #T_99af6_row8_col2, #T_99af6_row8_col3, #T_99af6_row8_col4, #T_99af6_row8_col5, #T_99af6_row9_col0, #T_99af6_row9_col1, #T_99af6_row9_col2, #T_99af6_row9_col3, #T_99af6_row9_col4, #T_99af6_row9_col5, #T_99af6_row10_col0, #T_99af6_row10_col1, #T_99af6_row10_col2, #T_99af6_row10_col3, #T_99af6_row10_col4, #T_99af6_row10_col5 {\n",
       "  background-color: lightgreen;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_99af6\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_99af6_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_99af6_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_99af6_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_99af6_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_99af6_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_99af6_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row0\" class=\"row_heading level0 row0\" >T1543.003-Windows_Service</th>\n",
       "      <td id=\"T_99af6_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_99af6_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_99af6_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
       "      <td id=\"T_99af6_row0_col5\" class=\"data row0 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row1\" class=\"row_heading level0 row1\" >T1548.002-Bypass_User_Account_Control</th>\n",
       "      <td id=\"T_99af6_row1_col0\" class=\"data row1 col0\" >no</td>\n",
       "      <td id=\"T_99af6_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
       "      <td id=\"T_99af6_row1_col5\" class=\"data row1 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row2\" class=\"row_heading level0 row2\" >T1059.001-PowerShell</th>\n",
       "      <td id=\"T_99af6_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
       "      <td id=\"T_99af6_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_99af6_row2_col3\" class=\"data row2 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
       "      <td id=\"T_99af6_row2_col5\" class=\"data row2 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row3\" class=\"row_heading level0 row3\" >T1548-Abuse_Elevation_Control_Mechanism&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_99af6_row3_col0\" class=\"data row3 col0\" >no</td>\n",
       "      <td id=\"T_99af6_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row3_col3\" class=\"data row3 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_99af6_row3_col5\" class=\"data row3 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row4\" class=\"row_heading level0 row4\" >T1555-Credentials_from_Password_Stores&nbsp;<sub>(5)</sub></th>\n",
       "      <td id=\"T_99af6_row4_col0\" class=\"data row4 col0\" >no</td>\n",
       "      <td id=\"T_99af6_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row4_col3\" class=\"data row4 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
       "      <td id=\"T_99af6_row4_col5\" class=\"data row4 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row5\" class=\"row_heading level0 row5\" >T1547.001-Registry_Run_Keys_/_Startup_Folder</th>\n",
       "      <td id=\"T_99af6_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
       "      <td id=\"T_99af6_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row5_col3\" class=\"data row5 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_99af6_row5_col5\" class=\"data row5 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row6\" class=\"row_heading level0 row6\" >T1555.003-Credentials_from_Web_Browsers</th>\n",
       "      <td id=\"T_99af6_row6_col0\" class=\"data row6 col0\" >no</td>\n",
       "      <td id=\"T_99af6_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row6_col3\" class=\"data row6 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
       "      <td id=\"T_99af6_row6_col5\" class=\"data row6 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row7\" class=\"row_heading level0 row7\" >T1112-Modify_Registry</th>\n",
       "      <td id=\"T_99af6_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
       "      <td id=\"T_99af6_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_99af6_row7_col5\" class=\"data row7 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row8\" class=\"row_heading level0 row8\" >T1071-Application_Layer_Protocol&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_99af6_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
       "      <td id=\"T_99af6_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row8_col2\" class=\"data row8 col2\" >no</td>\n",
       "      <td id=\"T_99af6_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
       "      <td id=\"T_99af6_row8_col5\" class=\"data row8 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row9\" class=\"row_heading level0 row9\" >T1547-Boot_or_Logon_Autostart_Execution&nbsp;<sub>(14)</sub></th>\n",
       "      <td id=\"T_99af6_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_99af6_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
       "      <td id=\"T_99af6_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_99af6_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_99af6_row9_col5\" class=\"data row9 col5\" >3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_99af6_level0_row10\" class=\"row_heading level0 row10\" >T1055-Process_Injection&nbsp;<sub>(12)</sub></th>\n",
       "      <td id=\"T_99af6_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
