mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
tccontre
13050 lines
861 KiB
Plaintext
13050 lines
861 KiB
Plaintext
{
|
||
"cells": [
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "8aae63e7-6918-4035-9617-92110e462324",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Description\n",
|
||
"\n",
|
||
"a simple jupyter notebook that helps Splunk Threat Research Team see the data connections, commonalities and differences of security content stories or threat families.This helps us to look for visualizing the common TTP’s and tooling used by adversaries or threat actors based on the Security content analytics we developed in each analytic story.\n"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 1,
|
||
"id": "78b65762-08c4-4100-bdd8-dcf162b09e73",
|
||
"metadata": {},
|
||
"outputs": [],
|
||
"source": [
|
||
"__author__ = \"Teoderick Contreras STRT\"\n",
|
||
"import os\n",
|
||
"import argparse\n",
|
||
"from pathlib import Path\n",
|
||
"import json\n",
|
||
"import csv\n",
|
||
"import yaml\n",
|
||
"from collections import defaultdict\n",
|
||
"import pandas as pd\n",
|
||
"import numpy as np\n",
|
||
"from IPython.display import display, HTML"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 2,
|
||
"id": "1e73c539-8e4e-40be-973a-72d7d1f3a93e",
|
||
"metadata": {},
|
||
"outputs": [],
|
||
"source": [
|
||
"SECURITY_CONTENT_PATH = \"~/security_content/detections/\"\n",
|
||
"sec_content_name_and_story = defaultdict(list)\n",
|
||
"mitre_attack_id_info_dict = defaultdict(list)\n",
|
||
"mitre_attack_tid_dict = defaultdict(list)\n",
|
||
"mitre_attack_fn_dict = defaultdict(list)\n",
|
||
"mitre_attack_story_dict = defaultdict(list)\n",
|
||
"mitre_attack_tid_name_dict = defaultdict(list)\n",
|
||
"home_path = Path.home()\n",
|
||
"story_detection_list = []"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 3,
|
||
"id": "bf35a8ba-2f3f-4983-85c8-e7a1ba4c3802",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"outputs": [],
|
||
"source": [
|
||
"def display_side_by_side(dfs:list, captions:list):\n",
|
||
" \"\"\"Display tables side by side to save vertical space\n",
|
||
" Input:\n",
|
||
" dfs: list of pandas.DataFrame\n",
|
||
" captions: list of table captions\n",
|
||
" \"\"\"\n",
|
||
" output = \"\"\n",
|
||
" combined = dict(zip(captions, dfs))\n",
|
||
" for caption, df in combined.items():\n",
|
||
" output += df.style.set_table_attributes(\"style='display:inline'\").set_caption(caption)._repr_html_()\n",
|
||
" output += \"\\xa0\\xa0\\xa0\"\n",
|
||
" display(HTML(output))\n",
|
||
"\n",
|
||
"def expand_path(file_path):\n",
|
||
" if \"~\" in file_path:\n",
|
||
" return str(file_path).replace(\"~\", str(home_path))\n",
|
||
" else:\n",
|
||
" return file_path\n",
|
||
"\n",
|
||
"def generate_name_and_story_dict(sec_content_path, story):\n",
|
||
" \n",
|
||
" for roots, dirs, files in os.walk(sec_content_path):\n",
|
||
" temp_file_name = \"\"\n",
|
||
" #print(\"[+] enumerating yml files in: {0}\".format(roots))\n",
|
||
" detection_base_dir_name = os.path.basename(roots)\n",
|
||
" \n",
|
||
" for f in files:\n",
|
||
" temp_file_name = os.path.join(detection_base_dir_name, f)\n",
|
||
" file_path = os.path.join(roots, f)\n",
|
||
" if file_path.endswith(\".yml\"):\n",
|
||
" parse_yml_file(file_path, temp_file_name, story)\n",
|
||
" print(\"[+] total detection found: {0}\".format(len(story_detection_list)))\n",
|
||
" return\n",
|
||
" \n",
|
||
"def parse_yml_file(file_path, base_file_name, story):\n",
|
||
" file_name = os.path.basename(base_file_name)\n",
|
||
" mitre_tid = \"\"\n",
|
||
" tid_json_obj = load_attack_id_json()\n",
|
||
" with open(file_path, \"r\") as f:\n",
|
||
" yml_buff = yaml.safe_load(f)\n",
|
||
" \n",
|
||
" for s in story:\n",
|
||
" s = s.strip()\n",
|
||
" if s in yml_buff['tags']['analytic_story']:\n",
|
||
"\n",
|
||
" sec_content_name_and_story[s].append(file_name)\n",
|
||
" print(\" [{0}] : {1}\".format(s, base_file_name))\n",
|
||
" story_detection_list.append(base_file_name)\n",
|
||
" #f_name = \"-\".join(yml_buff['tags'][\"mitre_attack_id\"]) + \":\" + file_name \n",
|
||
" f_name = file_name\n",
|
||
"\n",
|
||
"\n",
|
||
" mitre_attack_id_info_dict[f_name].append(s)\n",
|
||
" for m in yml_buff['tags'][\"mitre_attack_id\"]:\n",
|
||
"\n",
|
||
" mitre_attack_tid_dict[m].append(s)\n",
|
||
" mitre_attack_tid_dict[m] = sorted(list(set(mitre_attack_tid_dict[m])))\n",
|
||
" \n",
|
||
" mitre_attack_fn_dict[m].append(s + \":\" +file_name)\n",
|
||
" mitre_attack_fn_dict[m] = sorted(list(set(mitre_attack_fn_dict[m])))\n",
|
||
" \n",
|
||
"\n",
|
||
" mitre_attack_story_dict[s].append(m)\n",
|
||
" mitre_attack_story_dict[s] = sorted(list(set(mitre_attack_story_dict[s])))\n",
|
||
" \n",
|
||
" new_key = m + \"-\" + tid_json_obj[m].replace(\" \", \"_\")\n",
|
||
" mitre_attack_tid_name_dict[new_key].append(s)\n",
|
||
" mitre_attack_tid_name_dict[new_key] = sorted(list(set(mitre_attack_tid_name_dict[new_key])))\n",
|
||
" #logger.info(self.mitre_attack_id_info_dict[file_name])\n",
|
||
" #for mitre_tid in yml_buff['tags']['mitre_attack_id']:\n",
|
||
" # self.mitre_attack_tid_dict[mitre_tid].append(s)\n",
|
||
" \n",
|
||
" return\n",
|
||
"\n",
|
||
"def load_attack_id_json():\n",
|
||
" template_path = os.path.join(os.getcwd(), \"templates\")\n",
|
||
" tid_json_path = os.path.join(template_path, \"tid.json\")\n",
|
||
" with open(tid_json_path, \"r\") as f:\n",
|
||
" tid_json_obj = json.load(f)\n",
|
||
" return tid_json_obj\n",
|
||
"\n",
|
||
"def process_sec_content(story_list):\n",
|
||
" debug = 0\n",
|
||
" print(\" [+] story coverage needed: {0}\".format(story_list))\n",
|
||
" normalized_security_content_path = expand_path(SECURITY_CONTENT_PATH)\n",
|
||
" generate_name_and_story_dict(normalized_security_content_path, story_list)\n",
|
||
" if debug == 1:\n",
|
||
" print(\"\\n-----------------------------\\n[-] detection name vs analytic story - mitre_attack_id_info_dict \\n-----------------------------\\n\")\n",
|
||
" for k, v in mitre_attack_id_info_dict.items():\n",
|
||
" print(\"[{0}] detection name: {1} related story: {2}\".format(len(v), k, v)) \n",
|
||
" print(\"\\n-----------------------------\\n[-] mitre attack id vs analytic story - mitre_attack_tid_dict \\n-----------------------------\\n\")\n",
|
||
" for k, v in mitre_attack_tid_dict.items():\n",
|
||
" print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v))))\n",
|
||
" print(\"\\n-----------------------------\\n[-] mitre attack id vs story:detectioname - mitre_attack_fn_dict \\n-----------------------------\\n\")\n",
|
||
" for k, v in mitre_attack_fn_dict.items():\n",
|
||
" print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v)))) \n",
|
||
" print(\"\\n-----------------------------\\n[-] story vs id - mitre_attack_story_dict \\n-----------------------------\\n\")\n",
|
||
" for k, v in mitre_attack_story_dict.items():\n",
|
||
" print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v)))) \n",
|
||
" \n",
|
||
"def highlight_cells_5(val):\n",
|
||
" color= \"\"\n",
|
||
" for k ,v in mitre_attack_tid_dict.items():\n",
|
||
" if val == k and len(v) == 5:\n",
|
||
" color = 'yellow'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
"\n",
|
||
"def highlight_cells_4(val):\n",
|
||
" color= \"\"\n",
|
||
" for k ,v in mitre_attack_tid_dict.items():\n",
|
||
" if val == k and len(v) == 4:\n",
|
||
" color = 'orange'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" \n",
|
||
"def highlight_cells_3(val):\n",
|
||
" color= \"\"\n",
|
||
" for k ,v in mitre_attack_tid_dict.items():\n",
|
||
" if val == k and len(v) == 3:\n",
|
||
" color = 'lightgreen'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
"\n",
|
||
"def highlight_cells_2(val):\n",
|
||
" color= \"\"\n",
|
||
" for k ,v in mitre_attack_tid_dict.items():\n",
|
||
" if val == k and len(v) == 2:\n",
|
||
" color = 'lightblue'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
"\n",
|
||
"def highlight_cells_1(val):\n",
|
||
" color= \"\"\n",
|
||
" for k ,v in mitre_attack_tid_dict.items():\n",
|
||
" if val == k and len(v) == 1:\n",
|
||
" color = 'lightgray'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
"\n",
|
||
"def summary_table_of_id(dict_name, det_len): \n",
|
||
" temp_dict = {} \n",
|
||
" for k, v in dict_name.items():\n",
|
||
" if len(v) == det_len:\n",
|
||
" temp_dict[k] = v \n",
|
||
" return temp_dict\n",
|
||
"\n",
|
||
"def detection_list_by_count(det_table_dict): \n",
|
||
" detection_count_by_id = {}\n",
|
||
" for k, det_dict in det_table_dict.items():\n",
|
||
" t = {}\n",
|
||
" for s_, d in det_dict.items():\n",
|
||
" t[s_] = \"(\" + str(len(d)) + \")-detection count\"\n",
|
||
" detection_count_by_id[k] = t \n",
|
||
" return pd.DataFrame.from_dict(detection_count_by_id, orient='index')\n",
|
||
"\n",
|
||
"def detection_list_by_id(temp_dict): \n",
|
||
" det_table_dict = {}\n",
|
||
" for k, v in temp_dict.items():\n",
|
||
" temp_d = defaultdict(list)\n",
|
||
" for fn in mitre_attack_fn_dict[k]:\n",
|
||
" s_,d = fn.split(\":\")\n",
|
||
" temp_d[s_].append(d)\n",
|
||
" det_table_dict[k] = temp_d\n",
|
||
" \n",
|
||
" return det_table_dict\n",
|
||
"\n",
|
||
"\n",
|
||
"def highlight_cells(val):\n",
|
||
" color= \"\"\n",
|
||
" for k ,v in mitre_attack_tid_dict.items():\n",
|
||
" if val == k and len(v) == 5:\n",
|
||
" color = 'yellow'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == k and len(v) == 4:\n",
|
||
" color = 'orange'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == k and len(v) == 3:\n",
|
||
" color = 'lightgreen'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == k and len(v) == 2:\n",
|
||
" color = 'lightblue'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == k and len(v) == 1:\n",
|
||
" color = 'lightgray' \n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
"\n",
|
||
"def highlight_legend(val):\n",
|
||
" color= \"\"\n",
|
||
" if val == \"yellow\":\n",
|
||
" color = 'yellow'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == 'orange':\n",
|
||
" color = 'orange'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == 'lightgreen':\n",
|
||
" color = 'lightgreen'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == 'lightblue':\n",
|
||
" color = 'lightblue'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" elif val == \"lightgray\":\n",
|
||
" color = 'lightgray' \n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
"\n",
|
||
"def highlight_nan(val):\n",
|
||
" color= \"\"\n",
|
||
" if val == \"NaN\":\n",
|
||
" color = 'black'\n",
|
||
" return 'background-color: {}'.format(color)\n",
|
||
" \n",
|
||
"def show_legend():\n",
|
||
" color_dict = {\"5 malware coverage\":\"yellow\", \"4 malware coverage\":\"orange\", \"3 malware coverage\":\"lightgreen\", \"2 malware coverage\":\"lightblue\", \"1 malware coverage\":\"lightgray\"}\n",
|
||
" cf = pd.DataFrame.from_dict(color_dict, orient='index')\n",
|
||
" \n",
|
||
" return cf.style.applymap(highlight_legend)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 4,
|
||
"id": "293bd920-aeac-405e-8a4a-4291fe6abbbe",
|
||
"metadata": {},
|
||
"outputs": [],
|
||
"source": [
|
||
"def main():\n",
|
||
" \n",
|
||
" pd.options.display.max_colwidth = 1000\n",
|
||
" pd.set_option('display.max_rows', 500)\n",
|
||
" story_list = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]\n",
|
||
" process_sec_content(story_list)\n",
|
||
" \n",
|
||
" return"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "74a4cf30-31a9-4cb1-9a26-a4f88cdc5605",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Scan Detections\n",
|
||
"Scanning Splunk Security Content Analytic Detections related to the 5 CISA Malware family that STRT worked on."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 5,
|
||
"id": "926af3fd-3b64-4d3f-8bb7-f839e5aaf45a",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
" [+] story coverage needed: ['Qakbot', 'Azorult', 'Remcos', 'Trickbot', 'AgentTesla']\n",
|
||
" [Remcos] : endpoint/powershell_windows_defender_exclusion_commands.yml\n",
|
||
" [AgentTesla] : endpoint/powershell_windows_defender_exclusion_commands.yml\n",
|
||
" [Remcos] : endpoint/vbscript_execution_using_wscript_app.yml\n",
|
||
" [Azorult] : endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n",
|
||
" [Azorult] : endpoint/excessive_attempt_to_disable_services.yml\n",
|
||
" [Qakbot] : endpoint/windows_process_injection_remote_thread.yml\n",
|
||
" [Azorult] : endpoint/windows_remote_access_software_rms_registry.yml\n",
|
||
" [Azorult] : endpoint/windows_remote_services_allow_remote_assistance.yml\n",
|
||
" [Qakbot] : endpoint/system_user_discovery_with_whoami.yml\n",
|
||
" [Trickbot] : endpoint/wermgr_process_create_executable_file.yml\n",
|
||
" [Qakbot] : endpoint/windows_iso_lnk_file_creation.yml\n",
|
||
" [Azorult] : endpoint/windows_iso_lnk_file_creation.yml\n",
|
||
" [Remcos] : endpoint/windows_iso_lnk_file_creation.yml\n",
|
||
" [AgentTesla] : endpoint/windows_iso_lnk_file_creation.yml\n",
|
||
" [Qakbot] : endpoint/windows_system_discovery_using_qwinsta.yml\n",
|
||
" [Azorult] : endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n",
|
||
" [Qakbot] : endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n",
|
||
" [Trickbot] : endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n",
|
||
" [Remcos] : endpoint/remcos_rat_file_creation_in_remcos_folder.yml\n",
|
||
" [Azorult] : endpoint/hide_user_account_from_sign_in_screen.yml\n",
|
||
" [Trickbot] : endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n",
|
||
" [Azorult] : endpoint/processes_launching_netsh.yml\n",
|
||
" [Azorult] : endpoint/icacls_deny_command.yml\n",
|
||
" [Remcos] : endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n",
|
||
" [Azorult] : endpoint/excessive_usage_of_taskkill.yml\n",
|
||
" [AgentTesla] : endpoint/excessive_usage_of_taskkill.yml\n",
|
||
" [Azorult] : endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n",
|
||
" [Azorult] : endpoint/allow_operation_with_consent_admin.yml\n",
|
||
" [Remcos] : endpoint/suspicious_wav_file_in_appdata_folder.yml\n",
|
||
" [Azorult] : endpoint/windows_remote_services_rdp_enable.yml\n",
|
||
" [Qakbot] : endpoint/network_connection_discovery_netstat.yml\n",
|
||
" [AgentTesla] : endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml\n",
|
||
" [Azorult] : endpoint/windows_modify_registry_regedit_silent_reg_import.yml\n",
|
||
" [Qakbot] : endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n",
|
||
" [Qakbot] : endpoint/windows_wmi_process_call_create.yml\n",
|
||
" [Qakbot] : endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n",
|
||
" [Remcos] : endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n",
|
||
" [Qakbot] : endpoint/windows_masquerading_explorer_as_child_process.yml\n",
|
||
" [Qakbot] : endpoint/schtasks_run_task_on_demand.yml\n",
|
||
" [Qakbot] : endpoint/network_connection_discovery_arp.yml\n",
|
||
" [Qakbot] : endpoint/create_remote_thread_in_shell_application.yml\n",
|
||
" [Azorult] : endpoint/disable_windows_behavior_monitoring.yml\n",
|
||
" [Azorult] : endpoint/excessive_usage_of_cacls_app.yml\n",
|
||
" [Remcos] : endpoint/loading_of_dynwrapx_module.yml\n",
|
||
" [Remcos] : endpoint/possible_browser_pass_view_parameter.yml\n",
|
||
" [Qakbot] : endpoint/network_discovery_using_route_windows_app.yml\n",
|
||
" [Trickbot] : endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n",
|
||
" [Qakbot] : endpoint/malicious_powershell_process___encoded_command.yml\n",
|
||
" [AgentTesla] : endpoint/windows_drivers_loaded_by_signature.yml\n",
|
||
" [Qakbot] : endpoint/suspicious_regsvr32_register_suspicious_path.yml\n",
|
||
" [Qakbot] : endpoint/recon_avproduct_through_pwh_or_wmi.yml\n",
|
||
" [Azorult] : endpoint/suspicious_scheduled_task_from_public_directory.yml\n",
|
||
" [AgentTesla] : endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n",
|
||
" [Remcos] : endpoint/remcos_client_registry_install_entry.yml\n",
|
||
" [Qakbot] : endpoint/windows_dll_side_loading_in_calc.yml\n",
|
||
" [Qakbot] : endpoint/office_product_spawn_cmd_process.yml\n",
|
||
" [Azorult] : endpoint/office_product_spawn_cmd_process.yml\n",
|
||
" [Remcos] : endpoint/office_product_spawn_cmd_process.yml\n",
|
||
" [Trickbot] : endpoint/office_product_spawn_cmd_process.yml\n",
|
||
" [AgentTesla] : endpoint/office_product_spawn_cmd_process.yml\n",
|
||
" [Trickbot] : endpoint/cobalt_strike_named_pipes.yml\n",
|
||
" [Remcos] : endpoint/suspicious_image_creation_in_appdata_folder.yml\n",
|
||
" [Azorult] : endpoint/create_local_admin_accounts_using_net_exe.yml\n",
|
||
" [Qakbot] : endpoint/disable_defender_spynet_reporting.yml\n",
|
||
" [Azorult] : endpoint/disable_defender_spynet_reporting.yml\n",
|
||
" [Remcos] : endpoint/office_product_spawning_windows_script_host.yml\n",
|
||
" [Remcos] : endpoint/process_deleting_its_process_file_path.yml\n",
|
||
" [Qakbot] : endpoint/cmd_carry_out_string_command_parameter.yml\n",
|
||
" [Azorult] : endpoint/cmd_carry_out_string_command_parameter.yml\n",
|
||
" [Trickbot] : endpoint/office_application_spawn_rundll32_process.yml\n",
|
||
" [AgentTesla] : endpoint/office_application_spawn_rundll32_process.yml\n",
|
||
" [Azorult] : endpoint/excessive_usage_of_net_app.yml\n",
|
||
" [Azorult] : endpoint/disabling_remote_user_account_control.yml\n",
|
||
" [Remcos] : endpoint/disabling_remote_user_account_control.yml\n",
|
||
" [AgentTesla] : endpoint/disabling_remote_user_account_control.yml\n",
|
||
" [Qakbot] : endpoint/windows_command_shell_fetch_env_variables.yml\n",
|
||
" [Azorult] : endpoint/firewall_allowed_program_enable.yml\n",
|
||
" [Qakbot] : endpoint/recon_using_wmi_class.yml\n",
|
||
" [Qakbot] : endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml\n",
|
||
" [Qakbot] : endpoint/windows_system_discovery_using_ldap_nslookup.yml\n",
|
||
" [Qakbot] : endpoint/windows_service_created_with_suspicious_service_path.yml\n",
|
||
" [Trickbot] : endpoint/trickbot_named_pipe.yml\n",
|
||
" [Qakbot] : endpoint/system_processes_run_from_unexpected_locations.yml\n",
|
||
" [AgentTesla] : endpoint/suspicious_driver_loaded_path.yml\n",
|
||
" [Azorult] : endpoint/windows_disableantispyware_reg.yml\n",
|
||
" [Azorult] : endpoint/office_product_spawning_mshta.yml\n",
|
||
" [Azorult] : endpoint/network_connection_discovery_net.yml\n",
|
||
" [Qakbot] : endpoint/windows_process_injection_wermgr_child_process.yml\n",
|
||
" [Azorult] : endpoint/sc_exe_manipulating_windows_services.yml\n",
|
||
" [Qakbot] : endpoint/suspicious_process_file_path.yml\n",
|
||
" [Azorult] : endpoint/suspicious_process_file_path.yml\n",
|
||
" [Remcos] : endpoint/suspicious_process_file_path.yml\n",
|
||
" [Trickbot] : endpoint/suspicious_process_file_path.yml\n",
|
||
" [AgentTesla] : endpoint/suspicious_process_file_path.yml\n",
|
||
" [Qakbot] : endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml\n",
|
||
" [AgentTesla] : endpoint/windows_multi_hop_proxy_tor_website_query.yml\n",
|
||
" [Remcos] : endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n",
|
||
" [Azorult] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n",
|
||
" [Remcos] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n",
|
||
" [AgentTesla] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n",
|
||
" [Azorult] : endpoint/windows_service_stop_by_deletion.yml\n",
|
||
" [Trickbot] : endpoint/schedule_task_with_rundll32_command_trigger.yml\n",
|
||
" [Remcos] : endpoint/jscript_execution_using_cscript_app.yml\n",
|
||
" [Qakbot] : endpoint/services_exe_lolbas_execution_process_spawn.yml\n",
|
||
" [Azorult] : endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml\n",
|
||
" [Qakbot] : endpoint/windows_regsvr32_renamed_binary.yml\n",
|
||
" [Remcos] : endpoint/winhlp32_spawning_a_process.yml\n",
|
||
" [Azorult] : endpoint/attempt_to_stop_security_service.yml\n",
|
||
" [Trickbot] : endpoint/attempt_to_stop_security_service.yml\n",
|
||
" [Azorult] : endpoint/excessive_usage_of_sc_service_utility.yml\n",
|
||
" [Remcos] : endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n",
|
||
" [AgentTesla] : endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n",
|
||
" [Azorult] : endpoint/chcp_command_execution.yml\n",
|
||
" [Qakbot] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
|
||
" [Azorult] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
|
||
" [Trickbot] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
|
||
" [AgentTesla] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n",
|
||
" [Azorult] : endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml\n",
|
||
" [Trickbot] : endpoint/account_discovery_with_net_app.yml\n",
|
||
" [Trickbot] : endpoint/suspicious_rundll32_startw.yml\n",
|
||
