splunk-security_content/docs/mitre-map/detections.csv at coverage_update

admin/splunk-security_content

Fork 0

mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00

Files

T

divious1 fb69d6f6c4 updated both maps fixed errors with coverage

2020-08-22 01:18:14 -04:00

5.1 MiB

Raw Permalink Blame History

1	Technique ID	Detection Available	Link	score
2	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
3	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
4	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
5	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
6	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
7	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
8	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
9	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
10	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
11	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
12	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
13	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
14	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
15	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
16	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
17	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
18	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
19	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
20	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
21	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
22	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
23	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
24	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
25	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
26	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
27	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
28	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
29	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
30	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
31	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
32	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
33	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
34	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
35	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
36	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
37	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
38	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
39	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
40	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
41	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
42	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
43	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
44	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
45	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
46	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
47	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
48	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
49	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
50	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
51	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
52	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
53	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
54	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
55	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
56	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
57	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
58	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
59	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
60	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
61	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
62	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
63	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
64	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
65	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
66	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
67	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
68	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
69	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
70	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
71	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
72	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
73	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
74	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
75	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
76	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
77	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
78	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
79	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
80	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
81	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
82	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
83	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
84	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
85	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
86	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
87	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
88	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
89	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
90	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
91	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
92	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
93	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
94	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
95	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
96	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
97	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
98	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
99	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
100	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
101	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
102	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
103	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
104	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
105	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
106	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
107	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
108	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
109	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
110	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
111	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
112	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
113	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
114	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
115	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
116	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
117	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
118	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
119	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
120	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
121	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
122	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
123	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
124	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
125	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
126	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
127	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
128	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
129	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
130	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
131	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
132	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
133	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
134	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
135	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
136	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
137	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
138	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
139	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
140	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
141	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
142	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
143	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
144	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
145	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
146	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
147	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
148	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
149	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
150	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
151	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
152	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
153	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
154	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
155	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
156	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
157	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
158	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
159	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
160	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
161	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
162	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
163	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
164	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
165	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
166	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
167	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
168	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
169	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
170	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
171	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
172	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
173	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
174	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
175	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
176	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
177	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
178	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
179	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
180	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
181	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
182	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
183	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
184	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
185	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
186	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
187	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
188	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
189	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
190	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
191	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
192	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
193	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
194	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
195	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
196	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
197	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
198	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
199	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
200	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
201	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
202	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
203	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
204	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
205	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
206	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
207	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
208	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
209	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
210	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
211	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
212	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
213	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
214	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
215	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
216	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
217	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
218	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
219	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
220	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
221	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
222	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
223	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
224	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
225	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
226	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
227	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
228	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
229	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
230	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
231	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
232	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
233	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
234	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
235	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
236	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
237	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
238	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
239	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
240	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
241	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
242	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
243	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
244	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
245	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
246	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
247	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
248	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
249	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
250	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
251	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
252	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
253	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
254	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
255	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
256	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
257	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
258	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
259	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
260	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
261	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
262	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
263	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
264	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
265	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
266	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
267	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
268	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
269	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
270	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
271	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
272	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
273	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
274	T1193	No	-	51
275	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
276	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
277	T1193	No	-	51