       "      <td id=\"T_99af6_row10_col1\" class=\"data row10 col1\" >no</td>\n",
       "      <td id=\"T_99af6_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
       "      <td id=\"T_99af6_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
       "      <td id=\"T_99af6_row10_col4\" class=\"data row10 col4\" >no</td>\n",
       "      <td id=\"T_99af6_row10_col5\" class=\"data row10 col5\" >3</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c25bee0>"
      ]
     },
     "execution_count": 50,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 3]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 51,
   "id": "fb52fd1f-f949-4caf-a0e3-e0a40ebffb85",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(12, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_6d5e4_row0_col0, #T_6d5e4_row0_col1, #T_6d5e4_row0_col2, #T_6d5e4_row0_col3, #T_6d5e4_row0_col4, #T_6d5e4_row0_col5, #T_6d5e4_row1_col0, #T_6d5e4_row1_col1, #T_6d5e4_row1_col2, #T_6d5e4_row1_col3, #T_6d5e4_row1_col4, #T_6d5e4_row1_col5, #T_6d5e4_row2_col0, #T_6d5e4_row2_col1, #T_6d5e4_row2_col2, #T_6d5e4_row2_col3, #T_6d5e4_row2_col4, #T_6d5e4_row2_col5, #T_6d5e4_row3_col0, #T_6d5e4_row3_col1, #T_6d5e4_row3_col2, #T_6d5e4_row3_col3, #T_6d5e4_row3_col4, #T_6d5e4_row3_col5, #T_6d5e4_row4_col0, #T_6d5e4_row4_col1, #T_6d5e4_row4_col2, #T_6d5e4_row4_col3, #T_6d5e4_row4_col4, #T_6d5e4_row4_col5, #T_6d5e4_row5_col0, #T_6d5e4_row5_col1, #T_6d5e4_row5_col2, #T_6d5e4_row5_col3, #T_6d5e4_row5_col4, #T_6d5e4_row5_col5, #T_6d5e4_row6_col0, #T_6d5e4_row6_col1, #T_6d5e4_row6_col2, #T_6d5e4_row6_col3, #T_6d5e4_row6_col4, #T_6d5e4_row6_col5, #T_6d5e4_row7_col0, #T_6d5e4_row7_col1, #T_6d5e4_row7_col2, #T_6d5e4_row7_col3, #T_6d5e4_row7_col4, #T_6d5e4_row7_col5, #T_6d5e4_row8_col0, #T_6d5e4_row8_col1, #T_6d5e4_row8_col2, #T_6d5e4_row8_col3, #T_6d5e4_row8_col4, #T_6d5e4_row8_col5, #T_6d5e4_row9_col0, #T_6d5e4_row9_col1, #T_6d5e4_row9_col2, #T_6d5e4_row9_col3, #T_6d5e4_row9_col4, #T_6d5e4_row9_col5, #T_6d5e4_row10_col0, #T_6d5e4_row10_col1, #T_6d5e4_row10_col2, #T_6d5e4_row10_col3, #T_6d5e4_row10_col4, #T_6d5e4_row10_col5, #T_6d5e4_row11_col0, #T_6d5e4_row11_col1, #T_6d5e4_row11_col2, #T_6d5e4_row11_col3, #T_6d5e4_row11_col4, #T_6d5e4_row11_col5 {\n",
       "  background-color: lightblue;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_6d5e4\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_6d5e4_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_6d5e4_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_6d5e4_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_6d5e4_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_6d5e4_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_6d5e4_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row0\" class=\"row_heading level0 row0\" >T1049-System_Network_Connections_Discovery</th>\n",
       "      <td id=\"T_6d5e4_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row0_col3\" class=\"data row0 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row0_col4\" class=\"data row0 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row0_col5\" class=\"data row0 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row1\" class=\"row_heading level0 row1\" >T1592-Gather_Victim_Host_Information&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_6d5e4_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row1_col1\" class=\"data row1 col1\" >no</td>\n",
       "      <td id=\"T_6d5e4_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row1_col3\" class=\"data row1 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row1_col4\" class=\"data row1 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row1_col5\" class=\"data row1 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row2\" class=\"row_heading level0 row2\" >T1021-Remote_Services&nbsp;<sub>(6)</sub></th>\n",
       "      <td id=\"T_6d5e4_row2_col0\" class=\"data row2 col0\" >no</td>\n",
       "      <td id=\"T_6d5e4_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row2_col4\" class=\"data row2 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row2_col5\" class=\"data row2 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row3\" class=\"row_heading level0 row3\" >T1027-Obfuscated_Files_or_Information&nbsp;<sub>(9)</sub></th>\n",
       "      <td id=\"T_6d5e4_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row3_col1\" class=\"data row3 col1\" >no</td>\n",
       "      <td id=\"T_6d5e4_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row3_col4\" class=\"data row3 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row3_col5\" class=\"data row3 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row4\" class=\"row_heading level0 row4\" >T1055.001-Dynamic-link_Library_Injection</th>\n",
       "      <td id=\"T_6d5e4_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row4_col1\" class=\"data row4 col1\" >no</td>\n",
       "      <td id=\"T_6d5e4_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row4_col3\" class=\"data row4 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row4_col4\" class=\"data row4 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row4_col5\" class=\"data row4 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row5\" class=\"row_heading level0 row5\" >T1590-Gather_Victim_Network_Information&nbsp;<sub>(6)</sub></th>\n",
       "      <td id=\"T_6d5e4_row5_col0\" class=\"data row5 col0\" >no</td>\n",