" [Azorult] : endpoint/windows_modify_registry_disallow_windows_app.yml\n",
|
||
" [AgentTesla] : endpoint/detect_html_help_spawn_child_process.yml\n",
|
||
" [Qakbot] : endpoint/suspicious_copy_on_system32.yml\n",
|
||
" [Azorult] : endpoint/disable_defender_submit_samples_consent_feature.yml\n",
|
||
" [Azorult] : endpoint/windows_powershell_import_applocker_policy.yml\n",
|
||
" [Trickbot] : endpoint/executable_file_written_in_administrative_smb_share.yml\n",
|
||
" [Azorult] : endpoint/wmic_noninteractive_app_uninstallation.yml\n",
|
||
" [Qakbot] : endpoint/office_document_executing_macro_code.yml\n",
|
||
" [Azorult] : endpoint/office_document_executing_macro_code.yml\n",
|
||
" [Remcos] : endpoint/office_document_executing_macro_code.yml\n",
|
||
" [Trickbot] : endpoint/office_document_executing_macro_code.yml\n",
|
||
" [AgentTesla] : endpoint/office_document_executing_macro_code.yml\n",
|
||
" [Azorult] : endpoint/disable_show_hidden_files.yml\n",
|
||
" [Azorult] : endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n",
|
||
" [Azorult] : endpoint/windows_valid_account_with_never_expires_password.yml\n",
|
||
" [Qakbot] : endpoint/winevent_windows_task_scheduler_event_action_started.yml\n",
|
||
" [AgentTesla] : endpoint/windows_mail_protocol_in_non_common_process_path.yml\n",
|
||
" [Remcos] : endpoint/system_info_gathering_using_dxdiag_application.yml\n",
|
||
" [Remcos] : endpoint/process_writing_dynamicwrapperx.yml\n",
|
||
" [Qakbot] : endpoint/windows_process_injection_of_wermgr_to_known_browser.yml\n",
|
||
" [Remcos] : endpoint/add_or_set_windows_defender_exclusion.yml\n",
|
||
" [AgentTesla] : endpoint/add_or_set_windows_defender_exclusion.yml\n",
|
||
" [Trickbot] : endpoint/powershell_remote_thread_to_known_windows_process.yml\n",
|
||
" [Azorult] : endpoint/disable_defender_enhanced_notification.yml\n",
|
||
" [Azorult] : endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n",
|
||
" [Trickbot] : endpoint/office_product_spawning_certutil.yml\n",
|
||
" [AgentTesla] : endpoint/office_product_spawning_certutil.yml\n",
|
||
" [AgentTesla] : endpoint/office_application_drop_executable.yml\n",
|
||
" [Qakbot] : endpoint/process_creating_lnk_file_in_suspicious_location.yml\n",
|
||
" [Qakbot] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
|
||
" [Azorult] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
|
||
" [Remcos] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
|
||
" [Trickbot] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
|
||
" [AgentTesla] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n",
|
||
" [Azorult] : endpoint/windows_modify_registry_suppress_win_defender_notif.yml\n",
|
||
" [Qakbot] : endpoint/nltest_domain_trust_discovery.yml\n",
|
||
" [Qakbot] : endpoint/windows_modify_registry_qakbot_binary_data_registry.yml\n",
|
||
" [Qakbot] : endpoint/windows_defender_exclusion_registry_entry.yml\n",
|
||
" [Azorult] : endpoint/windows_defender_exclusion_registry_entry.yml\n",
|
||
" [Remcos] : endpoint/windows_defender_exclusion_registry_entry.yml\n",
|
||
" [Qakbot] : endpoint/office_application_spawn_regsvr32_process.yml\n",
|
||
" [Qakbot] : endpoint/windows_wmi_impersonate_token.yml\n",
|
||
" [Azorult] : endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml\n",
|
||
" [Azorult] : endpoint/windows_modify_registry_disable_windows_security_center_notif.yml\n",
|
||
" [Azorult] : endpoint/windows_modify_registry_disable_toast_notifications.yml\n",
|
||
" [Azorult] : endpoint/hiding_files_and_directories_with_attrib_exe.yml\n",
|
||
" [Remcos] : endpoint/wscript_or_cscript_suspicious_child_process.yml\n",
|
||
" [AgentTesla] : endpoint/powershell___connect_to_internet_with_hidden_window.yml\n",
|
||
" [Azorult] : endpoint/disable_defender_blockatfirstseen_feature.yml\n",
|
||
" [Qakbot] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
|
||
" [Azorult] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
|
||
" [Remcos] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
|
||
" [AgentTesla] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n",
|
||
" [Qakbot] : endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n",
|
||
" [Azorult] : endpoint/net_localgroup_discovery.yml\n",
|
||
" [Azorult] : endpoint/windows_modify_registry_disabling_wer_settings.yml\n",
|
||
" [Qakbot] : endpoint/windows_dll_side_loading_process_child_of_calc.yml\n",
|
||
" [Qakbot] : endpoint/registry_keys_used_for_persistence.yml\n",
|
||
" [Azorult] : endpoint/registry_keys_used_for_persistence.yml\n",
|
||
" [Remcos] : endpoint/registry_keys_used_for_persistence.yml\n",
|
||
" [Azorult] : endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n",
|
||
" [AgentTesla] : endpoint/windows_driver_load_non_standard_path.yml\n",
|
||
" [Qakbot] : endpoint/windows_schtasks_create_run_as_system.yml\n",
|
||
" [Remcos] : endpoint/malicious_inprocserver32_modification.yml\n",
|
||
"[+] total detection found: 184\n"
|
||
]
|
||
}
|
||
],
|
||
"source": [
|
||
"if __name__ == \"__main__\":\n",
|
||
" main()"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 6,
|
||
"id": "74eef86f-b203-447d-96e0-231744aa1c66",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>0</th>\n",
|
||
" <td>T1036</td>\n",
|
||
" <td>T1014</td>\n",
|
||
" <td>T1021</td>\n",
|
||
" <td>T1016</td>\n",
|
||
" <td>T1021</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>1</th>\n",
|
||
" <td>T1055</td>\n",
|
||
" <td>T1036</td>\n",
|
||
" <td>T1021.001</td>\n",
|
||
" <td>T1016.001</td>\n",
|
||
" <td>T1021.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>2</th>\n",
|
||
" <td>T1055.001</td>\n",
|
||
" <td>T1053</td>\n",
|
||
" <td>T1036</td>\n",
|
||
" <td>T1027</td>\n",
|
||
" <td>T1027</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>3</th>\n",
|
||
" <td>T1059</td>\n",
|
||
" <td>T1053.005</td>\n",
|
||
" <td>T1049</td>\n",
|
||
" <td>T1033</td>\n",
|
||
" <td>T1036</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>4</th>\n",
|
||
" <td>T1059.005</td>\n",
|
||
" <td>T1059</td>\n",
|
||
" <td>T1053</td>\n",
|
||
" <td>T1036</td>\n",
|
||
" <td>T1053</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>5</th>\n",
|
||
" <td>T1059.007</td>\n",
|
||
" <td>T1059.001</td>\n",
|
||
" <td>T1053.005</td>\n",
|
||
" <td>T1036.003</td>\n",
|
||
" <td>T1053.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>6</th>\n",
|
||
" <td>T1070</td>\n",
|
||
" <td>T1068</td>\n",
|
||
" <td>T1059</td>\n",
|
||
" <td>T1047</td>\n",
|
||
" <td>T1055</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>7</th>\n",
|
||
" <td>T1112</td>\n",
|
||
" <td>T1071</td>\n",
|
||
" <td>T1059.001</td>\n",
|
||
" <td>T1049</td>\n",
|
||
" <td>T1059</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>8</th>\n",
|
||
" <td>T1113</td>\n",
|
||
" <td>T1071.003</td>\n",
|
||
" <td>T1059.003</td>\n",
|
||
" <td>T1053</td>\n",
|
||
" <td>T1087</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>9</th>\n",
|
||
" <td>T1134</td>\n",
|
||
" <td>T1204</td>\n",
|
||
" <td>T1069</td>\n",
|
||
" <td>T1053.005</td>\n",
|
||
" <td>T1087.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>10</th>\n",
|
||
" <td>T1134.004</td>\n",
|
||
" <td>T1204.001</td>\n",
|
||
" <td>T1069.001</td>\n",
|
||
" <td>T1055</td>\n",
|
||
" <td>T1218</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>11</th>\n",
|
||
" <td>T1204</td>\n",
|
||
" <td>T1218</td>\n",
|
||
" <td>T1071</td>\n",
|
||
" <td>T1055.001</td>\n",
|
||
" <td>T1218.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>12</th>\n",
|
||
" <td>T1204.001</td>\n",
|
||
" <td>T1218.001</td>\n",
|
||
" <td>T1112</td>\n",
|
||
" <td>T1055.002</td>\n",
|
||
" <td>T1218.011</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>13</th>\n",
|
||
" <td>T1218</td>\n",
|
||
" <td>T1543</td>\n",
|
||
" <td>T1136</td>\n",
|
||
" <td>T1059</td>\n",
|
||
" <td>T1543</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>14</th>\n",
|
||
" <td>T1218.010</td>\n",
|
||
" <td>T1543.003</td>\n",
|
||
" <td>T1136.001</td>\n",
|
||
" <td>T1059.001</td>\n",
|
||
" <td>T1562</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>15</th>\n",
|
||
" <td>T1543</td>\n",
|
||
" <td>T1548</td>\n",
|
||
" <td>T1204</td>\n",
|
||
" <td>T1059.003</td>\n",
|
||
" <td>T1562.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>16</th>\n",
|
||
" <td>T1547</td>\n",
|
||
" <td>T1548.002</td>\n",
|
||
" <td>T1204.001</td>\n",
|
||
" <td>T1059.007</td>\n",
|
||
" <td>T1566</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>17</th>\n",
|
||
" <td>T1547.001</td>\n",
|
||
" <td>T1555</td>\n",
|
||
" <td>T1219</td>\n",
|
||
" <td>T1071</td>\n",
|
||
" <td>T1566.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>18</th>\n",
|
||
" <td>T1548</td>\n",
|
||
" <td>T1555.003</td>\n",
|
||
" <td>T1222</td>\n",
|
||
" <td>T1112</td>\n",
|
||
" <td>T1590</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>19</th>\n",
|
||
" <td>T1548.002</td>\n",
|
||
" <td>T1562</td>\n",
|
||
" <td>T1222.001</td>\n",
|
||
" <td>T1204</td>\n",
|
||
" <td>T1590.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>20</th>\n",
|
||
" <td>T1555</td>\n",
|
||
" <td>T1562.001</td>\n",
|
||
" <td>T1489</td>\n",
|
||
" <td>T1204.001</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>21</th>\n",
|
||
" <td>T1555.003</td>\n",
|
||
" <td>T1566</td>\n",
|
||
" <td>T1531</td>\n",
|
||
" <td>T1218</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>22</th>\n",
|
||
" <td>T1559.001</td>\n",
|
||
" <td>T1566.001</td>\n",
|
||
" <td>T1543</td>\n",
|
||
" <td>T1218.010</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>23</th>\n",
|
||
" <td>T1562</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1543.003</td>\n",
|
||
" <td>T1482</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>24</th>\n",
|
||
" <td>T1562.001</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1547</td>\n",
|
||
" <td>T1543</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>25</th>\n",
|
||
" <td>T1566</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1547.001</td>\n",
|
||
" <td>T1543.003</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>26</th>\n",
|
||
" <td>T1566.001</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1548</td>\n",
|
||
" <td>T1547</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>27</th>\n",
|
||
" <td>T1592</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1548.002</td>\n",
|
||
" <td>T1547.001</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>28</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1555</td>\n",
|
||
" <td>T1562</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>29</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1555.003</td>\n",
|
||
" <td>T1562.001</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>30</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1562</td>\n",
|
||
" <td>T1566</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>31</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1562.001</td>\n",
|
||
" <td>T1566.001</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>32</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1562.004</td>\n",
|
||
" <td>T1566.002</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>33</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1564</td>\n",
|
||
" <td>T1569</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>34</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1564.001</td>\n",
|
||
" <td>T1569.002</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>35</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1566</td>\n",
|
||
" <td>T1574</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>36</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1566.001</td>\n",
|
||
" <td>T1574.001</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>37</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1569</td>\n",
|
||
" <td>T1574.002</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>38</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1569.002</td>\n",
|
||
" <td>T1592</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>39</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1590</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>40</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>T1590.005</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" Remcos AgentTesla Azorult Qakbot Trickbot\n",
|
||
"0 T1036 T1014 T1021 T1016 T1021\n",
|
||
"1 T1055 T1036 T1021.001 T1016.001 T1021.002\n",
|
||
"2 T1055.001 T1053 T1036 T1027 T1027\n",
|
||
"3 T1059 T1053.005 T1049 T1033 T1036\n",
|
||
"4 T1059.005 T1059 T1053 T1036 T1053\n",
|
||
"5 T1059.007 T1059.001 T1053.005 T1036.003 T1053.005\n",
|
||
"6 T1070 T1068 T1059 T1047 T1055\n",
|
||
"7 T1112 T1071 T1059.001 T1049 T1059\n",
|
||
"8 T1113 T1071.003 T1059.003 T1053 T1087\n",
|
||
"9 T1134 T1204 T1069 T1053.005 T1087.002\n",
|
||
"10 T1134.004 T1204.001 T1069.001 T1055 T1218\n",
|
||
"11 T1204 T1218 T1071 T1055.001 T1218.005\n",
|
||
"12 T1204.001 T1218.001 T1112 T1055.002 T1218.011\n",
|
||
"13 T1218 T1543 T1136 T1059 T1543\n",
|
||
"14 T1218.010 T1543.003 T1136.001 T1059.001 T1562\n",
|
||
"15 T1543 T1548 T1204 T1059.003 T1562.001\n",
|
||
"16 T1547 T1548.002 T1204.001 T1059.007 T1566\n",
|
||
"17 T1547.001 T1555 T1219 T1071 T1566.001\n",
|
||
"18 T1548 T1555.003 T1222 T1112 T1590\n",
|
||
"19 T1548.002 T1562 T1222.001 T1204 T1590.005\n",
|
||
"20 T1555 T1562.001 T1489 T1204.001 NaN\n",
|
||
"21 T1555.003 T1566 T1531 T1218 NaN\n",
|
||
"22 T1559.001 T1566.001 T1543 T1218.010 NaN\n",
|
||
"23 T1562 NaN T1543.003 T1482 NaN\n",
|
||
"24 T1562.001 NaN T1547 T1543 NaN\n",
|
||
"25 T1566 NaN T1547.001 T1543.003 NaN\n",
|
||
"26 T1566.001 NaN T1548 T1547 NaN\n",
|
||
"27 T1592 NaN T1548.002 T1547.001 NaN\n",
|
||
"28 NaN NaN T1555 T1562 NaN\n",
|
||
"29 NaN NaN T1555.003 T1562.001 NaN\n",
|
||
"30 NaN NaN T1562 T1566 NaN\n",
|
||
"31 NaN NaN T1562.001 T1566.001 NaN\n",
|
||
"32 NaN NaN T1562.004 T1566.002 NaN\n",
|
||
"33 NaN NaN T1564 T1569 NaN\n",
|
||
"34 NaN NaN T1564.001 T1569.002 NaN\n",
|
||
"35 NaN NaN T1566 T1574 NaN\n",
|
||
"36 NaN NaN T1566.001 T1574.001 NaN\n",
|
||
"37 NaN NaN T1569 T1574.002 NaN\n",
|
||
"38 NaN NaN T1569.002 T1592 NaN\n",
|
||
"39 NaN NaN T1590 NaN NaN\n",
|
||
"40 NaN NaN T1590.005 NaN NaN"
|
||
]
|
||
},
|
||
"execution_count": 6,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"df = pd.DataFrame({ key:pd.Series(value) for key, value in mitre_attack_story_dict.items() })\n",
|
||
"df = df.sort_values(by =[\"Remcos\", \"Azorult\", \"Qakbot\", \"Trickbot\", \"AgentTesla\"])\n",
|
||
"df\n",
|
||
" "
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "e1325b00-3932-4ba3-92ad-25d9d382354b",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"source": [
|
||
"## Security Content mitre attack id Coverage for [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 7,
|
||
"id": "2fb85a5d-d498-43c1-97a5-08da5c0f6c32",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_afed1_row0_col0 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_afed1_row1_col0 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_afed1_row2_col0 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_afed1_row3_col0 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_afed1_row4_col0 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_afed1\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_afed1_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_afed1_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
|
||
" <td id=\"T_afed1_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_afed1_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
|
||
" <td id=\"T_afed1_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_afed1_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
|
||
" <td id=\"T_afed1_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_afed1_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
|
||
" <td id=\"T_afed1_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_afed1_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
|
||
" <td id=\"T_afed1_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12bfedfa0>"
|
||
]
|
||
},
|
||
"execution_count": 7,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"show_legend()\n"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 8,
|
||
"id": "0868588f-3ab0-4065-be94-b6632544a204",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_c2526_row0_col0, #T_c2526_row1_col1, #T_c2526_row2_col2, #T_c2526_row3_col0, #T_c2526_row3_col4, #T_c2526_row4_col1, #T_c2526_row4_col3, #T_c2526_row6_col2, #T_c2526_row7_col4, #T_c2526_row13_col1, #T_c2526_row13_col3, #T_c2526_row13_col4, #T_c2526_row14_col4, #T_c2526_row15_col0, #T_c2526_row15_col4, #T_c2526_row16_col4, #T_c2526_row17_col4, #T_c2526_row19_col1, #T_c2526_row20_col1, #T_c2526_row21_col1, #T_c2526_row22_col1, #T_c2526_row22_col2, #T_c2526_row23_col0, #T_c2526_row24_col0, #T_c2526_row24_col3, #T_c2526_row25_col0, #T_c2526_row26_col0, #T_c2526_row28_col3, #T_c2526_row29_col3, #T_c2526_row30_col2, #T_c2526_row30_col3, #T_c2526_row31_col2, #T_c2526_row31_col3, #T_c2526_row35_col2, #T_c2526_row36_col2 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_c2526_row0_col1, #T_c2526_row0_col3, #T_c2526_row1_col2, #T_c2526_row1_col3, #T_c2526_row1_col4, #T_c2526_row3_col3, #T_c2526_row4_col0, #T_c2526_row5_col3, #T_c2526_row6_col0, #T_c2526_row6_col1, #T_c2526_row6_col3, #T_c2526_row8_col0, #T_c2526_row8_col1, #T_c2526_row8_col4, #T_c2526_row9_col0, #T_c2526_row9_col2, #T_c2526_row9_col4, #T_c2526_row10_col0, #T_c2526_row10_col2, #T_c2526_row11_col4, #T_c2526_row12_col1, #T_c2526_row12_col3, #T_c2526_row12_col4, #T_c2526_row13_col2, #T_c2526_row14_col2, #T_c2526_row17_col2, #T_c2526_row18_col2, #T_c2526_row19_col2, #T_c2526_row20_col2, #T_c2526_row21_col2, #T_c2526_row22_col0, #T_c2526_row23_col3, #T_c2526_row32_col2, #T_c2526_row32_col3, #T_c2526_row33_col2, #T_c2526_row34_col2, #T_c2526_row35_col3, #T_c2526_row36_col3, #T_c2526_row37_col3 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"#T_c2526_row0_col2, #T_c2526_row0_col4, #T_c2526_row2_col0, #T_c2526_row2_col3, #T_c2526_row2_col4, #T_c2526_row3_col2, #T_c2526_row5_col0, #T_c2526_row7_col3, #T_c2526_row8_col2, #T_c2526_row11_col3, #T_c2526_row14_col0, #T_c2526_row15_col3, #T_c2526_row16_col3, #T_c2526_row18_col4, #T_c2526_row19_col4, #T_c2526_row22_col3, #T_c2526_row27_col0, #T_c2526_row33_col3, #T_c2526_row34_col3, #T_c2526_row37_col2, #T_c2526_row38_col2, #T_c2526_row38_col3, #T_c2526_row39_col2, #T_c2526_row40_col2 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_c2526_row1_col0, #T_c2526_row5_col1, #T_c2526_row6_col4, #T_c2526_row7_col0, #T_c2526_row7_col1, #T_c2526_row7_col2, #T_c2526_row10_col3, #T_c2526_row11_col2, #T_c2526_row12_col2, #T_c2526_row14_col1, #T_c2526_row14_col3, #T_c2526_row15_col1, #T_c2526_row16_col0, #T_c2526_row16_col1, #T_c2526_row17_col0, #T_c2526_row17_col1, #T_c2526_row17_col3, #T_c2526_row18_col0, #T_c2526_row18_col1, #T_c2526_row18_col3, #T_c2526_row19_col0, #T_c2526_row20_col0, #T_c2526_row21_col0, #T_c2526_row23_col2, #T_c2526_row24_col2, #T_c2526_row25_col2, #T_c2526_row25_col3, #T_c2526_row26_col2, #T_c2526_row26_col3, #T_c2526_row27_col2, #T_c2526_row27_col3, #T_c2526_row28_col2, #T_c2526_row29_col2 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_c2526_row2_col1, #T_c2526_row3_col1, #T_c2526_row4_col2, #T_c2526_row4_col4, #T_c2526_row5_col2, #T_c2526_row5_col4, #T_c2526_row8_col3, #T_c2526_row9_col1, #T_c2526_row9_col3, #T_c2526_row10_col1, #T_c2526_row10_col4, #T_c2526_row11_col0, #T_c2526_row11_col1, #T_c2526_row12_col0, #T_c2526_row13_col0, #T_c2526_row15_col2, #T_c2526_row16_col2, #T_c2526_row19_col3, #T_c2526_row20_col3, #T_c2526_row21_col3 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_c2526\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_c2526_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
|
||
" <th id=\"T_c2526_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
|
||
" <th id=\"T_c2526_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
|
||
" <th id=\"T_c2526_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
|
||
" <th id=\"T_c2526_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
|
||
" <td id=\"T_c2526_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
|
||
" <td id=\"T_c2526_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
|
||
" <td id=\"T_c2526_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
|
||
" <td id=\"T_c2526_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
|
||
" <td id=\"T_c2526_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
|
||
" <td id=\"T_c2526_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
|
||
" <td id=\"T_c2526_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
|
||
" <td id=\"T_c2526_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