278	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
279	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
280	T1193	No	-	51
281	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
282	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
283	T1193	No	-	51
284	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
285	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
286	T1193	No	-	51
287	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
288	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
289	T1193	No	-	51
290	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
291	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
292	T1193	No	-	51
293	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
294	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
295	T1193	No	-	51
296	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
297	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
298	T1193	No	-	51
299	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
300	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
301	T1193	No	-	51
302	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
303	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
304	T1193	No	-	51
305	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
306	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
307	T1193	No	-	51
308	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
309	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
310	T1193	No	-	51
311	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
312	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
313	T1193	No	-	51
314	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
315	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
316	T1193	No	-	51
317	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
318	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
319	T1193	No	-	51
320	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
321	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
322	T1193	No	-	51
323	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
324	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
325	T1193	No	-	51
326	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
327	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
328	T1193	No	-	51
329	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
330	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
331	T1193	No	-	51
332	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
333	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
334	T1193	No	-	51
335	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
336	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
337	T1193	No	-	51
338	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
339	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
340	T1193	No	-	51
341	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
342	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
343	T1193	No	-	51
344	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
345	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
346	T1193	No	-	51
347	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
348	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
349	T1193	No	-	51
350	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
351	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
352	T1193	No	-	51
353	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
354	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
355	T1193	No	-	51
356	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
357	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
358	T1193	No	-	51
359	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
360	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
361	T1193	No	-	51
362	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
363	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
364	T1193	No	-	51
365	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
366	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
367	T1193	No	-	51
368	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
369	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
370	T1193	No	-	51
371	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
372	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
373	T1193	No	-	51
374	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
375	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
376	T1193	No	-	51
377	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
378	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
379	T1193	No	-	51
380	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
381	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
382	T1193	No	-	51
383	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
384	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
385	T1193	No	-	51
386	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
387	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
388	T1193	No	-	51
389	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
390	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
391	T1193	No	-	51
392	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
393	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
394	T1193	No	-	51
395	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
396	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
397	T1193	No	-	51
398	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
399	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
400	T1193	No	-	51
401	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
402	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
403	T1193	No	-	51
404	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
405	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
406	T1193	No	-	51
407	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
408	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
409	T1193	No	-	51
410	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
411	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
412	T1193	No	-	51
413	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
414	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
415	T1193	No	-	51
416	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
417	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
418	T1193	No	-	51
419	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
420	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
421	T1193	No	-	51
422	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
423	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
424	T1193	No	-	51
425	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
426	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
427	T1193	No	-	51
428	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
429	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
430	T1193	No	-	51
431	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
432	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
433	T1193	No	-	51
434	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
435	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
436	T1193	No	-	51
437	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
438	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
439	T1193	No	-	51
440	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
441	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
442	T1193	No	-	51
443	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
444	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
445	T1193	No	-	51
446	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
447	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
448	T1193	No	-	51
449	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
450	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
451	T1193	No	-	51
452	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
453	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
454	T1193	No	-	51
455	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
456	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
457	T1193	No	-	51
458	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
459	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
460	T1193	No	-	51
461	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
462	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
463	T1193	No	-	51
464	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
465	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
466	T1193	No	-	51
467	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
468	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
469	T1193	No	-	51
470	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
471	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
472	T1193	No	-	51
473	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
474	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
475	T1193	No	-	51
476	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
477	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
478	T1193	No	-	51
479	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
480	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
481	T1193	No	-	51
482	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
483	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
484	T1193	No	-	51
485	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
486	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
487	T1193	No	-	51
488	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
489	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
490	T1193	No	-	51
491	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
492	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
493	T1193	No	-	51
494	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
495	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
496	T1193	No	-	51
497	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
498	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
499	T1193	No	-	51
500	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
501	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
502	T1193	No	-	51
503	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
504	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
505	T1193	No	-	51
506	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
507	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
508	T1193	No	-	51
509	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
510	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
511	T1193	No	-	51
512	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
513	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
514	T1193	No	-	51
515	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
516	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
517	T1193	No	-	51
518	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
519	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
520	T1193	No	-	51
521	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
522	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
523	T1193	No	-	51
524	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
525	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
526	T1193	No	-	51
527	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
528	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
529	T1193	No	-	51
530	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
531	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
532	T1193	No	-	51
533	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
534	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
535	T1193	No	-	51
536	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
537	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
538	T1193	No	-	51
539	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
540	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
541	T1193	No	-	51
542	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
543	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
544	T1193	No	-	51
545	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
546	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
547	T1193	No	-	51
548	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
549	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
550	T1193	No	-	51
551	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
552	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
553	T1193	No	-	51
554	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
555	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
556	T1193	No	-	51
557	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
558	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
559	T1193	No	-	51
560	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
561	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
562	T1193	No	-	51
563	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
564	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
565	T1193	No	-	51
566	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
567	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
568	T1193	No	-	51
569	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
570	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
571	T1193	No	-	51
572	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
573	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
574	T1193	No	-	51
575	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
576	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
577	T1193	No	-	51
578	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
579	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
580	T1193	No	-	51
581	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
582	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
583	T1193	No	-	51
584	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
585	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
586	T1193	No	-	51
587	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
588	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
589	T1193	No	-	51
590	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
591	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
592	T1193	No	-	51
593	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
594	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
595	T1193	No	-	51
596	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
597	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
598	T1193	No	-	51
599	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
600	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
601	T1193	No	-	51
602	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
603	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
604	T1193	No	-	51
605	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
606	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
607	T1193	No	-	51
608	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
609	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
610	T1193	No	-	51
611	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
612	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
613	T1193	No	-	51
614	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
615	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
616	T1193	No	-	51
617	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
618	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
619	T1193	No	-	51
620	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
621	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
622	T1193	No	-	51
623	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
624	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
625	T1193	No	-	51
626	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
627	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
628	T1193	No	-	51
629	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
630	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
631	T1193	No	-	51
632	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
633	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
634	T1193	No	-	51
635	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
636	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
637	T1193	No	-	51
638	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
639	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
640	T1193	No	-	51