       "      <td id=\"T_6d5e4_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row5_col2\" class=\"data row5 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row5_col5\" class=\"data row5 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row6\" class=\"row_heading level0 row6\" >T1059.003-Windows_Command_Shell</th>\n",
       "      <td id=\"T_6d5e4_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row6_col2\" class=\"data row6 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row6_col3\" class=\"data row6 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row6_col4\" class=\"data row6 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row6_col5\" class=\"data row6 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row7\" class=\"row_heading level0 row7\" >T1218.010-Regsvr32</th>\n",
       "      <td id=\"T_6d5e4_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row7_col1\" class=\"data row7 col1\" >no</td>\n",
       "      <td id=\"T_6d5e4_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row7_col5\" class=\"data row7 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row8\" class=\"row_heading level0 row8\" >T1590.005-IP_Addresses</th>\n",
       "      <td id=\"T_6d5e4_row8_col0\" class=\"data row8 col0\" >no</td>\n",
       "      <td id=\"T_6d5e4_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row8_col2\" class=\"data row8 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row8_col3\" class=\"data row8 col3\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row8_col4\" class=\"data row8 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row8_col5\" class=\"data row8 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row9\" class=\"row_heading level0 row9\" >T1059.007-JavaScript</th>\n",
       "      <td id=\"T_6d5e4_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row9_col1\" class=\"data row9 col1\" >no</td>\n",
       "      <td id=\"T_6d5e4_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row9_col5\" class=\"data row9 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row10\" class=\"row_heading level0 row10\" >T1569-System_Services&nbsp;<sub>(2)</sub></th>\n",
       "      <td id=\"T_6d5e4_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row10_col2\" class=\"data row10 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row10_col3\" class=\"data row10 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row10_col4\" class=\"data row10 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row10_col5\" class=\"data row10 col5\" >2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_6d5e4_level0_row11\" class=\"row_heading level0 row11\" >T1569.002-Service_Execution</th>\n",
       "      <td id=\"T_6d5e4_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row11_col1\" class=\"data row11 col1\" >yes</td>\n",
       "      <td id=\"T_6d5e4_row11_col2\" class=\"data row11 col2\" >no</td>\n",
       "      <td id=\"T_6d5e4_row11_col3\" class=\"data row11 col3\" >no</td>\n",
       "      <td id=\"T_6d5e4_row11_col4\" class=\"data row11 col4\" >no</td>\n",
       "      <td id=\"T_6d5e4_row11_col5\" class=\"data row11 col5\" >2</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c25b280>"
      ]
     },
     "execution_count": 51,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 2]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "id": "5533fb9c-36af-4ea1-addc-0f447f3e62dc",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(39, 6)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<style type=\"text/css\">\n",
       "#T_67af1_row0_col0, #T_67af1_row0_col1, #T_67af1_row0_col2, #T_67af1_row0_col3, #T_67af1_row0_col4, #T_67af1_row0_col5, #T_67af1_row1_col0, #T_67af1_row1_col1, #T_67af1_row1_col2, #T_67af1_row1_col3, #T_67af1_row1_col4, #T_67af1_row1_col5, #T_67af1_row2_col0, #T_67af1_row2_col1, #T_67af1_row2_col2, #T_67af1_row2_col3, #T_67af1_row2_col4, #T_67af1_row2_col5, #T_67af1_row3_col0, #T_67af1_row3_col1, #T_67af1_row3_col2, #T_67af1_row3_col3, #T_67af1_row3_col4, #T_67af1_row3_col5, #T_67af1_row4_col0, #T_67af1_row4_col1, #T_67af1_row4_col2, #T_67af1_row4_col3, #T_67af1_row4_col4, #T_67af1_row4_col5, #T_67af1_row5_col0, #T_67af1_row5_col1, #T_67af1_row5_col2, #T_67af1_row5_col3, #T_67af1_row5_col4, #T_67af1_row5_col5, #T_67af1_row6_col0, #T_67af1_row6_col1, #T_67af1_row6_col2, #T_67af1_row6_col3, #T_67af1_row6_col4, #T_67af1_row6_col5, #T_67af1_row7_col0, #T_67af1_row7_col1, #T_67af1_row7_col2, #T_67af1_row7_col3, #T_67af1_row7_col4, #T_67af1_row7_col5, #T_67af1_row8_col0, #T_67af1_row8_col1, #T_67af1_row8_col2, #T_67af1_row8_col3, #T_67af1_row8_col4, #T_67af1_row8_col5, #T_67af1_row9_col0, #T_67af1_row9_col1, #T_67af1_row9_col2, #T_67af1_row9_col3, #T_67af1_row9_col4, #T_67af1_row9_col5, #T_67af1_row10_col0, #T_67af1_row10_col1, #T_67af1_row10_col2, #T_67af1_row10_col3, #T_67af1_row10_col4, #T_67af1_row10_col5, #T_67af1_row11_col0, #T_67af1_row11_col1, #T_67af1_row11_col2, #T_67af1_row11_col3, #T_67af1_row11_col4, #T_67af1_row11_col5, #T_67af1_row12_col0, #T_67af1_row12_col1, #T_67af1_row12_col2, #T_67af1_row12_col3, #T_67af1_row12_col4, #T_67af1_row12_col5, #T_67af1_row13_col0, #T_67af1_row13_col1, #T_67af1_row13_col2, #T_67af1_row13_col3, #T_67af1_row13_col4, #T_67af1_row13_col5, #T_67af1_row14_col0, #T_67af1_row14_col1, #T_67af1_row14_col2, #T_67af1_row14_col3, #T_67af1_row14_col4, #T_67af1_row14_col5, #T_67af1_row15