splunk-security_content/docs/mitre-map/detections.csv

1	Technique ID	Detection Available	Link	score
2	T1193	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	49
3	T1193	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
4	T1566.001	No	-	51
5	T1204.002	No	-	50
6	T1027	No	-	48
7	T1059.001	No	-	44
8	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	38
9	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	38
10	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	38
11	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	38
12	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	38
13	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	38
14	T1059.003	No	-	41
15	T1105	No	-	40
16	T1060	No	-	38
17	T1547.001	No	-	38
18	T1071.001	No	-	34
19	T1107	No	-	30
20	T1070.004	No	-	30
21	T1053.005	No	-	28
22	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	22
23	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	22
24	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	22
25	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	22
26	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	22
27	T1059.005	No	-	26
28	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	23
29	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	23
30	T1566.002	No	-	24
31	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	3
32	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	3
33	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	3
34	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	3
35	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	3
36	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	3
37	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	3
38	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	3
39	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	3
40	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	3
41	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	3
42	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	3
43	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	3
44	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	3
45	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	3
46	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	3
47	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	3
48	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	3
49	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	3
50	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	3
51	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	3
52	T1192	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	23
53	T1083	No	-	23
54	T1203	No	-	23
55	T1005	No	-	22
56	T1057	No	-	22
57	T1016	No	-	22
58	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	19
59	T1076	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	18
60	T1076	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	18
61	T1056.001	No	-	20
62	T1140	No	-	19
63	T1018	No	-	19
64	T1036.005	No	-	19
65	T1204.001	No	-	19
66	T1033	No	-	18
67	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	10
68	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	10
69	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	10
70	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	10
71	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	10
72	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	10
73	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	10
74	T1189	No	-	17
75	T1543.003	No	-	16
76	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	2
77	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
78	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	2
79	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
80	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	2
81	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	2
82	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	2
83	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	2
84	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
85	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
86	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
87	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
88	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	2
89	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	2
90	T1560.001	No	-	16
91	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	13
92	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	13
93	T1503	No	-	15
94	T1555.003	No	-	15
95	T1087.001	No	-	14
96	T1553.002	No	-	14
97	T1049	No	-	14
98	T1074.001	No	-	14
99	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	12
100	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	12
101	T1116	No	-	14
102	T1046	No	-	13
103	T1045	No	-	12
104	T1027.002	No	-	12
105	T1041	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	11
106	T1113	No	-	12
107	T1518.001	No	-	11
108	T1571	No	-	11
109	T1574.002	No	-	11
110	T1063	No	-	11
111	T1218.011	No	-	11
112	T1073	No	-	11
113	T1085	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	10
114	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	4
115	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	4
116	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	4
117	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	4
118	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	4
119	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	4
120	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	4
121	T1133	No	-	11
122	T1021.002	No	-	11
123	T1136.002	No	-	10
124	T1505.003	No	-	10
125	T1087.002	No	-	10
126	T1055	No	-	10
127	T1100	No	-	10
128	T1562.001	No	-	9
129	T1560	No	-	9
130	T1143	No	-	9
131	T1564.003	No	-	9
132	T1090.002	No	-	9
133	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	7
134	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	7
135	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
136	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
137	T1119	No	-	9
138	T1559.002	No	-	9
139	T1173	No	-	9
140	T1102.002	No	-	8