641	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
642	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
643	T1193	No	-	51
644	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
645	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
646	T1193	No	-	51
647	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
648	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
649	T1193	No	-	51
650	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
651	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
652	T1193	No	-	51
653	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
654	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
655	T1193	No	-	51
656	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
657	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
658	T1193	No	-	51
659	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
660	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
661	T1193	No	-	51
662	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
663	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
664	T1193	No	-	51
665	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
666	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
667	T1193	No	-	51
668	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
669	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
670	T1193	No	-	51
671	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
672	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
673	T1193	No	-	51
674	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
675	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
676	T1193	No	-	51
677	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
678	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
679	T1193	No	-	51
680	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
681	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
682	T1193	No	-	51
683	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
684	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
685	T1193	No	-	51
686	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
687	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
688	T1193	No	-	51
689	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
690	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
691	T1193	No	-	51
692	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
693	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
694	T1193	No	-	51
695	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
696	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
697	T1193	No	-	51
698	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
699	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
700	T1193	No	-	51
701	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
702	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
703	T1193	No	-	51
704	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
705	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
706	T1193	No	-	51
707	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
708	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
709	T1193	No	-	51
710	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
711	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
712	T1193	No	-	51
713	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
714	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
715	T1193	No	-	51
716	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
717	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
718	T1193	No	-	51
719	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
720	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
721	T1193	No	-	51
722	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
723	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
724	T1193	No	-	51
725	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
726	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
727	T1193	No	-	51
728	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
729	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
730	T1193	No	-	51
731	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
732	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
733	T1193	No	-	51
734	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
735	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
736	T1193	No	-	51
737	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
738	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
739	T1193	No	-	51
740	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
741	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
742	T1193	No	-	51
743	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
744	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
745	T1193	No	-	51
746	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
747	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
748	T1193	No	-	51
749	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
750	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
751	T1193	No	-	51
752	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
753	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
754	T1193	No	-	51
755	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
756	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
757	T1193	No	-	51
758	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
759	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
760	T1193	No	-	51
761	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
762	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
763	T1193	No	-	51
764	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
765	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
766	T1193	No	-	51
767	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
768	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
769	T1193	No	-	51
770	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
771	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
772	T1193	No	-	51
773	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
774	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
775	T1193	No	-	51
776	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
777	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
778	T1193	No	-	51
779	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
780	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
781	T1193	No	-	51
782	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
783	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
784	T1193	No	-	51
785	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
786	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
787	T1193	No	-	51
788	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
789	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
790	T1193	No	-	51
791	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
792	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
793	T1193	No	-	51
794	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
795	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
796	T1193	No	-	51
797	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
798	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
799	T1193	No	-	51
800	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
801	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
802	T1193	No	-	51
803	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
804	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
805	T1193	No	-	51
806	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
807	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
808	T1193	No	-	51
809	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
810	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
811	T1193	No	-	51
812	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
813	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
814	T1193	No	-	51
815	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
816	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
817	T1193	No	-	51
818	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
819	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
820	T1193	No	-	51
821	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
822	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
823	T1193	No	-	51
824	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
825	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
826	T1193	No	-	51
827	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
828	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
829	T1193	No	-	51
830	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
831	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
832	T1193	No	-	51
833	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
834	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
835	T1193	No	-	51
836	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
837	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
838	T1193	No	-	51
839	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
840	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
841	T1193	No	-	51
842	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
843	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
844	T1193	No	-	51
845	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
846	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
847	T1193	No	-	51
848	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
849	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
850	T1193	No	-	51
851	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
852	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
853	T1193	No	-	51
854	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
855	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
856	T1193	No	-	51
857	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
858	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
859	T1193	No	-	51
860	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
861	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
862	T1193	No	-	51
863	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
864	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
865	T1193	No	-	51
866	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
867	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
868	T1193	No	-	51
869	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
870	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
871	T1193	No	-	51
872	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
873	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
874	T1193	No	-	51
875	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
876	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
877	T1193	No	-	51
878	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
879	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
880	T1193	No	-	51
881	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
882	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
883	T1193	No	-	51
884	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
885	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
886	T1193	No	-	51
887	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
888	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
889	T1193	No	-	51
890	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
891	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
892	T1193	No	-	51
893	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
894	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
895	T1193	No	-	51
896	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
897	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
898	T1193	No	-	51
899	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
900	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
901	T1193	No	-	51
902	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
903	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
904	T1193	No	-	51
905	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
906	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
907	T1193	No	-	51
908	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
909	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
910	T1193	No	-	51
911	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
912	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
913	T1193	No	-	51
914	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
915	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
916	T1193	No	-	51
917	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
918	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
919	T1193	No	-	51
920	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
921	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
922	T1193	No	-	51
923	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
924	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
925	T1193	No	-	51
926	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
927	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
928	T1193	No	-	51
929	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
930	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
931	T1193	No	-	51
932	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
933	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
934	T1193	No	-	51
935	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
936	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
937	T1193	No	-	51
938	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
939	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
940	T1193	No	-	51
941	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
942	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
943	T1193	No	-	51
944	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
945	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
946	T1193	No	-	51
947	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
948	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
949	T1193	No	-	51
950	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
951	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
952	T1193	No	-	51
953	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
954	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
955	T1193	No	-	51
956	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
957	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
958	T1193	No	-	51
959	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
960	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
961	T1193	No	-	51
962	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
963	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
964	T1193	No	-	51
965	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
966	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
967	T1193	No	-	51
968	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
969	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
970	T1193	No	-	51
971	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
972	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
973	T1193	No	-	51
974	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
975	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
976	T1193	No	-	51
977	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
978	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
979	T1193	No	-	51
980	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
981	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
982	T1193	No	-	51
983	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
984	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
985	T1193	No	-	51
986	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
987	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
988	T1193	No	-	51
989	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
990	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
991	T1193	No	-	51
992	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
993	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
994	T1193	No	-	51
995	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
996	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
997	T1193	No	-	51
998	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
999	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1000	T1193	No	-	51
1001	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1002	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1003	T1193	No	-	51