_col0, #T_67af1_row15_col1, #T_67af1_row15_col2, #T_67af1_row15_col3, #T_67af1_row15_col4, #T_67af1_row15_col5, #T_67af1_row16_col0, #T_67af1_row16_col1, #T_67af1_row16_col2, #T_67af1_row16_col3, #T_67af1_row16_col4, #T_67af1_row16_col5, #T_67af1_row17_col0, #T_67af1_row17_col1, #T_67af1_row17_col2, #T_67af1_row17_col3, #T_67af1_row17_col4, #T_67af1_row17_col5, #T_67af1_row18_col0, #T_67af1_row18_col1, #T_67af1_row18_col2, #T_67af1_row18_col3, #T_67af1_row18_col4, #T_67af1_row18_col5, #T_67af1_row19_col0, #T_67af1_row19_col1, #T_67af1_row19_col2, #T_67af1_row19_col3, #T_67af1_row19_col4, #T_67af1_row19_col5, #T_67af1_row20_col0, #T_67af1_row20_col1, #T_67af1_row20_col2, #T_67af1_row20_col3, #T_67af1_row20_col4, #T_67af1_row20_col5, #T_67af1_row21_col0, #T_67af1_row21_col1, #T_67af1_row21_col2, #T_67af1_row21_col3, #T_67af1_row21_col4, #T_67af1_row21_col5, #T_67af1_row22_col0, #T_67af1_row22_col1, #T_67af1_row22_col2, #T_67af1_row22_col3, #T_67af1_row22_col4, #T_67af1_row22_col5, #T_67af1_row23_col0, #T_67af1_row23_col1, #T_67af1_row23_col2, #T_67af1_row23_col3, #T_67af1_row23_col4, #T_67af1_row23_col5, #T_67af1_row24_col0, #T_67af1_row24_col1, #T_67af1_row24_col2, #T_67af1_row24_col3, #T_67af1_row24_col4, #T_67af1_row24_col5, #T_67af1_row25_col0, #T_67af1_row25_col1, #T_67af1_row25_col2, #T_67af1_row25_col3, #T_67af1_row25_col4, #T_67af1_row25_col5, #T_67af1_row26_col0, #T_67af1_row26_col1, #T_67af1_row26_col2, #T_67af1_row26_col3, #T_67af1_row26_col4, #T_67af1_row26_col5, #T_67af1_row27_col0, #T_67af1_row27_col1, #T_67af1_row27_col2, #T_67af1_row27_col3, #T_67af1_row27_col4, #T_67af1_row27_col5, #T_67af1_row28_col0, #T_67af1_row28_col1, #T_67af1_row28_col2, #T_67af1_row28_col3, #T_67af1_row28_col4, #T_67af1_row28_col5, #T_67af1_row29_col0, #T_67af1_row29_col1, #T_67af1_row29_col2, #T_67af1_row29_col3, #T_67af1_row29_col4, #T_67af1_row29_col5, #T_67af1_row30_col0, #T_67af1_row30_col1, #T_67af1_row30_col2, #T_67af1_row30_col3, #T_67af1_row30_col4, #T_67af1_row30_col5, #T_67af1_row31_col0, #T_67af1_row31_col1, #T_67af1_row31_col2, #T_67af1_row31_col3, #T_67af1_row31_col4, #T_67af1_row31_col5, #T_67af1_row32_col0, #T_67af1_row32_col1, #T_67af1_row32_col2, #T_67af1_row32_col3, #T_67af1_row32_col4, #T_67af1_row32_col5, #T_67af1_row33_col0, #T_67af1_row33_col1, #T_67af1_row33_col2, #T_67af1_row33_col3, #T_67af1_row33_col4, #T_67af1_row33_col5, #T_67af1_row34_col0, #T_67af1_row34_col1, #T_67af1_row34_col2, #T_67af1_row34_col3, #T_67af1_row34_col4, #T_67af1_row34_col5, #T_67af1_row35_col0, #T_67af1_row35_col1, #T_67af1_row35_col2, #T_67af1_row35_col3, #T_67af1_row35_col4, #T_67af1_row35_col5, #T_67af1_row36_col0, #T_67af1_row36_col1, #T_67af1_row36_col2, #T_67af1_row36_col3, #T_67af1_row36_col4, #T_67af1_row36_col5, #T_67af1_row37_col0, #T_67af1_row37_col1, #T_67af1_row37_col2, #T_67af1_row37_col3, #T_67af1_row37_col4, #T_67af1_row37_col5, #T_67af1_row38_col0, #T_67af1_row38_col1, #T_67af1_row38_col2, #T_67af1_row38_col3, #T_67af1_row38_col4, #T_67af1_row38_col5 {\n",
       "  background-color: lightgray;\n",
       "}\n",
       "</style>\n",
       "<table id=\"T_67af1\">\n",
       "  <thead>\n",
       "    <tr>\n",
       "      <th class=\"blank level0\" >&nbsp;</th>\n",
       "      <th id=\"T_67af1_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
       "      <th id=\"T_67af1_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
       "      <th id=\"T_67af1_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
       "      <th id=\"T_67af1_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
       "      <th id=\"T_67af1_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
       "      <th id=\"T_67af1_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row0\" class=\"row_heading level0 row0\" >T1087.002-Domain_Account</th>\n",
       "      <td id=\"T_67af1_row0_col0\" class=\"data row0 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row0_col1\" class=\"data row0 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row0_col2\" class=\"data row0 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
       "      <td id=\"T_67af1_row0_col4\" class=\"data row0 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row0_col5\" class=\"data row0 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row1\" class=\"row_heading level0 row1\" >T1087-Account_Discovery&nbsp;<sub>(4)</sub></th>\n",
       "      <td id=\"T_67af1_row1_col0\" class=\"data row1 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row1_col1\" class=\"data row1 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row1_col2\" class=\"data row1 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
       "      <td id=\"T_67af1_row1_col4\" class=\"data row1 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row1_col5\" class=\"data row1 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row2\" class=\"row_heading level0 row2\" >T1218.011-Rundll32</th>\n",
       "      <td id=\"T_67af1_row2_col0\" class=\"data row2 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row2_col1\" class=\"data row2 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row2_col2\" class=\"data row2 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
       "      <td id=\"T_67af1_row2_col4\" class=\"data row2 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row2_col5\" class=\"data row2 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row3\" class=\"row_heading level0 row3\" >T1218.001-Compiled_HTML_File</th>\n",