|
||
" <td id=\"T_c2526_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
|
||
" <td id=\"T_c2526_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
|
||
" <td id=\"T_c2526_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
|
||
" <td id=\"T_c2526_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
|
||
" <td id=\"T_c2526_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
|
||
" <td id=\"T_c2526_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
|
||
" <td id=\"T_c2526_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
|
||
" <td id=\"T_c2526_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
|
||
" <td id=\"T_c2526_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
|
||
" <td id=\"T_c2526_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
|
||
" <td id=\"T_c2526_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
|
||
" <td id=\"T_c2526_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
|
||
" <td id=\"T_c2526_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
|
||
" <td id=\"T_c2526_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
|
||
" <td id=\"T_c2526_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
|
||
" <td id=\"T_c2526_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
|
||
" <td id=\"T_c2526_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
|
||
" <td id=\"T_c2526_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
|
||
" <td id=\"T_c2526_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
|
||
" <td id=\"T_c2526_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
|
||
" <td id=\"T_c2526_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
|
||
" <td id=\"T_c2526_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
|
||
" <td id=\"T_c2526_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
|
||
" <td id=\"T_c2526_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
|
||
" <td id=\"T_c2526_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
|
||
" <td id=\"T_c2526_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
|
||
" <td id=\"T_c2526_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
|
||
" <td id=\"T_c2526_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
|
||
" <td id=\"T_c2526_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
|
||
" <td id=\"T_c2526_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
|
||
" <td id=\"T_c2526_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
|
||
" <td id=\"T_c2526_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
|
||
" <td id=\"T_c2526_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
|
||
" <td id=\"T_c2526_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
|
||
" <td id=\"T_c2526_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
|
||
" <td id=\"T_c2526_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
|
||
" <td id=\"T_c2526_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
|
||
" <td id=\"T_c2526_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
|
||
" <td id=\"T_c2526_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
|
||
" <td id=\"T_c2526_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
|
||
" <td id=\"T_c2526_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
|
||
" <td id=\"T_c2526_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
|
||
" <td id=\"T_c2526_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
|
||
" <td id=\"T_c2526_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
|
||
" <td id=\"T_c2526_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
|
||
" <td id=\"T_c2526_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
|
||
" <td id=\"T_c2526_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
|
||
" <td id=\"T_c2526_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
|
||
" <td id=\"T_c2526_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
|
||
" <td id=\"T_c2526_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
|
||
" <td id=\"T_c2526_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
|
||
" <td id=\"T_c2526_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
|
||
" <td id=\"T_c2526_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
|
||
" <td id=\"T_c2526_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
|
||
" <td id=\"T_c2526_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
|
||
" <td id=\"T_c2526_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
|
||
" <td id=\"T_c2526_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
|
||
" <td id=\"T_c2526_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
|
||
" <td id=\"T_c2526_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
|
||
" <td id=\"T_c2526_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
|
||
" <td id=\"T_c2526_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
|
||
" <td id=\"T_c2526_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
|
||
" <td id=\"T_c2526_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
|
||
" <td id=\"T_c2526_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
|
||
" <td id=\"T_c2526_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
|
||
" <td id=\"T_c2526_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
|
||
" <td id=\"T_c2526_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
|
||
" <td id=\"T_c2526_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
|
||
" <td id=\"T_c2526_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
|
||
" <td id=\"T_c2526_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
|
||
" <td id=\"T_c2526_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
|
||
" <td id=\"T_c2526_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
|
||
" <td id=\"T_c2526_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
|
||
" <td id=\"T_c2526_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
|
||
" <td id=\"T_c2526_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
|
||
" <td id=\"T_c2526_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
|
||
" <td id=\"T_c2526_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
|
||
" <td id=\"T_c2526_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
|
||
" <td id=\"T_c2526_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
|
||
" <td id=\"T_c2526_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
|
||
" <td id=\"T_c2526_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
|
||
" <td id=\"T_c2526_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
|
||
" <td id=\"T_c2526_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
|
||
" <td id=\"T_c2526_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
|
||
" <td id=\"T_c2526_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
|
||
" <td id=\"T_c2526_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
|
||
" <td id=\"T_c2526_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
|
||
" <td id=\"T_c2526_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
|
||
" <td id=\"T_c2526_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
|
||
" <td id=\"T_c2526_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
|
||
" <td id=\"T_c2526_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
|
||
" <td id=\"T_c2526_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
|
||
" <td id=\"T_c2526_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
|
||
" <td id=\"T_c2526_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
|
||
" <td id=\"T_c2526_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
|
||
" <td id=\"T_c2526_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
|
||
" <td id=\"T_c2526_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
|
||
" <td id=\"T_c2526_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
|
||
" <td id=\"T_c2526_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
|
||
" <td id=\"T_c2526_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
|
||
" <td id=\"T_c2526_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
|
||
" <td id=\"T_c2526_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
|
||
" <td id=\"T_c2526_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
|
||
" <td id=\"T_c2526_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
|
||
" <td id=\"T_c2526_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
|
||
" <td id=\"T_c2526_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
|
||
" <td id=\"T_c2526_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
|
||
" <td id=\"T_c2526_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
|
||
" <td id=\"T_c2526_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
|
||
" <td id=\"T_c2526_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
|
||
" <td id=\"T_c2526_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
|
||
" <td id=\"T_c2526_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
|
||
" <td id=\"T_c2526_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
|
||
" <td id=\"T_c2526_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
|
||
" <td id=\"T_c2526_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
|
||
" <td id=\"T_c2526_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
|
||
" <td id=\"T_c2526_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
|
||
" <td id=\"T_c2526_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
|
||
" <td id=\"T_c2526_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
|
||
" <td id=\"T_c2526_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
|
||
" <td id=\"T_c2526_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
|
||
" <td id=\"T_c2526_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
|
||
" <td id=\"T_c2526_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
|
||
" <td id=\"T_c2526_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
|
||
" <td id=\"T_c2526_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
|
||
" <td id=\"T_c2526_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
|
||
" <td id=\"T_c2526_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
|
||
" <td id=\"T_c2526_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
|
||
" <td id=\"T_c2526_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
|
||
" <td id=\"T_c2526_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
|
||
" <td id=\"T_c2526_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
|
||
" <td id=\"T_c2526_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
|
||
" <td id=\"T_c2526_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
|
||
" <td id=\"T_c2526_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
|
||
" <td id=\"T_c2526_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
|
||
" <td id=\"T_c2526_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
|
||
" <td id=\"T_c2526_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
|
||
" <td id=\"T_c2526_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
|
||
" <td id=\"T_c2526_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
|
||
" <td id=\"T_c2526_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
|
||
" <td id=\"T_c2526_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
|
||
" <td id=\"T_c2526_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
|
||
" <td id=\"T_c2526_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
|
||
" <td id=\"T_c2526_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
|
||
" <td id=\"T_c2526_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
|
||
" <td id=\"T_c2526_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
|
||
" <td id=\"T_c2526_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
|
||
" <td id=\"T_c2526_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
|
||
" <td id=\"T_c2526_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
|
||
" <td id=\"T_c2526_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
|
||
" <td id=\"T_c2526_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
|
||
" <td id=\"T_c2526_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
|
||
" <td id=\"T_c2526_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
|
||
" <td id=\"T_c2526_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
|
||
" <td id=\"T_c2526_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
|
||
" <td id=\"T_c2526_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
|
||
" <td id=\"T_c2526_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
|
||
" <td id=\"T_c2526_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
|
||
" <td id=\"T_c2526_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
|
||
" <td id=\"T_c2526_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
|
||
" <td id=\"T_c2526_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
|
||
" <td id=\"T_c2526_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_c2526_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
|
||
" <td id=\"T_c2526_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
|
||
" <td id=\"T_c2526_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
|
||
" <td id=\"T_c2526_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1f36a0>"
|
||
]
|
||
},
|
||
"execution_count": 8,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"\n",
|
||
"df.style.applymap(highlight_cells)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "a7510444-c411-443e-b8b5-de788fb940c2",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"source": [
|
||
"### Highlight Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 9,
|
||
"id": "fcc9a6f6-cd1d-4150-8896-ec1e12b50e68",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_67470_row0_col0 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_67470_row1_col0 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_67470_row2_col0 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_67470_row3_col0 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_67470_row4_col0 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_67470\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_67470_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67470_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
|
||
" <td id=\"T_67470_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67470_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
|
||
" <td id=\"T_67470_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67470_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
|
||
" <td id=\"T_67470_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67470_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
|
||
" <td id=\"T_67470_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67470_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
|
||
" <td id=\"T_67470_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c2109a0>"
|
||
]
|
||
},
|
||
"execution_count": 9,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"show_legend()"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 10,
|
||
"id": "29cb6e5d-8929-4620-8707-917886b3107c",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_e8c5e_row0_col0, #T_e8c5e_row1_col1, #T_e8c5e_row2_col2, #T_e8c5e_row3_col0, #T_e8c5e_row3_col4, #T_e8c5e_row4_col1, #T_e8c5e_row4_col3, #T_e8c5e_row6_col2, #T_e8c5e_row7_col4, #T_e8c5e_row13_col1, #T_e8c5e_row13_col3, #T_e8c5e_row13_col4, #T_e8c5e_row14_col4, #T_e8c5e_row15_col0, #T_e8c5e_row15_col4, #T_e8c5e_row16_col4, #T_e8c5e_row17_col4, #T_e8c5e_row19_col1, #T_e8c5e_row20_col1, #T_e8c5e_row21_col1, #T_e8c5e_row22_col1, #T_e8c5e_row22_col2, #T_e8c5e_row23_col0, #T_e8c5e_row24_col0, #T_e8c5e_row24_col3, #T_e8c5e_row25_col0, #T_e8c5e_row26_col0, #T_e8c5e_row28_col3, #T_e8c5e_row29_col3, #T_e8c5e_row30_col2, #T_e8c5e_row30_col3, #T_e8c5e_row31_col2, #T_e8c5e_row31_col3, #T_e8c5e_row35_col2, #T_e8c5e_row36_col2 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_e8c5e\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_e8c5e_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
|
||
" <th id=\"T_e8c5e_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
|
||
" <th id=\"T_e8c5e_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
|
||
" <th id=\"T_e8c5e_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
|
||
" <th id=\"T_e8c5e_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
|
||
" <td id=\"T_e8c5e_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
|
||
" <td id=\"T_e8c5e_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
|
||
" <td id=\"T_e8c5e_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
|
||
" <td id=\"T_e8c5e_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
|
||
" <td id=\"T_e8c5e_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
|
||
" <td id=\"T_e8c5e_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
|
||
" <td id=\"T_e8c5e_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
|
||
" <td id=\"T_e8c5e_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
|
||
" <td id=\"T_e8c5e_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
|
||
" <td id=\"T_e8c5e_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
|
||
" <td id=\"T_e8c5e_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
|
||
" <td id=\"T_e8c5e_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
|
||
" <td id=\"T_e8c5e_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
|
||
" <td id=\"T_e8c5e_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
|
||
" <td id=\"T_e8c5e_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
|
||
" <td id=\"T_e8c5e_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
|
||
" <td id=\"T_e8c5e_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
|
||
" <td id=\"T_e8c5e_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
|
||
" <td id=\"T_e8c5e_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
|
||
" <td id=\"T_e8c5e_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
|
||
" <td id=\"T_e8c5e_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
|
||
" <td id=\"T_e8c5e_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
|
||
" <td id=\"T_e8c5e_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
|
||
" <td id=\"T_e8c5e_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
|
||
" <td id=\"T_e8c5e_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
|
||
" <td id=\"T_e8c5e_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
|
||
" <td id=\"T_e8c5e_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
|
||
" <td id=\"T_e8c5e_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
|
||
" <td id=\"T_e8c5e_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
|
||
" <td id=\"T_e8c5e_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
|
||
" <td id=\"T_e8c5e_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
|
||
" <td id=\"T_e8c5e_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
|
||
" <td id=\"T_e8c5e_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
|
||
" <td id=\"T_e8c5e_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
|
||
" <td id=\"T_e8c5e_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
|
||
" <td id=\"T_e8c5e_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
|
||
" <td id=\"T_e8c5e_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
|
||
" <td id=\"T_e8c5e_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
|
||
" <td id=\"T_e8c5e_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
|
||
" <td id=\"T_e8c5e_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
|
||
" <td id=\"T_e8c5e_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
|
||
" <td id=\"T_e8c5e_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
|
||
" <td id=\"T_e8c5e_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
|
||
" <td id=\"T_e8c5e_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
|
||
" <td id=\"T_e8c5e_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
|
||
" <td id=\"T_e8c5e_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
|
||
" <td id=\"T_e8c5e_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
|
||
" <td id=\"T_e8c5e_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
|
||
" <td id=\"T_e8c5e_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
|
||
" <td id=\"T_e8c5e_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
|
||
" <td id=\"T_e8c5e_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
|
||
" <td id=\"T_e8c5e_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
|
||
" <td id=\"T_e8c5e_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
|
||
" <td id=\"T_e8c5e_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
|
||
" <td id=\"T_e8c5e_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
|
||
" <td id=\"T_e8c5e_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
|
||
" <td id=\"T_e8c5e_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
|
||
" <td id=\"T_e8c5e_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
|
||
" <td id=\"T_e8c5e_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
|
||
" <td id=\"T_e8c5e_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
|
||
" <td id=\"T_e8c5e_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