1004	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1005	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1006	T1193	No	-	51
1007	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1008	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1009	T1193	No	-	51
1010	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1011	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1012	T1193	No	-	51
1013	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1014	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1015	T1193	No	-	51
1016	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1017	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1018	T1193	No	-	51
1019	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1020	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1021	T1193	No	-	51
1022	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1023	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1024	T1193	No	-	51
1025	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1026	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1027	T1193	No	-	51
1028	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1029	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1030	T1193	No	-	51
1031	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1032	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1033	T1193	No	-	51
1034	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1035	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1036	T1193	No	-	51
1037	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1038	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1039	T1193	No	-	51
1040	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1041	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1042	T1193	No	-	51
1043	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1044	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1045	T1193	No	-	51
1046	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1047	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1048	T1193	No	-	51
1049	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1050	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1051	T1193	No	-	51
1052	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1053	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1054	T1193	No	-	51
1055	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1056	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1057	T1193	No	-	51
1058	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1059	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1060	T1193	No	-	51
1061	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1062	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1063	T1193	No	-	51
1064	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1065	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1066	T1193	No	-	51
1067	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1068	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1069	T1193	No	-	51
1070	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1071	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1072	T1193	No	-	51
1073	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1074	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1075	T1193	No	-	51
1076	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1077	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1078	T1193	No	-	51
1079	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1080	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1081	T1193	No	-	51
1082	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1083	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1084	T1193	No	-	51
1085	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1086	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1087	T1193	No	-	51
1088	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1089	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1090	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1091	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1092	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1093	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1094	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1095	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1096	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1097	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1098	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1099	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1100	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1101	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1102	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1103	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1104	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1105	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1106	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1107	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1108	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1109	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1110	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1111	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1112	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1113	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1114	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1115	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1116	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1117	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1118	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1119	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1120	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1121	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1122	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1123	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1124	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1125	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1126	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1127	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1128	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1129	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1130	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1131	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1132	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1133	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1134	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1135	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1136	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1137	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1138	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1139	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1140	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1141	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1142	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1143	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1144	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1145	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1146	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1147	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1148	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1149	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1150	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1151	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1152	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1153	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1154	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1155	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1156	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1157	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1158	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1159	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1160	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1161	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1162	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1163	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1164	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1165	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1166	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1167	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1168	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1169	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1170	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1171	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1172	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1173	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1174	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1175	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1176	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1177	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1178	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1179	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1180	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1181	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1182	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1183	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1184	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1185	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1186	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1187	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1188	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1189	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1190	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1191	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1192	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1193	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1194	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1195	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1196	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1197	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1198	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1199	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1200	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1201	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1202	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1203	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1204	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1205	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1206	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1207	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1208	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1209	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1210	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1211	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1212	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1213	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1214	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1215	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1216	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1217	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1218	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1219	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1220	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1221	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1222	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1223	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1224	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1225	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1226	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1227	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1228	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1229	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1230	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1231	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1232	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1233	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1234	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1235	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1236	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1237	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1238	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1239	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1240	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1241	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1242	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1243	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1244	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1245	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1246	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1247	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1248	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1249	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1250	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1251	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1252	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1253	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1254	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1255	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1256	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1257	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1258	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1259	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1260	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1261	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1262	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1263	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1264	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1265	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1266	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1267	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1268	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1269	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1270	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1271	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1272	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1273	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1274	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1275	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1276	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1277	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1278	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1279	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1280	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1281	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1282	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1283	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1284	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1285	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1286	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1287	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1288	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1289	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1290	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1291	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1292	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1293	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1294	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1295	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1296	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1297	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1298	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1299	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1300	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1301	