       "      <td id=\"T_67af1_row3_col0\" class=\"data row3 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row3_col1\" class=\"data row3 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row3_col2\" class=\"data row3 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row3_col3\" class=\"data row3 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
       "      <td id=\"T_67af1_row3_col5\" class=\"data row3 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row4\" class=\"row_heading level0 row4\" >T1021.002-SMB/Windows_Admin_Shares</th>\n",
       "      <td id=\"T_67af1_row4_col0\" class=\"data row4 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row4_col1\" class=\"data row4 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row4_col2\" class=\"data row4 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
       "      <td id=\"T_67af1_row4_col4\" class=\"data row4 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row4_col5\" class=\"data row4 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row5\" class=\"row_heading level0 row5\" >T1564.001-Hidden_Files_and_Directories</th>\n",
       "      <td id=\"T_67af1_row5_col0\" class=\"data row5 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row5_col2\" class=\"data row5 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row5_col3\" class=\"data row5 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row5_col4\" class=\"data row5 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row5_col5\" class=\"data row5 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row6\" class=\"row_heading level0 row6\" >T1482-Domain_Trust_Discovery</th>\n",
       "      <td id=\"T_67af1_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row6_col1\" class=\"data row6 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row6_col2\" class=\"data row6 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row6_col3\" class=\"data row6 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row6_col4\" class=\"data row6 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row6_col5\" class=\"data row6 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row7\" class=\"row_heading level0 row7\" >T1564-Hide_Artifacts&nbsp;<sub>(10)</sub></th>\n",
       "      <td id=\"T_67af1_row7_col0\" class=\"data row7 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row7_col2\" class=\"data row7 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row7_col3\" class=\"data row7 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row7_col4\" class=\"data row7 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row7_col5\" class=\"data row7 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row8\" class=\"row_heading level0 row8\" >T1559.001-Component_Object_Model</th>\n",
       "      <td id=\"T_67af1_row8_col0\" class=\"data row8 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row8_col1\" class=\"data row8 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
       "      <td id=\"T_67af1_row8_col3\" class=\"data row8 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row8_col4\" class=\"data row8 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row8_col5\" class=\"data row8 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row9\" class=\"row_heading level0 row9\" >T1566.002-Spearphishing_Link</th>\n",
       "      <td id=\"T_67af1_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row9_col1\" class=\"data row9 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row9_col2\" class=\"data row9 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row9_col3\" class=\"data row9 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row9_col4\" class=\"data row9 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row9_col5\" class=\"data row9 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row10\" class=\"row_heading level0 row10\" >T1222.001-Windows_File_and_Directory_Permissions_Modification</th>\n",
       "      <td id=\"T_67af1_row10_col0\" class=\"data row10 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row10_col2\" class=\"data row10 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row10_col3\" class=\"data row10 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row10_col4\" class=\"data row10 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row10_col5\" class=\"data row10 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row11\" class=\"row_heading level0 row11\" >T1134.004-Parent_PID_Spoofing</th>\n",
       "      <td id=\"T_67af1_row11_col0\" class=\"data row11 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row11_col1\" class=\"data row11 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
       "      <td id=\"T_67af1_row11_col3\" class=\"data row11 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row11_col4\" class=\"data row11 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row11_col5\" class=\"data row11 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row12\" class=\"row_heading level0 row12\" >T1134-Access_Token_Manipulation&nbsp;<sub>(5)</sub></th>\n",
       "      <td id=\"T_67af1_row12_col0\" class=\"data row12 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row12_col1\" class=\"data row12 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row12_col2\" class=\"data row12 col2\" >yes</td>\n",