|
||
" <td id=\"T_e8c5e_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
|
||
" <td id=\"T_e8c5e_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
|
||
" <td id=\"T_e8c5e_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
|
||
" <td id=\"T_e8c5e_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
|
||
" <td id=\"T_e8c5e_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
|
||
" <td id=\"T_e8c5e_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
|
||
" <td id=\"T_e8c5e_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
|
||
" <td id=\"T_e8c5e_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
|
||
" <td id=\"T_e8c5e_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
|
||
" <td id=\"T_e8c5e_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
|
||
" <td id=\"T_e8c5e_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
|
||
" <td id=\"T_e8c5e_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
|
||
" <td id=\"T_e8c5e_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
|
||
" <td id=\"T_e8c5e_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
|
||
" <td id=\"T_e8c5e_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
|
||
" <td id=\"T_e8c5e_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
|
||
" <td id=\"T_e8c5e_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
|
||
" <td id=\"T_e8c5e_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
|
||
" <td id=\"T_e8c5e_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
|
||
" <td id=\"T_e8c5e_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
|
||
" <td id=\"T_e8c5e_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
|
||
" <td id=\"T_e8c5e_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
|
||
" <td id=\"T_e8c5e_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
|
||
" <td id=\"T_e8c5e_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
|
||
" <td id=\"T_e8c5e_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
|
||
" <td id=\"T_e8c5e_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
|
||
" <td id=\"T_e8c5e_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
|
||
" <td id=\"T_e8c5e_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
|
||
" <td id=\"T_e8c5e_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
|
||
" <td id=\"T_e8c5e_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
|
||
" <td id=\"T_e8c5e_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
|
||
" <td id=\"T_e8c5e_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
|
||
" <td id=\"T_e8c5e_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
|
||
" <td id=\"T_e8c5e_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
|
||
" <td id=\"T_e8c5e_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
|
||
" <td id=\"T_e8c5e_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
|
||
" <td id=\"T_e8c5e_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
|
||
" <td id=\"T_e8c5e_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
|
||
" <td id=\"T_e8c5e_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
|
||
" <td id=\"T_e8c5e_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
|
||
" <td id=\"T_e8c5e_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
|
||
" <td id=\"T_e8c5e_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
|
||
" <td id=\"T_e8c5e_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
|
||
" <td id=\"T_e8c5e_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
|
||
" <td id=\"T_e8c5e_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
|
||
" <td id=\"T_e8c5e_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
|
||
" <td id=\"T_e8c5e_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
|
||
" <td id=\"T_e8c5e_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
|
||
" <td id=\"T_e8c5e_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
|
||
" <td id=\"T_e8c5e_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
|
||
" <td id=\"T_e8c5e_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
|
||
" <td id=\"T_e8c5e_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
|
||
" <td id=\"T_e8c5e_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
|
||
" <td id=\"T_e8c5e_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
|
||
" <td id=\"T_e8c5e_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
|
||
" <td id=\"T_e8c5e_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
|
||
" <td id=\"T_e8c5e_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
|
||
" <td id=\"T_e8c5e_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
|
||
" <td id=\"T_e8c5e_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
|
||
" <td id=\"T_e8c5e_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
|
||
" <td id=\"T_e8c5e_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
|
||
" <td id=\"T_e8c5e_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
|
||
" <td id=\"T_e8c5e_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
|
||
" <td id=\"T_e8c5e_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
|
||
" <td id=\"T_e8c5e_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
|
||
" <td id=\"T_e8c5e_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
|
||
" <td id=\"T_e8c5e_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
|
||
" <td id=\"T_e8c5e_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
|
||
" <td id=\"T_e8c5e_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
|
||
" <td id=\"T_e8c5e_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
|
||
" <td id=\"T_e8c5e_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
|
||
" <td id=\"T_e8c5e_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
|
||
" <td id=\"T_e8c5e_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
|
||
" <td id=\"T_e8c5e_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
|
||
" <td id=\"T_e8c5e_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
|
||
" <td id=\"T_e8c5e_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
|
||
" <td id=\"T_e8c5e_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
|
||
" <td id=\"T_e8c5e_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
|
||
" <td id=\"T_e8c5e_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
|
||
" <td id=\"T_e8c5e_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
|
||
" <td id=\"T_e8c5e_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
|
||
" <td id=\"T_e8c5e_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
|
||
" <td id=\"T_e8c5e_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
|
||
" <td id=\"T_e8c5e_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
|
||
" <td id=\"T_e8c5e_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
|
||
" <td id=\"T_e8c5e_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
|
||
" <td id=\"T_e8c5e_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
|
||
" <td id=\"T_e8c5e_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
|
||
" <td id=\"T_e8c5e_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
|
||
" <td id=\"T_e8c5e_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
|
||
" <td id=\"T_e8c5e_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
|
||
" <td id=\"T_e8c5e_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
|
||
" <td id=\"T_e8c5e_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
|
||
" <td id=\"T_e8c5e_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
|
||
" <td id=\"T_e8c5e_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
|
||
" <td id=\"T_e8c5e_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
|
||
" <td id=\"T_e8c5e_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
|
||
" <td id=\"T_e8c5e_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
|
||
" <td id=\"T_e8c5e_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
|
||
" <td id=\"T_e8c5e_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
|
||
" <td id=\"T_e8c5e_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
|
||
" <td id=\"T_e8c5e_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
|
||
" <td id=\"T_e8c5e_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
|
||
" <td id=\"T_e8c5e_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
|
||
" <td id=\"T_e8c5e_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
|
||
" <td id=\"T_e8c5e_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
|
||
" <td id=\"T_e8c5e_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
|
||
" <td id=\"T_e8c5e_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
|
||
" <td id=\"T_e8c5e_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e8c5e_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
|
||
" <td id=\"T_e8c5e_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
|
||
" <td id=\"T_e8c5e_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
|
||
" <td id=\"T_e8c5e_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1f3c10>"
|
||
]
|
||
},
|
||
"execution_count": 10,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"df.style.applymap(highlight_cells_5)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "c30e6a45-7728-4e91-aa34-88242a623b0c",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Summary of Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 11,
|
||
"id": "91f6821c-20ed-4c4d-968a-267cdf9bea36",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>0</th>\n",
|
||
" <th>1</th>\n",
|
||
" <th>2</th>\n",
|
||
" <th>3</th>\n",
|
||
" <th>4</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1562.001</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1562</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566.001</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1036</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1543</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" 0 1 2 3 4\n",
|
||
"T1562.001 AgentTesla Azorult Qakbot Remcos Trickbot\n",
|
||
"T1562 AgentTesla Azorult Qakbot Remcos Trickbot\n",
|
||
"T1059 AgentTesla Azorult Qakbot Remcos Trickbot\n",
|
||
"T1566.001 AgentTesla Azorult Qakbot Remcos Trickbot\n",
|
||
"T1566 AgentTesla Azorult Qakbot Remcos Trickbot\n",
|
||
"T1036 AgentTesla Azorult Qakbot Remcos Trickbot\n",
|
||
"T1543 AgentTesla Azorult Qakbot Remcos Trickbot"
|
||
]
|
||
},
|
||
"execution_count": 11,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"\n",
|
||
"temp_dict = summary_table_of_id(mitre_attack_tid_dict, 5)\n",
|
||
"tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
|
||
"tdf"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "77c29341-1e19-404b-acd6-7cc20cccc1dc",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection list for Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 12,
|
||
"id": "05d30039-ae22-4ea1-b381-064d8826cb57",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(7, 5)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1562.001</th>\n",
|
||
" <td>[add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml]</td>\n",
|
||
" <td>[attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, hide_user_account_from_sign_in_screen.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml]</td>\n",
|
||
" <td>[disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
|
||
" <td>[add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
|
||
" <td>[attempt_to_stop_security_service.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1562</th>\n",
|
||
" <td>[add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml]</td>\n",
|
||
" <td>[attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, firewall_allowed_program_enable.yml, hide_user_account_from_sign_in_screen.yml, processes_launching_netsh.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml]</td>\n",
|
||
" <td>[disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
|
||
" <td>[add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml]</td>\n",
|
||
" <td>[attempt_to_stop_security_service.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059</th>\n",
|
||
" <td>[powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml]</td>\n",
|
||
" <td>[chcp_command_execution.yml, cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml]</td>\n",
|
||
" <td>[cmd_carry_out_string_command_parameter.yml, cmdline_tool_not_executed_in_cmd_shell.yml, wermgr_process_spawned_cmd_or_powershell_process.yml]</td>\n",
|
||
" <td>[jscript_execution_using_cscript_app.yml, process_writing_dynamicwrapperx.yml, suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml]</td>\n",
|
||
" <td>[wermgr_process_spawned_cmd_or_powershell_process.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566.001</th>\n",
|
||
" <td>[office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566</th>\n",
|
||
" <td>[office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, process_creating_lnk_file_in_suspicious_location.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml]</td>\n",
|
||
" <td>[office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1036</th>\n",
|
||
" <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
|
||
" <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
|
||
" <td>[executables_or_script_creation_in_suspicious_path.yml, suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml]</td>\n",
|
||
" <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
|
||
" <td>[executables_or_script_creation_in_suspicious_path.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1543</th>\n",
|
||
" <td>[suspicious_driver_loaded_path.yml, suspicious_process_file_path.yml]</td>\n",
|
||
" <td>[sc_exe_manipulating_windows_services.yml, suspicious_process_file_path.yml]</td>\n",
|
||
" <td>[services_exe_lolbas_execution_process_spawn.yml, suspicious_process_file_path.yml]</td>\n",
|
||
" <td>[suspicious_process_file_path.yml, wscript_or_cscript_suspicious_child_process.yml]</td>\n",
|
||
" <td>[suspicious_process_file_path.yml]</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" AgentTesla \\\n",
|
||
"T1562.001 [add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml] \n",
|
||
"T1562 [add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml] \n",
|
||
"T1059 [powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml] \n",
|
||
"T1566.001 [office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1566 [office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1036 [executables_or_script_creation_in_suspicious_path.yml] \n",
|
||
"T1543 [suspicious_driver_loaded_path.yml, suspicious_process_file_path.yml] \n",
|
||
"\n",
|
||
" Azorult \\\n",
|
||
"T1562.001 [attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, hide_user_account_from_sign_in_screen.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml] \n",
|
||
"T1562 [attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, firewall_allowed_program_enable.yml, hide_user_account_from_sign_in_screen.yml, processes_launching_netsh.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml] \n",
|
||
"T1059 [chcp_command_execution.yml, cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml] \n",
|
||
"T1566.001 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1566 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1036 [executables_or_script_creation_in_suspicious_path.yml] \n",
|
||
"T1543 [sc_exe_manipulating_windows_services.yml, suspicious_process_file_path.yml] \n",
|
||
"\n",
|
||
" Qakbot \\\n",
|
||
"T1562.001 [disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml] \n",
|
||
"T1562 [disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml] \n",
|
||
"T1059 [cmd_carry_out_string_command_parameter.yml, cmdline_tool_not_executed_in_cmd_shell.yml, wermgr_process_spawned_cmd_or_powershell_process.yml] \n",
|
||
"T1566.001 [office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1566 [office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, process_creating_lnk_file_in_suspicious_location.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1036 [executables_or_script_creation_in_suspicious_path.yml, suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml] \n",
|
||
"T1543 [services_exe_lolbas_execution_process_spawn.yml, suspicious_process_file_path.yml] \n",
|
||
"\n",
|
||
" Remcos \\\n",
|
||
"T1562.001 [add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml] \n",
|
||
"T1562 [add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml] \n",
|
||
"T1059 [jscript_execution_using_cscript_app.yml, process_writing_dynamicwrapperx.yml, suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml] \n",
|
||
"T1566.001 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1566 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n",
|
||
"T1036 [executables_or_script_creation_in_suspicious_path.yml] \n",
|
||
"T1543 [suspicious_process_file_path.yml, wscript_or_cscript_suspicious_child_process.yml] \n",
|
||
"\n",
|
||
" Trickbot \n",
|
||
"T1562.001 [attempt_to_stop_security_service.yml] \n",
|
||
"T1562 [attempt_to_stop_security_service.yml] \n",
|
||
"T1059 [wermgr_process_spawned_cmd_or_powershell_process.yml] \n",
|
||
"T1566.001 [office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml] \n",
|
||
"T1566 [office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml] \n",
|
||
"T1036 [executables_or_script_creation_in_suspicious_path.yml] \n",
|
||
"T1543 [suspicious_process_file_path.yml] "
|
||
]
|
||
},
|
||
"execution_count": 12,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"det_table_dict = detection_list_by_id(temp_dict)\n",
|
||
"tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf "
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "2f50a79c-075e-46ea-a00e-c535f01f304f",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection count per mitre attack id in each malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 13,
|
||
"id": "bd5233dd-a4fd-49bf-86ff-f46cbb6f9ce9",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1562.001</th>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(14)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1562</th>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(16)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059</th>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(4)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566.001</th>\n",
|
||
" <td>(7)-detection count</td>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>(4)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566</th>\n",
|
||
" <td>(7)-detection count</td>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>(6)-detection count</td>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>(4)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1036</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1543</th>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" AgentTesla Azorult Qakbot \\\n",
|
||
"T1562.001 (3)-detection count (14)-detection count (2)-detection count \n",
|
||
"T1562 (3)-detection count (16)-detection count (2)-detection count \n",
|
||
"T1059 (2)-detection count (3)-detection count (3)-detection count \n",
|
||
"T1566.001 (7)-detection count (5)-detection count (5)-detection count \n",
|
||
"T1566 (7)-detection count (5)-detection count (6)-detection count \n",
|
||
"T1036 (1)-detection count (1)-detection count (3)-detection count \n",
|
||
"T1543 (2)-detection count (2)-detection count (2)-detection count \n",
|
||
"\n",
|
||
" Remcos Trickbot \n",
|
||
"T1562.001 (3)-detection count (1)-detection count \n",
|
||
"T1562 (3)-detection count (1)-detection count \n",
|
||
"T1059 (4)-detection count (1)-detection count \n",
|
||
"T1566.001 (5)-detection count (4)-detection count \n",
|
||
"T1566 (5)-detection count (4)-detection count \n",
|
||
"T1036 (1)-detection count (1)-detection count \n",
|
||
"T1543 (2)-detection count (1)-detection count "
|
||
]
|
||
},
|
||
"execution_count": 13,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"detection_list_by_count(det_table_dict)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "a7cbd7a7-46d2-464d-9af7-d1a65c87b822",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Highlight Mitre Attack ID that detects 4/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 14,
|
||
"id": "2a32699e-442b-458f-9b24-bb753efc5325",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_2b475_row0_col0 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_2b475_row1_col0 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_2b475_row2_col0 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_2b475_row3_col0 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_2b475_row4_col0 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_2b475\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_2b475_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_2b475_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
|
||
" <td id=\"T_2b475_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_2b475_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
|
||