141	T1548.002	No	-	8
142	T1003.004	No	-	8
143	T1035	No	-	8
144	T1219	No	-	8
145	T1132.001	No	-	8
146	T1218.010	No	-	8
147	T1569.002	No	-	8
148	T1071.004	No	-	8
149	T1117	No	-	8
150	T1190	No	-	8
151	T1065	No	-	8
152	T1135	No	-	8
153	T1221	No	-	7
154	T1027.005	No	-	7
155	T1023	No	-	7
156	T1573.001	No	-	7
157	T1069.002	No	-	7
158	T1012	No	-	7
159	T1066	No	-	7
160	T1070.001	No	-	7
161	T1007	No	-	7
162	T1059.007	No	-	7
163	T1555	No	-	7
164	T1552.001	No	-	7
165	T1021.004	No	-	7
166	T1547.009	No	-	7
167	T1106	No	-	7
168	T1009	No	-	6
169	T1027.001	No	-	6
170	T1036.004	No	-	6
171	T1003.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	5
172	T1048.003	No	-	6
173	T1114.002	No	-	6
174	T1027.003	No	-	5
175	T1001.002	No	-	5
176	T1573.002	No	-	5
177	T1546.008	No	-	5
178	T1102.001	No	-	5
179	T1059.006	No	-	5
180	T1074.002	No	-	5
181	T1550.002	No	-	5
182	T1566.003	No	-	5
183	T1055.001	No	-	5
184	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	4
185	T1075	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	4
186	T1084	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	2
187	T1084	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	2
188	T1084	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	2
189	T1040	No	-	5
190	T1223	No	-	5
191	T1170	No	-	5
192	T1090	No	-	5
193	T1564.001	No	-	5
194	T1158	No	-	5
195	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	4
196	T1218.001	No	-	5
197	T1218.005	No	-	5
198	T1099	No	-	5
199	T1194	No	-	5
200	T1015	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	2
201	T1015	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	2
202	T1015	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	2
203	T1110	No	-	5
204	T1120	No	-	5
205	T1546.003	No	-	5
206	T1070.006	No	-	5
207	T1094	No	-	4
208	T1574.001	No	-	4
209	T1014	No	-	4
210	T1038	No	-	4
211	T1570	No	-	4
212	T1078.003	No	-	4
213	T1036.002	No	-	4
214	T1487	No	-	4
215	T1093	No	-	4
216	T1071.002	No	-	4
217	T1560.003	No	-	4
218	T1561.002	No	-	4
219	T1003.005	No	-	4
220	T1102	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	3
221	T1124	No	-	4
222	T1025	No	-	4
223	T1496	No	-	4
224	T1055.012	No	-	4
225	T1036.003	No	-	4
226	T1097	No	-	3
227	T1550.003	No	-	3
228	T1020	No	-	3
229	T1104	No	-	3
230	T1091	No	-	3
231	T1197	No	-	3
232	T1188	No	-	3
233	T1486	No	-	3
234	T1067	No	-	3
235	T1572	No	-	3
236	T1027.004	No	-	3
237	T1090.003	No	-	3
238	T1039	No	-	3
239	T1071.003	No	-	3
240	T1529	No	-	3
241	T1069.001	No	-	3
242	T1053.002	No	-	3
243	T1518	No	-	3
244	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	2
245	T1110.002	No	-	3
246	T1078.002	No	-	3
247	T1071	No	-	3
248	T1485	No	-	3
249	T1110.003	No	-	3
250	T1500	No	-	3
251	T1542.003	No	-	3
252	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	2
253	T1098	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	2
254	T1008	No	-	3
255	T1004	No	-	2
256	T1069	No	-	2
257	T1201	No	-	2
258	T1059.004	No	-	2
259	T1187	No	-	2
260	T1195.002	No	-	2
261	T1055.002	No	-	2
262	T1137	No	-	2
263	T1115	No	-	2
264	T1222.002	No	-	2
265	T1090.001	No	-	2
266	T1125	No	-	2
267	T1547.004	No	-	2
268	T1559.001	No	-	2
269	T1542.002	No	-	2
270	T1114.001	No	-	2
271	T1176	No	-	2
272	T1191	No	-	2
273	T1109	No	-	2
274	T1213.002	No	-	2
275	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	-2
276	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	-2
277	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	-2
278	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	-2
279	T1134.002	No	-	2
280	T1080	No	-	2
281	T1564.005	No	-	2
282	T1087.003	No	-	2
283	T1199	No	-	2
284	T1218.003	No	-	2
285	T1560.002	No	-	2
286	T1032	No	-	2
287	T1037.001	No	-	2
288	T1210	No	-	2
289	T1480.001	No	-	2
290	T1565.001	No	-	2
291	T1492	No	-	2
292	T1567.002	No	-	2
293	T1218.007	No	-	2
294	T1126	No	-	1
295	T1213	No	-	1
296	T1127.001	No	-	1
297	T1174	No	-	1
298	T1030	No	-	1
299	T1214	No	-	1
300	T1546.012	No	-	1
301	T1546.011	No	-	1
302	T1504	No	-	1
303	T1489	No	-	1
304	T1056.004	No	-	1
305	T1565.002	No	-	1
306	T1056.002	No	-	1
307	T1074	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	-1
308	T1074	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	-1
309	T1001.003	No	-	1
310	T1497.002	No	-	1
311	T1134.001	No	-	1
312	T1026	No	-	1
313	T1216.001	No	-	1
314	T1534	No	-	1
315	T1183	No	-	1
316	T1220	No	-	1
317	T1546.001	No	-	1
318	T1070.005	No	-	1
319	T1494	No	-	1
320	T1010	No	-	1
321	T1546.013	No	-	1
322	T1138	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	-2
323	T1138	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	-2
324	T1138	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	-2
325	T1573	No	-	1
326	T1096	No	-	1
327	T1146	No	-	1
328	T1543.002	No	-	1
329	T1037	No	-	1
330	T1211	No	-	1
331	T1021.005	No	-	1
332	T1186	No	-	1
333	T1070.003	No	-	1
334	T1092	No	-	1
335	T1565.003	No	-	1
336	T1001.001	No	-	1
337	T1558.001	No	-	1
338	T1021.006	No	-	1
339	T1501	No	-	1
340	T1546.015	No	-	1
341	T1137.006	No	-	1
342	T1562.002	No	-	1
343	T1145	No	-	1
344	T1172	No	-	1
345	T1568.003	No	-	1
346	T1042	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	-2
347	T1042	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	-2
348	T1042	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	-2
349	T1482	No	-	1
350	T1052.001	No	-	1
351	T1028	No	-	1
352	T1001	No	-	1
353	T1568.001	No	-	1
354	T1055.013	No	-	1
355	T1574.006	No	-	1
356	T1552.002	No	-	1
357	T1137.001	No	-	1
358	T1564.004	No	-	1
359	T1090.004	No	-	1
360	T1102.003	No	-	1
361	T1552.006	No	-	1
362	T1078.004	No	-	1
363	T1098.002	No	-	1
364	T1568.002	No	-	1
365	T1070.002	No	-	1
366	T1122	No	-	1
367	T1036.001	No	-	1
368	T1134	No	-	1
369	T1556.002	No	-	1
370	T1546.009	No	-	1
371	T1137.002	No	-	1
372	T1137.004	No	-	1
373	T1550.001	No	-	1
374	T1497.001	No	-	1
375	T1182	No	-	1
376	T1053.003	No	-	1
377	T1218.008	No	-	1
378	T1483	No	-	1
379	T1200	No	-	1
380	T1123	No	-	1
381	T1195	No	-	1
382	T1527	No	-	1
383	T1552.004	No	-	1
384	T1561.001	No	-	1
385	T1491.001	No	-	1
386	T1488	No	-	1
387	T1493	No	-	1
388	T1528	No	-	1
389	T1574.012	No	-	1