       "      <td id=\"T_67af1_row12_col3\" class=\"data row12 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row12_col4\" class=\"data row12 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row12_col5\" class=\"data row12 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row13\" class=\"row_heading level0 row13\" >T1574.001-DLL_Search_Order_Hijacking</th>\n",
       "      <td id=\"T_67af1_row13_col0\" class=\"data row13 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row13_col1\" class=\"data row13 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row13_col2\" class=\"data row13 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row13_col3\" class=\"data row13 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row13_col4\" class=\"data row13 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row13_col5\" class=\"data row13 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row14\" class=\"row_heading level0 row14\" >T1069-Permission_Groups_Discovery&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_67af1_row14_col0\" class=\"data row14 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row14_col2\" class=\"data row14 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row14_col3\" class=\"data row14 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row14_col4\" class=\"data row14 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row14_col5\" class=\"data row14 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row15\" class=\"row_heading level0 row15\" >T1069.001-Local_Groups</th>\n",
       "      <td id=\"T_67af1_row15_col0\" class=\"data row15 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row15_col2\" class=\"data row15 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row15_col3\" class=\"data row15 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row15_col4\" class=\"data row15 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row15_col5\" class=\"data row15 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row16\" class=\"row_heading level0 row16\" >T1059.005-Visual_Basic</th>\n",
       "      <td id=\"T_67af1_row16_col0\" class=\"data row16 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row16_col1\" class=\"data row16 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
       "      <td id=\"T_67af1_row16_col3\" class=\"data row16 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row16_col4\" class=\"data row16 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row16_col5\" class=\"data row16 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row17\" class=\"row_heading level0 row17\" >T1021.001-Remote_Desktop_Protocol</th>\n",
       "      <td id=\"T_67af1_row17_col0\" class=\"data row17 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row17_col2\" class=\"data row17 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row17_col3\" class=\"data row17 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row17_col4\" class=\"data row17 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row17_col5\" class=\"data row17 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row18\" class=\"row_heading level0 row18\" >T1531-Account_Access_Removal</th>\n",
       "      <td id=\"T_67af1_row18_col0\" class=\"data row18 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row18_col2\" class=\"data row18 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row18_col3\" class=\"data row18 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row18_col4\" class=\"data row18 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row18_col5\" class=\"data row18 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row19\" class=\"row_heading level0 row19\" >T1036.003-Rename_System_Utilities</th>\n",
       "      <td id=\"T_67af1_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row19_col1\" class=\"data row19 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row19_col2\" class=\"data row19 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row19_col3\" class=\"data row19 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row19_col4\" class=\"data row19 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row19_col5\" class=\"data row19 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row20\" class=\"row_heading level0 row20\" >T1489-Service_Stop</th>\n",
       "      <td id=\"T_67af1_row20_col0\" class=\"data row20 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row20_col2\" class=\"data row20 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row20_col3\" class=\"data row20 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row20_col4\" class=\"data row20 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row20_col5\" class=\"data row20 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row21\" class=\"row_heading level0 row21\" >T1222-File_and_Directory_Permissions_Modification&nbsp;<sub>(2)</sub></th>\n",
       "      <td id=\"T_67af1_row21_col0\" class=\"data row21 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row21_col2\" class=\"data row21 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row21_col3\" class=\"data row21 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row21_col4\" class=\"data row21 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row21_col5\" class=\"data row21 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row22\" class=\"row_heading level0 row22\" >T1562.004-Disable_or_Modify_System_Firewall</th>\n",