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1302	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1303	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1304	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1305	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1306	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1307	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1308	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1309	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1310	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1311	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1312	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1313	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1314	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1315	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1316	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1317	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1318	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1319	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1320	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1321	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1322	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1323	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1324	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1325	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1326	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1327	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1328	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1329	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1330	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1331	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1332	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1333	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1334	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1335	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1336	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1337	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1338	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1339	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1340	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1341	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1342	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1343	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1344	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1345	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1346	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1347	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1348	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1349	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1350	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1351	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1352	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1353	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1354	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1355	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1356	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1357	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1358	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1359	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1360	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1361	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1362	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1363	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1364	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1365	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1366	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1367	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1368	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1369	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1370	T1086	No	-	44
1371	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1372	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1373	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1374	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1375	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1376	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1377	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1378	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1379	T1086	No	-	44
1380	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1381	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1382	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1383	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1384	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1385	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1386	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1387	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1388	T1086	No	-	44
1389	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1390	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1391	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1392	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1393	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1394	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1395	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1396	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1397	T1086	No	-	44
1398	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1399	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1400	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1401	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1402	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1403	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1404	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1405	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1406	T1086	No	-	44
1407	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1408	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1409	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1410	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1411	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1412	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1413	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1414	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1415	T1086	No	-	44
1416	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1417	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1418	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1419	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1420	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1421	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1422	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1423	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1424	T1086	No	-	44
1425	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1426	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1427	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1428	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1429	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1430	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1431	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1432	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1433	T1086	No	-	44
1434	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1435	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1436	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1437	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1438	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1439	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1440	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1441	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1442	T1086	No	-	44
1443	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1444	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1445	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1446	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1447	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1448	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1449	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1450	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1451	T1086	No	-	44
1452	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1453	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1454	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1455	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1456	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1457	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1458	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1459	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1460	T1086	No	-	44
1461	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1462	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1463	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1464	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1465	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1466	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1467	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1468	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1469	T1086	No	-	44
1470	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1471	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1472	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1473	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1474	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1475	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1476	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1477	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1478	T1086	No	-	44
1479	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1480	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1481	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1482	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1483	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1484	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1485	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1486	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1487	T1086	No	-	44
1488	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1489	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1490	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1491	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1492	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1493	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1494	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1495	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1496	T1086	No	-	44
1497	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1498	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1499	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1500	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1501	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1502	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1503	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1504	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1505	T1086	No	-	44
1506	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1507	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1508	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1509	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1510	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1511	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1512	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1513	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1514	T1086	No	-	44
1515	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1516	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1517	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1518	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1519	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1520	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1521	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1522	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1523	T1086	No	-	44
1524	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1525	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1526	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1527	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1528	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1529	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1530	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1531	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1532	T1086	No	-	44
1533	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1534	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1535	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1536	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1537	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1538	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1539	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1540	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1541	T1086	No	-	44
1542	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1543	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1544	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1545	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1546	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1547	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1548	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1549	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1550	T1086	No	-	44
1551	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1552	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1553	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1554	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1555	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1556	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1557	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1558	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1559	T1086	No	-	44
1560	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1561	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1562	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1563	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1564	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1565	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1566	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1567	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1568	T1086	No	-	44
1569	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1570	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1571	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1572	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1573	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1574	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1575	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1576	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1577	T1086	No	-	44
1578	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1579	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1580	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1581	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1582	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1583	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1584	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1585	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1586	T1086	No	-	44
1587	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1588	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1589	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1590	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1591	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1592	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1593	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1594	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1595	T1086	No	-	44