" <td id=\"T_2b475_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_2b475_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
|
||
" <td id=\"T_2b475_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_2b475_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
|
||
" <td id=\"T_2b475_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_2b475_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
|
||
" <td id=\"T_2b475_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1db400>"
|
||
]
|
||
},
|
||
"execution_count": 14,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"show_legend()"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 15,
|
||
"id": "cdad9857-37ff-40a5-8cbd-532cb23f6373",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_bd535_row2_col1, #T_bd535_row3_col1, #T_bd535_row4_col2, #T_bd535_row4_col4, #T_bd535_row5_col2, #T_bd535_row5_col4, #T_bd535_row8_col3, #T_bd535_row9_col1, #T_bd535_row9_col3, #T_bd535_row10_col1, #T_bd535_row10_col4, #T_bd535_row11_col0, #T_bd535_row11_col1, #T_bd535_row12_col0, #T_bd535_row13_col0, #T_bd535_row15_col2, #T_bd535_row16_col2, #T_bd535_row19_col3, #T_bd535_row20_col3, #T_bd535_row21_col3 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_bd535\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_bd535_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
|
||
" <th id=\"T_bd535_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
|
||
" <th id=\"T_bd535_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
|
||
" <th id=\"T_bd535_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
|
||
" <th id=\"T_bd535_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
|
||
" <td id=\"T_bd535_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
|
||
" <td id=\"T_bd535_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
|
||
" <td id=\"T_bd535_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
|
||
" <td id=\"T_bd535_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
|
||
" <td id=\"T_bd535_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
|
||
" <td id=\"T_bd535_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
|
||
" <td id=\"T_bd535_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
|
||
" <td id=\"T_bd535_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
|
||
" <td id=\"T_bd535_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
|
||
" <td id=\"T_bd535_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
|
||
" <td id=\"T_bd535_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
|
||
" <td id=\"T_bd535_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
|
||
" <td id=\"T_bd535_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
|
||
" <td id=\"T_bd535_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
|
||
" <td id=\"T_bd535_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
|
||
" <td id=\"T_bd535_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
|
||
" <td id=\"T_bd535_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
|
||
" <td id=\"T_bd535_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
|
||
" <td id=\"T_bd535_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
|
||
" <td id=\"T_bd535_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
|
||
" <td id=\"T_bd535_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
|
||
" <td id=\"T_bd535_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
|
||
" <td id=\"T_bd535_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
|
||
" <td id=\"T_bd535_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
|
||
" <td id=\"T_bd535_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
|
||
" <td id=\"T_bd535_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
|
||
" <td id=\"T_bd535_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
|
||
" <td id=\"T_bd535_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
|
||
" <td id=\"T_bd535_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
|
||
" <td id=\"T_bd535_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
|
||
" <td id=\"T_bd535_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
|
||
" <td id=\"T_bd535_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
|
||
" <td id=\"T_bd535_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
|
||
" <td id=\"T_bd535_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
|
||
" <td id=\"T_bd535_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
|
||
" <td id=\"T_bd535_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
|
||
" <td id=\"T_bd535_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
|
||
" <td id=\"T_bd535_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
|
||
" <td id=\"T_bd535_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
|
||
" <td id=\"T_bd535_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
|
||
" <td id=\"T_bd535_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
|
||
" <td id=\"T_bd535_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
|
||
" <td id=\"T_bd535_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
|
||
" <td id=\"T_bd535_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
|
||
" <td id=\"T_bd535_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
|
||
" <td id=\"T_bd535_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
|
||
" <td id=\"T_bd535_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
|
||
" <td id=\"T_bd535_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
|
||
" <td id=\"T_bd535_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
|
||
" <td id=\"T_bd535_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
|
||
" <td id=\"T_bd535_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
|
||
" <td id=\"T_bd535_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
|
||
" <td id=\"T_bd535_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
|
||
" <td id=\"T_bd535_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
|
||
" <td id=\"T_bd535_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
|
||
" <td id=\"T_bd535_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
|
||
" <td id=\"T_bd535_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
|
||
" <td id=\"T_bd535_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
|
||
" <td id=\"T_bd535_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
|
||
" <td id=\"T_bd535_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
|
||
" <td id=\"T_bd535_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
|
||
" <td id=\"T_bd535_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
|
||
" <td id=\"T_bd535_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
|
||
" <td id=\"T_bd535_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
|
||
" <td id=\"T_bd535_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
|
||
" <td id=\"T_bd535_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
|
||
" <td id=\"T_bd535_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
|
||
" <td id=\"T_bd535_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
|
||
" <td id=\"T_bd535_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
|
||
" <td id=\"T_bd535_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
|
||
" <td id=\"T_bd535_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
|
||
" <td id=\"T_bd535_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
|
||
" <td id=\"T_bd535_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
|
||
" <td id=\"T_bd535_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
|
||
" <td id=\"T_bd535_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
|
||
" <td id=\"T_bd535_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
|
||
" <td id=\"T_bd535_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
|
||
" <td id=\"T_bd535_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
|
||
" <td id=\"T_bd535_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
|
||
" <td id=\"T_bd535_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
|
||
" <td id=\"T_bd535_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
|
||
" <td id=\"T_bd535_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
|
||
" <td id=\"T_bd535_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
|
||
" <td id=\"T_bd535_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
|
||
" <td id=\"T_bd535_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
|
||
" <td id=\"T_bd535_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
|
||
" <td id=\"T_bd535_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
|
||
" <td id=\"T_bd535_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
|
||
" <td id=\"T_bd535_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
|
||
" <td id=\"T_bd535_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
|
||
" <td id=\"T_bd535_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
|
||
" <td id=\"T_bd535_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
|
||
" <td id=\"T_bd535_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
|
||
" <td id=\"T_bd535_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
|
||
" <td id=\"T_bd535_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
|
||
" <td id=\"T_bd535_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
|
||
" <td id=\"T_bd535_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
|
||
" <td id=\"T_bd535_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
|
||
" <td id=\"T_bd535_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
|
||
" <td id=\"T_bd535_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
|
||
" <td id=\"T_bd535_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
|
||
" <td id=\"T_bd535_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
|
||
" <td id=\"T_bd535_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
|
||
" <td id=\"T_bd535_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
|
||
" <td id=\"T_bd535_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
|
||
" <td id=\"T_bd535_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
|
||
" <td id=\"T_bd535_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
|
||
" <td id=\"T_bd535_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
|
||
" <td id=\"T_bd535_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
|
||
" <td id=\"T_bd535_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
|
||
" <td id=\"T_bd535_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
|
||
" <td id=\"T_bd535_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
|
||
" <td id=\"T_bd535_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
|
||
" <td id=\"T_bd535_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
|
||
" <td id=\"T_bd535_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
|
||
" <td id=\"T_bd535_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
|
||
" <td id=\"T_bd535_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
|
||
" <td id=\"T_bd535_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
|
||
" <td id=\"T_bd535_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
|
||
" <td id=\"T_bd535_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
|
||
" <td id=\"T_bd535_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
|
||
" <td id=\"T_bd535_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
|
||
" <td id=\"T_bd535_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
|
||
" <td id=\"T_bd535_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
|
||
" <td id=\"T_bd535_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
|
||
" <td id=\"T_bd535_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
|
||
" <td id=\"T_bd535_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
|
||
" <td id=\"T_bd535_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
|
||
" <td id=\"T_bd535_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
|
||
" <td id=\"T_bd535_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
|
||
" <td id=\"T_bd535_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
|
||
" <td id=\"T_bd535_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
|
||
" <td id=\"T_bd535_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
|
||
" <td id=\"T_bd535_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
|
||
" <td id=\"T_bd535_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
|
||
" <td id=\"T_bd535_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
|
||
" <td id=\"T_bd535_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
|
||
" <td id=\"T_bd535_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
|
||
" <td id=\"T_bd535_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
|
||
" <td id=\"T_bd535_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
|
||
" <td id=\"T_bd535_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
|
||
" <td id=\"T_bd535_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
|
||
" <td id=\"T_bd535_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
|
||
" <td id=\"T_bd535_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
|
||
" <td id=\"T_bd535_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
|
||
" <td id=\"T_bd535_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
|
||
" <td id=\"T_bd535_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
|
||
" <td id=\"T_bd535_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
|
||
" <td id=\"T_bd535_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
|
||
" <td id=\"T_bd535_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
|
||
" <td id=\"T_bd535_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
|
||
" <td id=\"T_bd535_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
|
||
" <td id=\"T_bd535_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
|
||
" <td id=\"T_bd535_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
|
||
" <td id=\"T_bd535_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
|
||
" <td id=\"T_bd535_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
|
||
" <td id=\"T_bd535_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
|
||
" <td id=\"T_bd535_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
|
||
" <td id=\"T_bd535_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
|
||
" <td id=\"T_bd535_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
|
||
" <td id=\"T_bd535_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
|
||
" <td id=\"T_bd535_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
|
||
" <td id=\"T_bd535_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
|
||
" <td id=\"T_bd535_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
|
||
" <td id=\"T_bd535_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
|
||
" <td id=\"T_bd535_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
|
||
" <td id=\"T_bd535_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
|
||
" <td id=\"T_bd535_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
|
||
" <td id=\"T_bd535_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
|
||
" <td id=\"T_bd535_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_bd535_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
|
||
" <td id=\"T_bd535_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
|
||
" <td id=\"T_bd535_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
|
||
" <td id=\"T_bd535_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1f4d00>"
|
||
]
|
||
},
|
||
"execution_count": 15,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"df.style.applymap(highlight_cells_4)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "49b139b0-a8b6-4b5a-88cb-6c009047519d",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Summary of Mitre Attack ID that detects 4/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 16,
|
||
"id": "1dbccecb-9411-4087-8760-f16ba681d310",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>0</th>\n",
|
||
" <th>1</th>\n",
|
||
" <th>2</th>\n",
|
||
" <th>3</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1204.001</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1204</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1053</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1053.005</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" 0 1 2 3\n",
|
||
"T1204.001 AgentTesla Azorult Qakbot Remcos\n",
|
||
"T1204 AgentTesla Azorult Qakbot Remcos\n",
|
||
"T1053 AgentTesla Azorult Qakbot Trickbot\n",
|
||
"T1053.005 AgentTesla Azorult Qakbot Trickbot\n",
|
||
"T1218 AgentTesla Qakbot Remcos Trickbot"
|
||
]
|
||
},
|
||
"execution_count": 16,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"temp_dict = summary_table_of_id(mitre_attack_tid_dict, 4)\n",
|
||
"tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
|
||
"tdf = tdf.sort_values(by=[0,1,2,3])\n",
|
||
"tdf"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "4deb3bef-e9b9-4e98-a44f-7b8162a74d92",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection list for Mitre Attack ID that detects 4/5 malware families"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 17,
|
||
"id": "874c8687-477a-4f0f-8e79-abf8643ab128",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(5, 5)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1204.001</th>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1204</th>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>[windows_iso_lnk_file_creation.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218</th>\n",
|
||
" <td>[detect_html_help_spawn_child_process.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml]</td>\n",
|
||
" <td>[regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml]</td>\n",
|
||
" <td>[mshta_spawning_rundll32_or_regsvr32_process.yml, suspicious_rundll32_startw.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1053</th>\n",
|
||
" <td>[scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
|
||
" <td>[scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml]</td>\n",
|
||
" <td>[scheduled_task_deleted_or_created_via_cmd.yml, schtasks_run_task_on_demand.yml, windows_schtasks_create_run_as_system.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[schedule_task_with_rundll32_command_trigger.yml, scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1053.005</th>\n",
|
||
" <td>[scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
|
||
" <td>[scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml]</td>\n",
|
||
" <td>[scheduled_task_deleted_or_created_via_cmd.yml, windows_schtasks_create_run_as_system.yml, winevent_windows_task_scheduler_event_action_started.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[scheduled_task_deleted_or_created_via_cmd.yml]</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" AgentTesla \\\n",
|
||
"T1204.001 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1204 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1218 [detect_html_help_spawn_child_process.yml] \n",
|
||
"T1053 [scheduled_task_deleted_or_created_via_cmd.yml] \n",
|
||
"T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml] \n",
|
||
"\n",
|
||
" Azorult \\\n",
|
||
"T1204.001 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1204 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1218 NaN \n",
|
||
"T1053 [scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml] \n",
|
||
"T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml] \n",
|
||
"\n",
|
||
" Qakbot \\\n",
|
||
"T1204.001 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1204 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1218 [regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml] \n",
|
||
"T1053 [scheduled_task_deleted_or_created_via_cmd.yml, schtasks_run_task_on_demand.yml, windows_schtasks_create_run_as_system.yml] \n",
|
||
"T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml, windows_schtasks_create_run_as_system.yml, winevent_windows_task_scheduler_event_action_started.yml] \n",
|
||
"\n",
|
||
" Remcos \\\n",
|
||
"T1204.001 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1204 [windows_iso_lnk_file_creation.yml] \n",
|
||
"T1218 [regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml] \n",
|
||
"T1053 NaN \n",
|
||
"T1053.005 NaN \n",
|
||
"\n",
|
||
" Trickbot \n",
|
||
"T1204.001 NaN \n",
|
||
"T1204 NaN \n",
|
||
"T1218 [mshta_spawning_rundll32_or_regsvr32_process.yml, suspicious_rundll32_startw.yml] \n",
|
||
"T1053 [schedule_task_with_rundll32_command_trigger.yml, scheduled_task_deleted_or_created_via_cmd.yml] \n",
|
||
"T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml] "
|
||
]
|
||
},
|
||
"execution_count": 17,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"det_table_dict = detection_list_by_id(temp_dict)\n",
|
||
"tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf "
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "a50a8933-f8ec-4dc2-b116-5761e97b7024",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection count per mitre attack id in each malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 18,