       "      <td id=\"T_67af1_row22_col0\" class=\"data row22 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row22_col2\" class=\"data row22 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row22_col3\" class=\"data row22 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row22_col4\" class=\"data row22 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row22_col5\" class=\"data row22 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row23\" class=\"row_heading level0 row23\" >T1047-Windows_Management_Instrumentation</th>\n",
       "      <td id=\"T_67af1_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row23_col1\" class=\"data row23 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row23_col2\" class=\"data row23 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row23_col3\" class=\"data row23 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row23_col4\" class=\"data row23 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row23_col5\" class=\"data row23 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row24\" class=\"row_heading level0 row24\" >T1574.002-DLL_Side-Loading</th>\n",
       "      <td id=\"T_67af1_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row24_col1\" class=\"data row24 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row24_col2\" class=\"data row24 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row24_col3\" class=\"data row24 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row24_col4\" class=\"data row24 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row24_col5\" class=\"data row24 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row25\" class=\"row_heading level0 row25\" >T1574-Hijack_Execution_Flow&nbsp;<sub>(12)</sub></th>\n",
       "      <td id=\"T_67af1_row25_col0\" class=\"data row25 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row25_col1\" class=\"data row25 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row25_col2\" class=\"data row25 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row25_col3\" class=\"data row25 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row25_col4\" class=\"data row25 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row25_col5\" class=\"data row25 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row26\" class=\"row_heading level0 row26\" >T1113-Screen_Capture</th>\n",
       "      <td id=\"T_67af1_row26_col0\" class=\"data row26 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row26_col1\" class=\"data row26 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row26_col2\" class=\"data row26 col2\" >yes</td>\n",
       "      <td id=\"T_67af1_row26_col3\" class=\"data row26 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row26_col4\" class=\"data row26 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row26_col5\" class=\"data row26 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row27\" class=\"row_heading level0 row27\" >T1016-System_Network_Configuration_Discovery&nbsp;<sub>(1)</sub></th>\n",
       "      <td id=\"T_67af1_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row27_col1\" class=\"data row27 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row27_col2\" class=\"data row27 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row27_col3\" class=\"data row27 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row27_col4\" class=\"data row27 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row27_col5\" class=\"data row27 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row28\" class=\"row_heading level0 row28\" >T1033-System_Owner/User_Discovery</th>\n",
       "      <td id=\"T_67af1_row28_col0\" class=\"data row28 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row28_col1\" class=\"data row28 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row28_col2\" class=\"data row28 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row28_col3\" class=\"data row28 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row28_col4\" class=\"data row28 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row28_col5\" class=\"data row28 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row29\" class=\"row_heading level0 row29\" >T1218.005-Mshta</th>\n",
       "      <td id=\"T_67af1_row29_col0\" class=\"data row29 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row29_col1\" class=\"data row29 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row29_col2\" class=\"data row29 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row29_col3\" class=\"data row29 col3\" >yes</td>\n",
       "      <td id=\"T_67af1_row29_col4\" class=\"data row29 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row29_col5\" class=\"data row29 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row30\" class=\"row_heading level0 row30\" >T1014-Rootkit</th>\n",
       "      <td id=\"T_67af1_row30_col0\" class=\"data row30 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row30_col1\" class=\"data row30 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row30_col2\" class=\"data row30 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row30_col3\" class=\"data row30 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row30_col4\" class=\"data row30 col4\" >yes</td>\n",
       "      <td id=\"T_67af1_row30_col5\" class=\"data row30 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row31\" class=\"row_heading level0 row31\" >T1068-Exploitation_for_Privilege_Escalation</th>\n",