1596	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1597	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1598	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1599	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1600	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1601	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1602	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1603	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1604	T1086	No	-	44
1605	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1606	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1607	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1608	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1609	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1610	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1611	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1612	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1613	T1086	No	-	44
1614	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1615	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1616	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1617	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1618	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1619	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1620	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1621	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1622	T1086	No	-	44
1623	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1624	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1625	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1626	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1627	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1628	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1629	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1630	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1631	T1086	No	-	44
1632	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1633	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1634	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1635	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1636	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1637	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1638	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1639	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1640	T1086	No	-	44
1641	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1642	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1643	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1644	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1645	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1646	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1647	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1648	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1649	T1086	No	-	44
1650	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1651	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1652	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1653	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1654	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1655	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1656	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1657	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1658	T1086	No	-	44
1659	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1660	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1661	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1662	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1663	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1664	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1665	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1666	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1667	T1086	No	-	44
1668	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1669	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1670	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1671	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1672	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1673	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1674	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1675	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1676	T1086	No	-	44
1677	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1678	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1679	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1680	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1681	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1682	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1683	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1684	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1685	T1086	No	-	44
1686	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1687	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1688	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1689	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1690	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1691	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1692	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1693	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1694	T1086	No	-	44
1695	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1696	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1697	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1698	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1699	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1700	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1701	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1702	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1703	T1086	No	-	44
1704	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1705	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1706	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1707	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1708	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1709	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1710	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1711	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1712	T1086	No	-	44
1713	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1714	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1715	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1716	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1717	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1718	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1719	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1720	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1721	T1086	No	-	44
1722	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1723	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1724	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1725	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1726	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1727	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1728	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1729	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1730	T1086	No	-	44
1731	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1732	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1733	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1734	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1735	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1736	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1737	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1738	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1739	T1086	No	-	44
1740	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1741	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1742	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1743	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1744	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1745	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1746	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1747	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1748	T1086	No	-	44
1749	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1750	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1751	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1752	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1753	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1754	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1755	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1756	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1757	T1086	No	-	44
1758	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1759	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1760	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1761	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1762	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1763	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1764	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1765	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1766	T1086	No	-	44
1767	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1768	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1769	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1770	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1771	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1772	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1773	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1774	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1775	T1086	No	-	44
1776	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1777	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1778	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1779	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1780	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1781	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1782	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1783	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1784	T1086	No	-	44
1785	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1786	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1787	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1788	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1789	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1790	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1791	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1792	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1793	T1086	No	-	44
1794	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1795	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1796	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1797	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1798	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1799	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1800	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1801	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1802	T1086	No	-	44
1803	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1804	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1805	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1806	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1807	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1808	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1809	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1810	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1811	T1086	No	-	44
1812	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1813	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1814	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1815	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1816	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1817	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1818	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1819	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1820	T1086	No	-	44
1821	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1822	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1823	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1824	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1825	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1826	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1827	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1828	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1829	T1086	No	-	44
1830	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1831	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1832	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1833	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1834	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1835	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1836	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1837	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1838	T1086	No	-	44
1839	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1840	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1841	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1842	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1843	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1844	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1845	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1846	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1847	T1086	No	-	44
1848	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1849	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1850	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1851	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1852	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1853	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1854	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1855	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1856	T1086	No	-	44
1857	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1858	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1859	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1860	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1861	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1862	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1863	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1864	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1865	T1086	No	-	44
1866	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1867	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1868	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1869	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1870	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1871	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1872	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1873	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1874	T1086	No	-	44
1875	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1876	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1877	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1878	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1879	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1880	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1881	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1882	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1883	T1086	No	-	44
1884	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1885	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1886	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1887	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1888	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1889	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1890	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1891	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1892	T1086	No	-	44
1893	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1894	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1895	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1896	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1897	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1898	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1899	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1900	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1901	T1086	No	-	44