|
||
"id": "54fb9a34-ac9a-48f2-a436-0cafaf16066c",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1204.001</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1204</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1053</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1053.005</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" AgentTesla Azorult Qakbot \\\n",
|
||
"T1204.001 (1)-detection count (1)-detection count (1)-detection count \n",
|
||
"T1204 (1)-detection count (1)-detection count (1)-detection count \n",
|
||
"T1218 (1)-detection count NaN (3)-detection count \n",
|
||
"T1053 (1)-detection count (2)-detection count (3)-detection count \n",
|
||
"T1053.005 (1)-detection count (2)-detection count (3)-detection count \n",
|
||
"\n",
|
||
" Remcos Trickbot \n",
|
||
"T1204.001 (1)-detection count NaN \n",
|
||
"T1204 (1)-detection count NaN \n",
|
||
"T1218 (2)-detection count (2)-detection count \n",
|
||
"T1053 NaN (2)-detection count \n",
|
||
"T1053.005 NaN (1)-detection count "
|
||
]
|
||
},
|
||
"execution_count": 18,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"detection_list_by_count(det_table_dict)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "23f0dad6-7b39-4eeb-97b0-c5fecc08f5f2",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Highlight Mitre Attack ID that detects 3/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 19,
|
||
"id": "1e1ad988-b482-4b75-b4ec-a1238e7e441e",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_50c38_row0_col0 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_50c38_row1_col0 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_50c38_row2_col0 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_50c38_row3_col0 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_50c38_row4_col0 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_50c38\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_50c38_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_50c38_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
|
||
" <td id=\"T_50c38_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_50c38_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
|
||
" <td id=\"T_50c38_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_50c38_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
|
||
" <td id=\"T_50c38_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_50c38_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
|
||
" <td id=\"T_50c38_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_50c38_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
|
||
" <td id=\"T_50c38_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1cca90>"
|
||
]
|
||
},
|
||
"execution_count": 19,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"show_legend()"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 20,
|
||
"id": "385f15e4-d000-4004-9a1c-8a762b3a3af7",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_df10c_row1_col0, #T_df10c_row5_col1, #T_df10c_row6_col4, #T_df10c_row7_col0, #T_df10c_row7_col1, #T_df10c_row7_col2, #T_df10c_row10_col3, #T_df10c_row11_col2, #T_df10c_row12_col2, #T_df10c_row14_col1, #T_df10c_row14_col3, #T_df10c_row15_col1, #T_df10c_row16_col0, #T_df10c_row16_col1, #T_df10c_row17_col0, #T_df10c_row17_col1, #T_df10c_row17_col3, #T_df10c_row18_col0, #T_df10c_row18_col1, #T_df10c_row18_col3, #T_df10c_row19_col0, #T_df10c_row20_col0, #T_df10c_row21_col0, #T_df10c_row23_col2, #T_df10c_row24_col2, #T_df10c_row25_col2, #T_df10c_row25_col3, #T_df10c_row26_col2, #T_df10c_row26_col3, #T_df10c_row27_col2, #T_df10c_row27_col3, #T_df10c_row28_col2, #T_df10c_row29_col2 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_df10c\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_df10c_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
|
||
" <th id=\"T_df10c_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
|
||
" <th id=\"T_df10c_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
|
||
" <th id=\"T_df10c_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
|
||
" <th id=\"T_df10c_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
|
||
" <td id=\"T_df10c_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
|
||
" <td id=\"T_df10c_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
|
||
" <td id=\"T_df10c_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
|
||
" <td id=\"T_df10c_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
|
||
" <td id=\"T_df10c_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
|
||
" <td id=\"T_df10c_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
|
||
" <td id=\"T_df10c_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
|
||
" <td id=\"T_df10c_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
|
||
" <td id=\"T_df10c_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
|
||
" <td id=\"T_df10c_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
|
||
" <td id=\"T_df10c_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
|
||
" <td id=\"T_df10c_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
|
||
" <td id=\"T_df10c_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
|
||
" <td id=\"T_df10c_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
|
||
" <td id=\"T_df10c_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
|
||
" <td id=\"T_df10c_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
|
||
" <td id=\"T_df10c_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
|
||
" <td id=\"T_df10c_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
|
||
" <td id=\"T_df10c_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
|
||
" <td id=\"T_df10c_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
|
||
" <td id=\"T_df10c_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
|
||
" <td id=\"T_df10c_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
|
||
" <td id=\"T_df10c_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
|
||
" <td id=\"T_df10c_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
|
||
" <td id=\"T_df10c_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
|
||
" <td id=\"T_df10c_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
|
||
" <td id=\"T_df10c_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
|
||
" <td id=\"T_df10c_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
|
||
" <td id=\"T_df10c_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
|
||
" <td id=\"T_df10c_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
|
||
" <td id=\"T_df10c_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
|
||
" <td id=\"T_df10c_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
|
||
" <td id=\"T_df10c_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
|
||
" <td id=\"T_df10c_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
|
||
" <td id=\"T_df10c_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
|
||
" <td id=\"T_df10c_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
|
||
" <td id=\"T_df10c_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
|
||
" <td id=\"T_df10c_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
|
||
" <td id=\"T_df10c_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
|
||
" <td id=\"T_df10c_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
|
||
" <td id=\"T_df10c_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
|
||
" <td id=\"T_df10c_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
|
||
" <td id=\"T_df10c_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
|
||
" <td id=\"T_df10c_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
|
||
" <td id=\"T_df10c_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
|
||
" <td id=\"T_df10c_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
|
||
" <td id=\"T_df10c_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
|
||
" <td id=\"T_df10c_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
|
||
" <td id=\"T_df10c_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
|
||
" <td id=\"T_df10c_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
|
||
" <td id=\"T_df10c_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
|
||
" <td id=\"T_df10c_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
|
||
" <td id=\"T_df10c_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
|
||
" <td id=\"T_df10c_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
|
||
" <td id=\"T_df10c_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
|
||
" <td id=\"T_df10c_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
|
||
" <td id=\"T_df10c_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
|
||
" <td id=\"T_df10c_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
|
||
" <td id=\"T_df10c_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
|
||
" <td id=\"T_df10c_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
|
||
" <td id=\"T_df10c_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
|
||
" <td id=\"T_df10c_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
|
||
" <td id=\"T_df10c_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
|
||
" <td id=\"T_df10c_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
|
||
" <td id=\"T_df10c_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
|
||
" <td id=\"T_df10c_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
|
||
" <td id=\"T_df10c_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
|
||
" <td id=\"T_df10c_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
|
||
" <td id=\"T_df10c_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
|
||
" <td id=\"T_df10c_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
|
||
" <td id=\"T_df10c_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
|
||
" <td id=\"T_df10c_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
|
||
" <td id=\"T_df10c_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
|
||
" <td id=\"T_df10c_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
|
||
" <td id=\"T_df10c_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
|
||
" <td id=\"T_df10c_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
|
||
" <td id=\"T_df10c_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
|
||
" <td id=\"T_df10c_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
|
||
" <td id=\"T_df10c_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
|
||
" <td id=\"T_df10c_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
|
||
" <td id=\"T_df10c_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
|
||
" <td id=\"T_df10c_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
|
||
" <td id=\"T_df10c_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
|
||
" <td id=\"T_df10c_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
|
||
" <td id=\"T_df10c_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
|
||
" <td id=\"T_df10c_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
|
||
" <td id=\"T_df10c_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
|
||
" <td id=\"T_df10c_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
|
||
" <td id=\"T_df10c_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
|
||
" <td id=\"T_df10c_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
|
||
" <td id=\"T_df10c_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
|
||
" <td id=\"T_df10c_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
|
||
" <td id=\"T_df10c_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
|
||
" <td id=\"T_df10c_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
|
||
" <td id=\"T_df10c_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
|
||
" <td id=\"T_df10c_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
|
||
" <td id=\"T_df10c_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
|
||
" <td id=\"T_df10c_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
|
||
" <td id=\"T_df10c_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
|
||
" <td id=\"T_df10c_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
|
||
" <td id=\"T_df10c_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
|
||
" <td id=\"T_df10c_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
|
||
" <td id=\"T_df10c_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
|
||
" <td id=\"T_df10c_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
|
||
" <td id=\"T_df10c_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
|
||
" <td id=\"T_df10c_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
|
||
" <td id=\"T_df10c_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
|
||
" <td id=\"T_df10c_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
|
||
" <td id=\"T_df10c_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
|
||
" <td id=\"T_df10c_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
|
||
" <td id=\"T_df10c_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
|
||
" <td id=\"T_df10c_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
|
||
" <td id=\"T_df10c_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
|
||
" <td id=\"T_df10c_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
|
||
" <td id=\"T_df10c_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
|
||
" <td id=\"T_df10c_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
|
||
" <td id=\"T_df10c_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
|
||
" <td id=\"T_df10c_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
|
||
" <td id=\"T_df10c_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
|
||
" <td id=\"T_df10c_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
|
||
" <td id=\"T_df10c_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
|
||
" <td id=\"T_df10c_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
|
||
" <td id=\"T_df10c_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
|
||
" <td id=\"T_df10c_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
|
||
" <td id=\"T_df10c_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
|
||
" <td id=\"T_df10c_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
|
||
" <td id=\"T_df10c_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
|
||
" <td id=\"T_df10c_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
|
||
" <td id=\"T_df10c_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
|
||
" <td id=\"T_df10c_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
|
||
" <td id=\"T_df10c_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
|
||
" <td id=\"T_df10c_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
|
||
" <td id=\"T_df10c_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
|
||
" <td id=\"T_df10c_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
|
||
" <td id=\"T_df10c_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
|
||
" <td id=\"T_df10c_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
|
||
" <td id=\"T_df10c_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
|
||
" <td id=\"T_df10c_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
|
||
" <td id=\"T_df10c_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
|
||
" <td id=\"T_df10c_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
|
||
" <td id=\"T_df10c_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
|
||
" <td id=\"T_df10c_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
|
||
" <td id=\"T_df10c_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
|
||
" <td id=\"T_df10c_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
|
||
" <td id=\"T_df10c_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
|
||
" <td id=\"T_df10c_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
|
||
" <td id=\"T_df10c_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
|
||
" <td id=\"T_df10c_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
|
||
" <td id=\"T_df10c_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
|
||
" <td id=\"T_df10c_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
|
||
" <td id=\"T_df10c_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
|
||
" <td id=\"T_df10c_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
|
||
" <td id=\"T_df10c_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
|
||
" <td id=\"T_df10c_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
|
||
" <td id=\"T_df10c_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
|
||
" <td id=\"T_df10c_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
|
||
" <td id=\"T_df10c_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
|
||
" <td id=\"T_df10c_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
|
||
" <td id=\"T_df10c_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
|
||
" <td id=\"T_df10c_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
|
||
" <td id=\"T_df10c_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
|
||
" <td id=\"T_df10c_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
|
||
" <td id=\"T_df10c_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
|
||
" <td id=\"T_df10c_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
|
||
" <td id=\"T_df10c_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
|
||
" <td id=\"T_df10c_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
|
||
" <td id=\"T_df10c_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
|
||
" <td id=\"T_df10c_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
|
||
" <td id=\"T_df10c_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
|
||
" <td id=\"T_df10c_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_df10c_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
|
||
" <td id=\"T_df10c_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
|
||
" <td id=\"T_df10c_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
|
||
" <td id=\"T_df10c_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1b6790>"
|
||
]
|
||
},
|
||
"execution_count": 20,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"df.style.applymap(highlight_cells_3)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "d5b5a932-286d-4e02-b642-c02c40e4b454",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Summary of Mitre Attack ID that detects 3/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 21,
|
||
"id": "00422f3c-2dc7-4fe2-b942-83c63535edd3",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>0</th>\n",
|
||
" <th>1</th>\n",
|
||
" <th>2</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1071</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.001</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1543.003</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1548</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1555.003</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1555</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1548.002</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1112</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1547.001</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1547</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1055</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" 0 1 2\n",
|
||
"T1071 AgentTesla Azorult Qakbot\n",
|
||
"T1059.001 AgentTesla Azorult Qakbot\n",
|
||
"T1543.003 AgentTesla Azorult Qakbot\n",
|
||
"T1548 AgentTesla Azorult Remcos\n",
|
||
"T1555.003 AgentTesla Azorult Remcos\n",
|
||
"T1555 AgentTesla Azorult Remcos\n",
|
||
"T1548.002 AgentTesla Azorult Remcos\n",
|
||
"T1112 Azorult Qakbot Remcos\n",
|
||
"T1547.001 Azorult Qakbot Remcos\n",
|
||
"T1547 Azorult Qakbot Remcos\n",
|
||
"T1055 Qakbot Remcos Trickbot"
|
||
]
|
||
},
|
||
"execution_count": 21,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"\n",
|
||
"temp_dict = summary_table_of_id(mitre_attack_tid_dict, 3)\n",
|
||
"tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
|
||
"tdf = tdf.sort_values(by=[0,1,2])\n",
|
||
"tdf"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "917b867f-73df-432d-ad61-f8288ed0bd17",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection list for Mitre Attack ID that detects 3/5 malware families"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 22,
|
||
"id": "4b5556a3-185b-4d09-9b11-8754f8a63668",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(11, 5)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1055</th>\n",
|
||
" <td>[create_remote_thread_in_shell_application.yml, windows_command_shell_fetch_env_variables.yml, windows_process_injection_of_wermgr_to_known_browser.yml, windows_process_injection_remote_thread.yml, windows_process_injection_wermgr_child_process.yml]</td>\n",
|
||
" <td>[loading_of_dynwrapx_module.yml, winhlp32_spawning_a_process.yml, wscript_or_cscript_suspicious_child_process.yml]</td>\n",
|
||
" <td>[cobalt_strike_named_pipes.yml, powershell_remote_thread_to_known_windows_process.yml, trickbot_named_pipe.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1071</th>\n",
|
||
" <td>[windows_app_layer_protocol_qakbot_namedpipe.yml, windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml]</td>\n",