       "      <td id=\"T_67af1_row31_col0\" class=\"data row31 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row31_col1\" class=\"data row31 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row31_col2\" class=\"data row31 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row31_col3\" class=\"data row31 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
       "      <td id=\"T_67af1_row31_col5\" class=\"data row31 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row32\" class=\"row_heading level0 row32\" >T1219-Remote_Access_Software</th>\n",
       "      <td id=\"T_67af1_row32_col0\" class=\"data row32 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row32_col1\" class=\"data row32 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row32_col2\" class=\"data row32 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row32_col3\" class=\"data row32 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row32_col4\" class=\"data row32 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row32_col5\" class=\"data row32 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row33\" class=\"row_heading level0 row33\" >T1055.002-Portable_Executable_Injection</th>\n",
       "      <td id=\"T_67af1_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row33_col1\" class=\"data row33 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row33_col2\" class=\"data row33 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row33_col3\" class=\"data row33 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row33_col4\" class=\"data row33 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row33_col5\" class=\"data row33 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row34\" class=\"row_heading level0 row34\" >T1136.001-Local_Account</th>\n",
       "      <td id=\"T_67af1_row34_col0\" class=\"data row34 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row34_col2\" class=\"data row34 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row34_col3\" class=\"data row34 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row34_col4\" class=\"data row34 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row34_col5\" class=\"data row34 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row35\" class=\"row_heading level0 row35\" >T1136-Create_Account&nbsp;<sub>(3)</sub></th>\n",
       "      <td id=\"T_67af1_row35_col0\" class=\"data row35 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row35_col1\" class=\"data row35 col1\" >yes</td>\n",
       "      <td id=\"T_67af1_row35_col2\" class=\"data row35 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row35_col3\" class=\"data row35 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row35_col4\" class=\"data row35 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row35_col5\" class=\"data row35 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row36\" class=\"row_heading level0 row36\" >T1070-Indicator_Removal&nbsp;<sub>(9)</sub></th>\n",
       "      <td id=\"T_67af1_row36_col0\" class=\"data row36 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row36_col1\" class=\"data row36 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row36_col2\" class=\"data row36 col2\" >yes</td>\n",
       "      <td id=\"T_67af1_row36_col3\" class=\"data row36 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row36_col4\" class=\"data row36 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row36_col5\" class=\"data row36 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row37\" class=\"row_heading level0 row37\" >T1071.003-Mail_Protocols</th>\n",
       "      <td id=\"T_67af1_row37_col0\" class=\"data row37 col0\" >no</td>\n",
       "      <td id=\"T_67af1_row37_col1\" class=\"data row37 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row37_col2\" class=\"data row37 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row37_col3\" class=\"data row37 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row37_col4\" class=\"data row37 col4\" >yes</td>\n",
       "      <td id=\"T_67af1_row37_col5\" class=\"data row37 col5\" >1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th id=\"T_67af1_level0_row38\" class=\"row_heading level0 row38\" >T1016.001-Internet_Connection_Discovery</th>\n",
       "      <td id=\"T_67af1_row38_col0\" class=\"data row38 col0\" >yes</td>\n",
       "      <td id=\"T_67af1_row38_col1\" class=\"data row38 col1\" >no</td>\n",
       "      <td id=\"T_67af1_row38_col2\" class=\"data row38 col2\" >no</td>\n",
       "      <td id=\"T_67af1_row38_col3\" class=\"data row38 col3\" >no</td>\n",
       "      <td id=\"T_67af1_row38_col4\" class=\"data row38 col4\" >no</td>\n",
       "      <td id=\"T_67af1_row38_col5\" class=\"data row38 col5\" >1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x12c2807f0>"
      ]
     },
     "execution_count": 52,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rslt_df = tdf[tdf['total_coverage'] == 1]\n",
    "print(rslt_df.shape)\n",
    "rslt_df.style.apply(highlight_rows, axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "62821d46-d7a2-4964-9401-47189fb4b510",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "848faf4c-1939-4b32-ab7d-9821d5bf2ed0",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.15"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}