1902	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1903	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1904	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1905	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1906	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1907	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1908	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1909	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1910	T1086	No	-	44
1911	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1912	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1913	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1914	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1915	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1916	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1917	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1918	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1919	T1086	No	-	44
1920	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1921	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1922	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1923	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1924	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1925	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1926	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1927	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1928	T1086	No	-	44
1929	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1930	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1931	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1932	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1933	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1934	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1935	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1936	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1937	T1086	No	-	44
1938	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1939	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1940	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1941	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1942	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1943	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1944	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1945	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1946	T1086	No	-	44
1947	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1948	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1949	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1950	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1951	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1952	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1953	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1954	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1955	T1086	No	-	44
1956	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1957	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1958	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1959	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1960	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1961	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1962	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1963	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1964	T1086	No	-	44
1965	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1966	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1967	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1968	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1969	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1970	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1971	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1972	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1973	T1086	No	-	44
1974	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1975	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1976	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1977	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1978	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1979	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1980	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1981	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1982	T1086	No	-	44
1983	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1984	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1985	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1986	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1987	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1988	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1989	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1990	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1991	T1086	No	-	44
1992	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1993	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1994	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1995	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1996	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1997	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1998	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1999	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2000	T1086	No	-	44
2001	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2002	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2003	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2004	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2005	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2006	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2007	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2008	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2009	T1086	No	-	44
2010	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2011	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2012	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2013	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2014	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2015	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2016	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2017	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2018	T1086	No	-	44
2019	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2020	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2021	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2022	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2023	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2024	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2025	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2026	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2027	T1086	No	-	44
2028	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2029	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2030	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2031	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2032	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2033	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2034	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2035	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2036	T1086	No	-	44
2037	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2038	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2039	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2040	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2041	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2042	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2043	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2044	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2045	T1086	No	-	44
2046	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2047	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2048	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2049	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2050	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2051	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2052	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2053	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2054	T1086	No	-	44
2055	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2056	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2057	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2058	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2059	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2060	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2061	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2062	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2063	T1086	No	-	44
2064	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2065	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2066	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2067	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2068	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2069	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2070	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2071	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2072	T1086	No	-	44
2073	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2074	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2075	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2076	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2077	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2078	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2079	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2080	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2081	T1086	No	-	44
2082	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2083	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2084	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2085	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2086	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2087	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2088	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2089	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2090	T1086	No	-	44
2091	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2092	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2093	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2094	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2095	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2096	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2097	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2098	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2099	T1086	No	-	44
2100	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2101	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2102	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2103	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2104	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2105	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2106	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2107	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2108	T1086	No	-	44
2109	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2110	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2111	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2112	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2113	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2114	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2115	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2116	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2117	T1086	No	-	44
2118	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2119	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2120	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2121	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2122	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2123	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2124	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2125	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2126	T1086	No	-	44
2127	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2128	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2129	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2130	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2131	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2132	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2133	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2134	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2135	T1086	No	-	44
2136	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2137	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2138	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2139	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2140	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2141	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2142	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2143	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2144	T1086	No	-	44
2145	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2146	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2147	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2148	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2149	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2150	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2151	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2152	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2153	T1086	No	-	44
2154	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2155	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2156	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2157	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2158	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2159	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2160	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2161	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2162	T1086	No	-	44
2163	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2164	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2165	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2166	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2167	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2168	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2169	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2170	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2171	T1086	No	-	44
2172	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2173	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2174	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2175	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2176	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2177	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2178	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2179	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2180	T1086	No	-	44
2181	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2182	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2183	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2184	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2185	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2186	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2187	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2188	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2189	T1086	No	-	44
2190	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2191	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2192	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2193	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2194	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2195	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2196	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2197	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2198	T1086	No	-	44