|
||
" <td>[windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1112</th>\n",
|
||
" <td>[windows_modify_registry_qakbot_binary_data_registry.yml]</td>\n",
|
||
" <td>[malicious_inprocserver32_modification.yml, remcos_client_registry_install_entry.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_modify_registry_disable_toast_notifications.yml, windows_modify_registry_disable_win_defender_raw_write_notif.yml, windows_modify_registry_disable_windows_security_center_notif.yml, windows_modify_registry_disabling_wer_settings.yml, windows_modify_registry_disallow_windows_app.yml, windows_modify_registry_regedit_silent_reg_import.yml, windows_modify_registry_suppress_win_defender_notif.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.001</th>\n",
|
||
" <td>[recon_using_wmi_class.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml]</td>\n",
|
||
" <td>[windows_powershell_import_applocker_policy.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1543.003</th>\n",
|
||
" <td>[services_exe_lolbas_execution_process_spawn.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[suspicious_driver_loaded_path.yml]</td>\n",
|
||
" <td>[sc_exe_manipulating_windows_services.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1547.001</th>\n",
|
||
" <td>[registry_keys_used_for_persistence.yml]</td>\n",
|
||
" <td>[registry_keys_used_for_persistence.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[registry_keys_used_for_persistence.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1547</th>\n",
|
||
" <td>[registry_keys_used_for_persistence.yml]</td>\n",
|
||
" <td>[registry_keys_used_for_persistence.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[registry_keys_used_for_persistence.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1548</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[disabling_remote_user_account_control.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[disabling_remote_user_account_control.yml]</td>\n",
|
||
" <td>[allow_operation_with_consent_admin.yml, disabling_remote_user_account_control.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1555.003</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
|
||
" <td>[non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1555</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
|
||
" <td>[non_firefox_process_access_firefox_profile_dir.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1548.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[disabling_remote_user_account_control.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[disabling_remote_user_account_control.yml]</td>\n",
|
||
" <td>[disabling_remote_user_account_control.yml]</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" Qakbot \\\n",
|
||
"T1055 [create_remote_thread_in_shell_application.yml, windows_command_shell_fetch_env_variables.yml, windows_process_injection_of_wermgr_to_known_browser.yml, windows_process_injection_remote_thread.yml, windows_process_injection_wermgr_child_process.yml] \n",
|
||
"T1071 [windows_app_layer_protocol_qakbot_namedpipe.yml, windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml] \n",
|
||
"T1112 [windows_modify_registry_qakbot_binary_data_registry.yml] \n",
|
||
"T1059.001 [recon_using_wmi_class.yml] \n",
|
||
"T1543.003 [services_exe_lolbas_execution_process_spawn.yml] \n",
|
||
"T1547.001 [registry_keys_used_for_persistence.yml] \n",
|
||
"T1547 [registry_keys_used_for_persistence.yml] \n",
|
||
"T1548 NaN \n",
|
||
"T1555.003 NaN \n",
|
||
"T1555 NaN \n",
|
||
"T1548.002 NaN \n",
|
||
"\n",
|
||
" Remcos \\\n",
|
||
"T1055 [loading_of_dynwrapx_module.yml, winhlp32_spawning_a_process.yml, wscript_or_cscript_suspicious_child_process.yml] \n",
|
||
"T1071 NaN \n",
|
||
"T1112 [malicious_inprocserver32_modification.yml, remcos_client_registry_install_entry.yml] \n",
|
||
"T1059.001 NaN \n",
|
||
"T1543.003 NaN \n",
|
||
"T1547.001 [registry_keys_used_for_persistence.yml] \n",
|
||
"T1547 [registry_keys_used_for_persistence.yml] \n",
|
||
"T1548 [disabling_remote_user_account_control.yml] \n",
|
||
"T1555.003 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml] \n",
|
||
"T1555 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml] \n",
|
||
"T1548.002 [disabling_remote_user_account_control.yml] \n",
|
||
"\n",
|
||
" Trickbot \\\n",
|
||
"T1055 [cobalt_strike_named_pipes.yml, powershell_remote_thread_to_known_windows_process.yml, trickbot_named_pipe.yml] \n",
|
||
"T1071 NaN \n",
|
||
"T1112 NaN \n",
|
||
"T1059.001 NaN \n",
|
||
"T1543.003 NaN \n",
|
||
"T1547.001 NaN \n",
|
||
"T1547 NaN \n",
|
||
"T1548 NaN \n",
|
||
"T1555.003 NaN \n",
|
||
"T1555 NaN \n",
|
||
"T1548.002 NaN \n",
|
||
"\n",
|
||
" AgentTesla \\\n",
|
||
"T1055 NaN \n",
|
||
"T1071 [windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml] \n",
|
||
"T1112 NaN \n",
|
||
"T1059.001 [powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml] \n",
|
||
"T1543.003 [suspicious_driver_loaded_path.yml] \n",
|
||
"T1547.001 NaN \n",
|
||
"T1547 NaN \n",
|
||
"T1548 [disabling_remote_user_account_control.yml] \n",
|
||
"T1555.003 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml] \n",
|
||
"T1555 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml] \n",
|
||
"T1548.002 [disabling_remote_user_account_control.yml] \n",
|
||
"\n",
|
||
" Azorult \n",
|
||
"T1055 NaN \n",
|
||
"T1071 [windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml] \n",
|
||
"T1112 [windows_modify_registry_disable_toast_notifications.yml, windows_modify_registry_disable_win_defender_raw_write_notif.yml, windows_modify_registry_disable_windows_security_center_notif.yml, windows_modify_registry_disabling_wer_settings.yml, windows_modify_registry_disallow_windows_app.yml, windows_modify_registry_regedit_silent_reg_import.yml, windows_modify_registry_suppress_win_defender_notif.yml] \n",
|
||
"T1059.001 [windows_powershell_import_applocker_policy.yml] \n",
|
||
"T1543.003 [sc_exe_manipulating_windows_services.yml] \n",
|
||
"T1547.001 [registry_keys_used_for_persistence.yml] \n",
|
||
"T1547 [registry_keys_used_for_persistence.yml] \n",
|
||
"T1548 [allow_operation_with_consent_admin.yml, disabling_remote_user_account_control.yml] \n",
|
||
"T1555.003 [non_firefox_process_access_firefox_profile_dir.yml] \n",
|
||
"T1555 [non_firefox_process_access_firefox_profile_dir.yml] \n",
|
||
"T1548.002 [disabling_remote_user_account_control.yml] "
|
||
]
|
||
},
|
||
"execution_count": 22,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"det_table_dict = detection_list_by_id(temp_dict)\n",
|
||
"tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf "
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "cb75a49c-d35f-47ee-bad3-bb31e7e7d041",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection count per mitre attack id in each malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 23,
|
||
"id": "72b34254-fd19-4c37-a0e2-df5cb3934cb3",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1055</th>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1071</th>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1112</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(7)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.001</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1543.003</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1547.001</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1547</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1548</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1555.003</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1555</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1548.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" Qakbot Remcos Trickbot \\\n",
|
||
"T1055 (5)-detection count (3)-detection count (3)-detection count \n",
|
||
"T1071 (2)-detection count NaN NaN \n",
|
||
"T1112 (1)-detection count (2)-detection count NaN \n",
|
||
"T1059.001 (1)-detection count NaN NaN \n",
|
||
"T1543.003 (1)-detection count NaN NaN \n",
|
||
"T1547.001 (1)-detection count (1)-detection count NaN \n",
|
||
"T1547 (1)-detection count (1)-detection count NaN \n",
|
||
"T1548 NaN (1)-detection count NaN \n",
|
||
"T1555.003 NaN (3)-detection count NaN \n",
|
||
"T1555 NaN (3)-detection count NaN \n",
|
||
"T1548.002 NaN (1)-detection count NaN \n",
|
||
"\n",
|
||
" AgentTesla Azorult \n",
|
||
"T1055 NaN NaN \n",
|
||
"T1071 (3)-detection count (1)-detection count \n",
|
||
"T1112 NaN (7)-detection count \n",
|
||
"T1059.001 (2)-detection count (1)-detection count \n",
|
||
"T1543.003 (1)-detection count (1)-detection count \n",
|
||
"T1547.001 NaN (1)-detection count \n",
|
||
"T1547 NaN (1)-detection count \n",
|
||
"T1548 (1)-detection count (2)-detection count \n",
|
||
"T1555.003 (2)-detection count (1)-detection count \n",
|
||
"T1555 (2)-detection count (1)-detection count \n",
|
||
"T1548.002 (1)-detection count (1)-detection count "
|
||
]
|
||
},
|
||
"execution_count": 23,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"detection_list_by_count(det_table_dict)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "4289037d-495e-4f38-8d3c-c724a2805a9c",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Highlight Mitre Attack ID that detects 2/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 24,
|
||
"id": "45ebfd15-bdbe-4415-bcea-c94558ba6a7a",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_8409a_row0_col0 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_8409a_row1_col0 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_8409a_row2_col0 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_8409a_row3_col0 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_8409a_row4_col0 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_8409a\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_8409a_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8409a_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
|
||
" <td id=\"T_8409a_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8409a_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
|
||
" <td id=\"T_8409a_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8409a_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
|
||
" <td id=\"T_8409a_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8409a_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
|
||
" <td id=\"T_8409a_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8409a_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
|
||
" <td id=\"T_8409a_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1d2f10>"
|
||
]
|
||
},
|
||
"execution_count": 24,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"show_legend()"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 25,
|
||
"id": "d28d99e3-aab1-4a7a-8a04-ec88b390abfe",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_23e9f_row0_col2, #T_23e9f_row0_col4, #T_23e9f_row2_col0, #T_23e9f_row2_col3, #T_23e9f_row2_col4, #T_23e9f_row3_col2, #T_23e9f_row5_col0, #T_23e9f_row7_col3, #T_23e9f_row8_col2, #T_23e9f_row11_col3, #T_23e9f_row14_col0, #T_23e9f_row15_col3, #T_23e9f_row16_col3, #T_23e9f_row18_col4, #T_23e9f_row19_col4, #T_23e9f_row22_col3, #T_23e9f_row27_col0, #T_23e9f_row33_col3, #T_23e9f_row34_col3, #T_23e9f_row37_col2, #T_23e9f_row38_col2, #T_23e9f_row38_col3, #T_23e9f_row39_col2, #T_23e9f_row40_col2 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_23e9f\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_23e9f_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
|
||
" <th id=\"T_23e9f_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
|
||
" <th id=\"T_23e9f_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
|
||
" <th id=\"T_23e9f_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
|
||
" <th id=\"T_23e9f_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
|
||
" <td id=\"T_23e9f_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
|
||
" <td id=\"T_23e9f_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
|
||
" <td id=\"T_23e9f_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
|
||
" <td id=\"T_23e9f_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
|
||
" <td id=\"T_23e9f_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
|
||
" <td id=\"T_23e9f_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
|
||
" <td id=\"T_23e9f_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
|
||
" <td id=\"T_23e9f_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
|
||
" <td id=\"T_23e9f_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
|
||
" <td id=\"T_23e9f_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
|
||
" <td id=\"T_23e9f_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
|
||
" <td id=\"T_23e9f_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
|
||
" <td id=\"T_23e9f_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
|
||
" <td id=\"T_23e9f_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
|
||
" <td id=\"T_23e9f_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
|
||
" <td id=\"T_23e9f_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
|
||
" <td id=\"T_23e9f_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
|
||
" <td id=\"T_23e9f_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
|
||
" <td id=\"T_23e9f_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
|
||
" <td id=\"T_23e9f_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
|
||
" <td id=\"T_23e9f_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
|
||
" <td id=\"T_23e9f_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
|
||
" <td id=\"T_23e9f_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
|
||
" <td id=\"T_23e9f_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
|
||
" <td id=\"T_23e9f_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
|
||
" <td id=\"T_23e9f_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
|
||
" <td id=\"T_23e9f_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
|
||
" <td id=\"T_23e9f_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
|
||
" <td id=\"T_23e9f_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
|
||
" <td id=\"T_23e9f_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
|
||
" <td id=\"T_23e9f_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
|
||
" <td id=\"T_23e9f_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
|
||
" <td id=\"T_23e9f_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
|
||
" <td id=\"T_23e9f_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
|
||
" <td id=\"T_23e9f_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
|
||
" <td id=\"T_23e9f_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
|
||
" <td id=\"T_23e9f_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
|
||
" <td id=\"T_23e9f_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
|
||
" <td id=\"T_23e9f_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
|
||
" <td id=\"T_23e9f_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
|
||
" <td id=\"T_23e9f_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
|
||
" <td id=\"T_23e9f_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
|
||
" <td id=\"T_23e9f_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
|
||
" <td id=\"T_23e9f_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
|
||
" <td id=\"T_23e9f_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
|
||
" <td id=\"T_23e9f_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
|
||
" <td id=\"T_23e9f_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
|
||
" <td id=\"T_23e9f_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
|
||
" <td id=\"T_23e9f_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
|
||
" <td id=\"T_23e9f_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
|
||
" <td id=\"T_23e9f_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
|
||
" <td id=\"T_23e9f_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
|
||
" <td id=\"T_23e9f_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
|
||
" <td id=\"T_23e9f_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
|
||
" <td id=\"T_23e9f_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
|
||
" <td id=\"T_23e9f_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
|
||
" <td id=\"T_23e9f_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
|
||
" <td id=\"T_23e9f_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
|
||
" <td id=\"T_23e9f_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
|
||
" <td id=\"T_23e9f_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
|
||
" <td id=\"T_23e9f_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
|
||
" <td id=\"T_23e9f_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
|
||
" <td id=\"T_23e9f_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
|
||
" <td id=\"T_23e9f_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
|
||
" <td id=\"T_23e9f_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
|
||
" <td id=\"T_23e9f_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
|
||
" <td id=\"T_23e9f_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
|
||
" <td id=\"T_23e9f_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
|
||
" <td id=\"T_23e9f_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
|
||
" <td id=\"T_23e9f_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
|
||
" <td id=\"T_23e9f_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
|
||
" <td id=\"T_23e9f_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
|
||
" <td id=\"T_23e9f_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
|
||
" <td id=\"T_23e9f_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
|
||
" <td id=\"T_23e9f_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
|
||
" <td id=\"T_23e9f_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
|
||
" <td id=\"T_23e9f_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
|
||
" <td id=\"T_23e9f_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
|
||
" <td id=\"T_23e9f_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
|
||
" <td id=\"T_23e9f_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
|
||
" <td id=\"T_23e9f_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
|
||
" <td id=\"T_23e9f_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
|
||
" <td id=\"T_23e9f_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
|
||
" <td id=\"T_23e9f_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
|
||
" <td id=\"T_23e9f_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
|
||
" <td id=\"T_23e9f_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
|
||
" <td id=\"T_23e9f_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
|
||
" <td id=\"T_23e9f_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
|
||
" <td id=\"T_23e9f_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
|
||
" <td id=\"T_23e9f_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
|
||
" <td id=\"T_23e9f_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
|
||
" <td id=\"T_23e9f_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
|
||
" <td id=\"T_23e9f_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
|
||
" <td id=\"T_23e9f_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
|
||
" <td id=\"T_23e9f_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
|
||
" <td id=\"T_23e9f_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
|
||
" <td id=\"T_23e9f_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
|
||
" <td id=\"T_23e9f_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
|
||
" <td id=\"T_23e9f_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
|
||
" <td id=\"T_23e9f_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
|
||
" <td id=\"T_23e9f_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
|
||
" <td id=\"T_23e9f_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
|
||
" <td id=\"T_23e9f_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
|
||
" <td id=\"T_23e9f_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
|
||
" <td id=\"T_23e9f_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
|
||
" <td id=\"T_23e9f_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
|
||
" <td id=\"T_23e9f_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
|
||
" <td id=\"T_23e9f_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
|
||
" <td id=\"T_23e9f_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
|
||
" <td id=\"T_23e9f_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
|
||
" <td id=\"T_23e9f_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
|
||
" <td id=\"T_23e9f_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
|
||
" <td id=\"T_23e9f_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
|
||
" <td id=\"T_23e9f_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
|
||