2199	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2200	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2201	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2202	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2203	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2204	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2205	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2206	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2207	T1086	No	-	44
2208	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2209	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2210	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2211	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2212	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2213	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2214	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2215	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2216	T1086	No	-	44
2217	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2218	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2219	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2220	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2221	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2222	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2223	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2224	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2225	T1086	No	-	44
2226	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2227	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2228	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2229	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2230	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2231	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2232	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2233	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2234	T1086	No	-	44
2235	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2236	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2237	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2238	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2239	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2240	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2241	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2242	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2243	T1086	No	-	44
2244	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2245	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2246	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2247	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2248	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2249	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2250	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2251	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2252	T1086	No	-	44
2253	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2254	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2255	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2256	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2257	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2258	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2259	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2260	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2261	T1086	No	-	44
2262	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2263	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2264	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2265	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2266	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2267	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2268	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2269	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2270	T1086	No	-	44
2271	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2272	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2273	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2274	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2275	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2276	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2277	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2278	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2279	T1086	No	-	44
2280	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2281	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2282	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2283	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2284	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2285	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2286	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2287	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2288	T1086	No	-	44
2289	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2290	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2291	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2292	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2293	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2294	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2295	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2296	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2297	T1086	No	-	44
2298	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2299	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2300	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2301	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2302	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2303	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2304	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2305	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2306	T1086	No	-	44
2307	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2308	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2309	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2310	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2311	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2312	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2313	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2314	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2315	T1086	No	-	44
2316	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2317	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2318	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2319	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2320	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2321	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2322	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2323	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2324	T1086	No	-	44
2325	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2326	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2327	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2328	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2329	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2330	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2331	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2332	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2333	T1086	No	-	44
2334	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2335	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2336	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2337	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2338	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2339	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2340	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2341	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2342	T1086	No	-	44
2343	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2344	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2345	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2346	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2347	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2348	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2349	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2350	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2351	T1086	No	-	44
2352	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2353	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2354	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2355	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2356	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2357	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2358	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2359	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2360	T1086	No	-	44
2361	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2362	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2363	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2364	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2365	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2366	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2367	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2368	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2369	T1086	No	-	44
2370	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2371	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2372	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2373	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2374	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2375	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2376	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2377	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2378	T1086	No	-	44
2379	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2380	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2381	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2382	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2383	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2384	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2385	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2386	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2387	T1086	No	-	44
2388	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2389	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2390	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2391	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2392	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2393	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2394	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2395	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2396	T1086	No	-	44
2397	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2398	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2399	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2400	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2401	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2402	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2403	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2404	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2405	T1086	No	-	44
2406	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2407	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2408	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2409	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2410	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2411	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2412	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2413	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2414	T1086	No	-	44
2415	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2416	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2417	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2418	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2419	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2420	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2421	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2422	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2423	T1086	No	-	44
2424	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2425	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2426	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2427	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2428	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2429	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2430	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2431	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2432	T1086	No	-	44
2433	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2434	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2435	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2436	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2437	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2438	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2439	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2440	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2441	T1086	No	-	44
2442	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2443	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2444	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2445	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2446	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2447	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2448	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2449	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2450	T1086	No	-	44
2451	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2452	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2453	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2454	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2455	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2456	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2457	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2458	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2459	T1086	No	-	44
2460	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2461	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2462	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2463	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2464	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2465	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2466	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2467	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2468	T1086	No	-	44
2469	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2470	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2471	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2472	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2473	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2474	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2475	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2476	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2477	T1086	No	-	44
2478	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2479	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2480	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2481	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2482	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2483	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2484	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2485	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2486	T1086	No	-	44
2487	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2488	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2489	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2490	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2491	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2492	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2493	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2494	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2495	T1086	No	-	44
2496	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2497	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2498	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2499	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2500	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36

The file is too large to be shown. View Raw

5.1 MiB Raw Permalink Blame History

5.1 MiB

Raw Permalink Blame History