" <td id=\"T_23e9f_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
|
||
" <td id=\"T_23e9f_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
|
||
" <td id=\"T_23e9f_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
|
||
" <td id=\"T_23e9f_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
|
||
" <td id=\"T_23e9f_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
|
||
" <td id=\"T_23e9f_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
|
||
" <td id=\"T_23e9f_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
|
||
" <td id=\"T_23e9f_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
|
||
" <td id=\"T_23e9f_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
|
||
" <td id=\"T_23e9f_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
|
||
" <td id=\"T_23e9f_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
|
||
" <td id=\"T_23e9f_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
|
||
" <td id=\"T_23e9f_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
|
||
" <td id=\"T_23e9f_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
|
||
" <td id=\"T_23e9f_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
|
||
" <td id=\"T_23e9f_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
|
||
" <td id=\"T_23e9f_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
|
||
" <td id=\"T_23e9f_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
|
||
" <td id=\"T_23e9f_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
|
||
" <td id=\"T_23e9f_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
|
||
" <td id=\"T_23e9f_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
|
||
" <td id=\"T_23e9f_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
|
||
" <td id=\"T_23e9f_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
|
||
" <td id=\"T_23e9f_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
|
||
" <td id=\"T_23e9f_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
|
||
" <td id=\"T_23e9f_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
|
||
" <td id=\"T_23e9f_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
|
||
" <td id=\"T_23e9f_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
|
||
" <td id=\"T_23e9f_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
|
||
" <td id=\"T_23e9f_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
|
||
" <td id=\"T_23e9f_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
|
||
" <td id=\"T_23e9f_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
|
||
" <td id=\"T_23e9f_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
|
||
" <td id=\"T_23e9f_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
|
||
" <td id=\"T_23e9f_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
|
||
" <td id=\"T_23e9f_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
|
||
" <td id=\"T_23e9f_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
|
||
" <td id=\"T_23e9f_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
|
||
" <td id=\"T_23e9f_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
|
||
" <td id=\"T_23e9f_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
|
||
" <td id=\"T_23e9f_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
|
||
" <td id=\"T_23e9f_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
|
||
" <td id=\"T_23e9f_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
|
||
" <td id=\"T_23e9f_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
|
||
" <td id=\"T_23e9f_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
|
||
" <td id=\"T_23e9f_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
|
||
" <td id=\"T_23e9f_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
|
||
" <td id=\"T_23e9f_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
|
||
" <td id=\"T_23e9f_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
|
||
" <td id=\"T_23e9f_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
|
||
" <td id=\"T_23e9f_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
|
||
" <td id=\"T_23e9f_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
|
||
" <td id=\"T_23e9f_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
|
||
" <td id=\"T_23e9f_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
|
||
" <td id=\"T_23e9f_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
|
||
" <td id=\"T_23e9f_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_23e9f_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
|
||
" <td id=\"T_23e9f_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
|
||
" <td id=\"T_23e9f_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
|
||
" <td id=\"T_23e9f_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c2410d0>"
|
||
]
|
||
},
|
||
"execution_count": 25,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"df.style.applymap(highlight_cells_2)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "12972dd1-7e11-4097-b4fa-168c45a3ab2c",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Summary of Mitre Attack ID that detects 2/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 26,
|
||
"id": "49b832b4-2436-4cef-98fe-997a2679d0c0",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>0</th>\n",
|
||
" <th>1</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1049</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.003</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1569</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1569.002</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1021</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1590</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1590.005</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.007</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.010</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1055.001</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1592</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1027</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" 0 1\n",
|
||
"T1049 Azorult Qakbot\n",
|
||
"T1059.003 Azorult Qakbot\n",
|
||
"T1569 Azorult Qakbot\n",
|
||
"T1569.002 Azorult Qakbot\n",
|
||
"T1021 Azorult Trickbot\n",
|
||
"T1590 Azorult Trickbot\n",
|
||
"T1590.005 Azorult Trickbot\n",
|
||
"T1059.007 Qakbot Remcos\n",
|
||
"T1218.010 Qakbot Remcos\n",
|
||
"T1055.001 Qakbot Remcos\n",
|
||
"T1592 Qakbot Remcos\n",
|
||
"T1027 Qakbot Trickbot"
|
||
]
|
||
},
|
||
"execution_count": 26,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"temp_dict = summary_table_of_id(mitre_attack_tid_dict, 2)\n",
|
||
"tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
|
||
"tdf = tdf.sort_values(by=[0,1])\n",
|
||
"tdf"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "02cb02d6-310e-44fa-a701-2dcdc0338a10",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection list for Mitre Attack ID that detects 2/5 malware families"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 27,
|
||
"id": "da26ea7f-7d62-47cc-a1e3-95442104d188",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(12, 4)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1021</th>\n",
|
||
" <td>[allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml]</td>\n",
|
||
" <td>[executable_file_written_in_administrative_smb_share.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1590</th>\n",
|
||
" <td>[windows_gather_victim_network_info_through_ip_check_web_services.yml]</td>\n",
|
||
" <td>[wermgr_process_connecting_to_ip_check_web_services.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1590.005</th>\n",
|
||
" <td>[windows_gather_victim_network_info_through_ip_check_web_services.yml]</td>\n",
|
||
" <td>[wermgr_process_connecting_to_ip_check_web_services.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1049</th>\n",
|
||
" <td>[network_connection_discovery_net.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[network_connection_discovery_arp.yml, network_connection_discovery_netstat.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.003</th>\n",
|
||
" <td>[cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[cmd_carry_out_string_command_parameter.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1569</th>\n",
|
||
" <td>[excessive_usage_of_sc_service_utility.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_service_created_with_suspicious_service_path.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1569.002</th>\n",
|
||
" <td>[excessive_usage_of_sc_service_utility.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_service_created_with_suspicious_service_path.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1027</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[wermgr_process_create_executable_file.yml]</td>\n",
|
||
" <td>[malicious_powershell_process___encoded_command.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.007</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[cmdline_tool_not_executed_in_cmd_shell.yml]</td>\n",
|
||
" <td>[jscript_execution_using_cscript_app.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.010</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml]</td>\n",
|
||
" <td>[malicious_inprocserver32_modification.yml, regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1055.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_process_injection_of_wermgr_to_known_browser.yml]</td>\n",
|
||
" <td>[loading_of_dynwrapx_module.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1592</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[recon_avproduct_through_pwh_or_wmi.yml, recon_using_wmi_class.yml]</td>\n",
|
||
" <td>[system_info_gathering_using_dxdiag_application.yml]</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" Azorult \\\n",
|
||
"T1021 [allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml] \n",
|
||
"T1590 [windows_gather_victim_network_info_through_ip_check_web_services.yml] \n",
|
||
"T1590.005 [windows_gather_victim_network_info_through_ip_check_web_services.yml] \n",
|
||
"T1049 [network_connection_discovery_net.yml] \n",
|
||
"T1059.003 [cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml] \n",
|
||
"T1569 [excessive_usage_of_sc_service_utility.yml] \n",
|
||
"T1569.002 [excessive_usage_of_sc_service_utility.yml] \n",
|
||
"T1027 NaN \n",
|
||
"T1059.007 NaN \n",
|
||
"T1218.010 NaN \n",
|
||
"T1055.001 NaN \n",
|
||
"T1592 NaN \n",
|
||
"\n",
|
||
" Trickbot \\\n",
|
||
"T1021 [executable_file_written_in_administrative_smb_share.yml] \n",
|
||
"T1590 [wermgr_process_connecting_to_ip_check_web_services.yml] \n",
|
||
"T1590.005 [wermgr_process_connecting_to_ip_check_web_services.yml] \n",
|
||
"T1049 NaN \n",
|
||
"T1059.003 NaN \n",
|
||
"T1569 NaN \n",
|
||
"T1569.002 NaN \n",
|
||
"T1027 [wermgr_process_create_executable_file.yml] \n",
|
||
"T1059.007 NaN \n",
|
||
"T1218.010 NaN \n",
|
||
"T1055.001 NaN \n",
|
||
"T1592 NaN \n",
|
||
"\n",
|
||
" Qakbot \\\n",
|
||
"T1021 NaN \n",
|
||
"T1590 NaN \n",
|
||
"T1590.005 NaN \n",
|
||
"T1049 [network_connection_discovery_arp.yml, network_connection_discovery_netstat.yml] \n",
|
||
"T1059.003 [cmd_carry_out_string_command_parameter.yml] \n",
|
||
"T1569 [windows_service_created_with_suspicious_service_path.yml] \n",
|
||
"T1569.002 [windows_service_created_with_suspicious_service_path.yml] \n",
|
||
"T1027 [malicious_powershell_process___encoded_command.yml] \n",
|
||
"T1059.007 [cmdline_tool_not_executed_in_cmd_shell.yml] \n",
|
||
"T1218.010 [regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml] \n",
|
||
"T1055.001 [windows_process_injection_of_wermgr_to_known_browser.yml] \n",
|
||
"T1592 [recon_avproduct_through_pwh_or_wmi.yml, recon_using_wmi_class.yml] \n",
|
||
"\n",
|
||
" Remcos \n",
|
||
"T1021 NaN \n",
|
||
"T1590 NaN \n",
|
||
"T1590.005 NaN \n",
|
||
"T1049 NaN \n",
|
||
"T1059.003 NaN \n",
|
||
"T1569 NaN \n",
|
||
"T1569.002 NaN \n",
|
||
"T1027 NaN \n",
|
||
"T1059.007 [jscript_execution_using_cscript_app.yml] \n",
|
||
"T1218.010 [malicious_inprocserver32_modification.yml, regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml] \n",
|
||
"T1055.001 [loading_of_dynwrapx_module.yml] \n",
|
||
"T1592 [system_info_gathering_using_dxdiag_application.yml] "
|
||
]
|
||
},
|
||
"execution_count": 27,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"det_table_dict = detection_list_by_id(temp_dict)\n",
|
||
"tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf "
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "cc2bef38-a3e2-4081-a447-86c1e70d433f",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection count per mitre attack id in each malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 28,
|
||
"id": "5863c606-ed0c-475d-b37d-1d4e8f9502a6",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1021</th>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1590</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1590.005</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1049</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.003</th>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1569</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1569.002</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1027</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.007</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.010</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1055.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1592</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" Azorult Trickbot Qakbot \\\n",
|
||
"T1021 (5)-detection count (1)-detection count NaN \n",
|
||
"T1590 (1)-detection count (1)-detection count NaN \n",
|
||
"T1590.005 (1)-detection count (1)-detection count NaN \n",
|
||
"T1049 (1)-detection count NaN (2)-detection count \n",
|
||
"T1059.003 (2)-detection count NaN (1)-detection count \n",
|
||
"T1569 (1)-detection count NaN (1)-detection count \n",
|
||
"T1569.002 (1)-detection count NaN (1)-detection count \n",
|
||
"T1027 NaN (1)-detection count (1)-detection count \n",
|
||
"T1059.007 NaN NaN (1)-detection count \n",
|
||
"T1218.010 NaN NaN (3)-detection count \n",
|
||
"T1055.001 NaN NaN (1)-detection count \n",
|
||
"T1592 NaN NaN (2)-detection count \n",
|
||
"\n",
|
||
" Remcos \n",
|
||
"T1021 NaN \n",
|
||
"T1590 NaN \n",
|
||
"T1590.005 NaN \n",
|
||
"T1049 NaN \n",
|
||
"T1059.003 NaN \n",
|
||
"T1569 NaN \n",
|
||
"T1569.002 NaN \n",
|
||
"T1027 NaN \n",
|
||
"T1059.007 (1)-detection count \n",
|
||
"T1218.010 (3)-detection count \n",
|
||
"T1055.001 (1)-detection count \n",
|
||
"T1592 (1)-detection count "
|
||
]
|
||
},
|
||
"execution_count": 28,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"detection_list_by_count(det_table_dict)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "316697a7-1d08-442d-849d-72a17764495d",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Highlight Mitre Attack ID that detects 1/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 29,
|
||
"id": "5805b5e1-679d-45b5-8e31-19cbc6edd390",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_81a9c_row0_col0 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_81a9c_row1_col0 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_81a9c_row2_col0 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_81a9c_row3_col0 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_81a9c_row4_col0 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_81a9c\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_81a9c_level0_col0\" class=\"col_heading level0 col0\" >0</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_81a9c_level0_row0\" class=\"row_heading level0 row0\" >5 malware coverage</th>\n",
|
||
" <td id=\"T_81a9c_row0_col0\" class=\"data row0 col0\" >yellow</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_81a9c_level0_row1\" class=\"row_heading level0 row1\" >4 malware coverage</th>\n",
|
||
" <td id=\"T_81a9c_row1_col0\" class=\"data row1 col0\" >orange</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_81a9c_level0_row2\" class=\"row_heading level0 row2\" >3 malware coverage</th>\n",
|
||
" <td id=\"T_81a9c_row2_col0\" class=\"data row2 col0\" >lightgreen</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_81a9c_level0_row3\" class=\"row_heading level0 row3\" >2 malware coverage</th>\n",
|
||
" <td id=\"T_81a9c_row3_col0\" class=\"data row3 col0\" >lightblue</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_81a9c_level0_row4\" class=\"row_heading level0 row4\" >1 malware coverage</th>\n",
|
||
" <td id=\"T_81a9c_row4_col0\" class=\"data row4 col0\" >lightgray</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c2410a0>"
|
||
]
|
||
},
|
||
"execution_count": 29,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"show_legend()"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 30,
|
||
"id": "1ed5bbe5-d4e8-42f3-b086-9bc065f314ed",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_97b18_row0_col1, #T_97b18_row0_col3, #T_97b18_row1_col2, #T_97b18_row1_col3, #T_97b18_row1_col4, #T_97b18_row3_col3, #T_97b18_row4_col0, #T_97b18_row5_col3, #T_97b18_row6_col0, #T_97b18_row6_col1, #T_97b18_row6_col3, #T_97b18_row8_col0, #T_97b18_row8_col1, #T_97b18_row8_col4, #T_97b18_row9_col0, #T_97b18_row9_col2, #T_97b18_row9_col4, #T_97b18_row10_col0, #T_97b18_row10_col2, #T_97b18_row11_col4, #T_97b18_row12_col1, #T_97b18_row12_col3, #T_97b18_row12_col4, #T_97b18_row13_col2, #T_97b18_row14_col2, #T_97b18_row17_col2, #T_97b18_row18_col2, #T_97b18_row19_col2, #T_97b18_row20_col2, #T_97b18_row21_col2, #T_97b18_row22_col0, #T_97b18_row23_col3, #T_97b18_row32_col2, #T_97b18_row32_col3, #T_97b18_row33_col2, #T_97b18_row34_col2, #T_97b18_row35_col3, #T_97b18_row36_col3, #T_97b18_row37_col3 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_97b18\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_97b18_level0_col0\" class=\"col_heading level0 col0\" >Remcos</th>\n",
|
||
" <th id=\"T_97b18_level0_col1\" class=\"col_heading level0 col1\" >AgentTesla</th>\n",
|
||
" <th id=\"T_97b18_level0_col2\" class=\"col_heading level0 col2\" >Azorult</th>\n",
|
||
" <th id=\"T_97b18_level0_col3\" class=\"col_heading level0 col3\" >Qakbot</th>\n",
|
||
" <th id=\"T_97b18_level0_col4\" class=\"col_heading level0 col4\" >Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row0\" class=\"row_heading level0 row0\" >0</th>\n",
|
||
" <td id=\"T_97b18_row0_col0\" class=\"data row0 col0\" >T1036</td>\n",
|
||
" <td id=\"T_97b18_row0_col1\" class=\"data row0 col1\" >T1014</td>\n",
|
||
" <td id=\"T_97b18_row0_col2\" class=\"data row0 col2\" >T1021</td>\n",
|
||
" <td id=\"T_97b18_row0_col3\" class=\"data row0 col3\" >T1016</td>\n",
|
||
" <td id=\"T_97b18_row0_col4\" class=\"data row0 col4\" >T1021</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row1\" class=\"row_heading level0 row1\" >1</th>\n",
|
||
" <td id=\"T_97b18_row1_col0\" class=\"data row1 col0\" >T1055</td>\n",
|
||
" <td id=\"T_97b18_row1_col1\" class=\"data row1 col1\" >T1036</td>\n",
|
||
" <td id=\"T_97b18_row1_col2\" class=\"data row1 col2\" >T1021.001</td>\n",
|
||
" <td id=\"T_97b18_row1_col3\" class=\"data row1 col3\" >T1016.001</td>\n",
|
||
" <td id=\"T_97b18_row1_col4\" class=\"data row1 col4\" >T1021.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row2\" class=\"row_heading level0 row2\" >2</th>\n",
|
||
" <td id=\"T_97b18_row2_col0\" class=\"data row2 col0\" >T1055.001</td>\n",
|
||
" <td id=\"T_97b18_row2_col1\" class=\"data row2 col1\" >T1053</td>\n",
|
||
" <td id=\"T_97b18_row2_col2\" class=\"data row2 col2\" >T1036</td>\n",
|
||
" <td id=\"T_97b18_row2_col3\" class=\"data row2 col3\" >T1027</td>\n",
|
||
" <td id=\"T_97b18_row2_col4\" class=\"data row2 col4\" >T1027</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row3\" class=\"row_heading level0 row3\" >3</th>\n",
|
||
" <td id=\"T_97b18_row3_col0\" class=\"data row3 col0\" >T1059</td>\n",
|
||
" <td id=\"T_97b18_row3_col1\" class=\"data row3 col1\" >T1053.005</td>\n",
|
||
" <td id=\"T_97b18_row3_col2\" class=\"data row3 col2\" >T1049</td>\n",
|
||
" <td id=\"T_97b18_row3_col3\" class=\"data row3 col3\" >T1033</td>\n",
|
||
" <td id=\"T_97b18_row3_col4\" class=\"data row3 col4\" >T1036</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row4\" class=\"row_heading level0 row4\" >4</th>\n",
|
||
" <td id=\"T_97b18_row4_col0\" class=\"data row4 col0\" >T1059.005</td>\n",
|
||
" <td id=\"T_97b18_row4_col1\" class=\"data row4 col1\" >T1059</td>\n",
|
||
" <td id=\"T_97b18_row4_col2\" class=\"data row4 col2\" >T1053</td>\n",
|
||
" <td id=\"T_97b18_row4_col3\" class=\"data row4 col3\" >T1036</td>\n",
|
||
" <td id=\"T_97b18_row4_col4\" class=\"data row4 col4\" >T1053</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row5\" class=\"row_heading level0 row5\" >5</th>\n",
|
||
" <td id=\"T_97b18_row5_col0\" class=\"data row5 col0\" >T1059.007</td>\n",
|
||
" <td id=\"T_97b18_row5_col1\" class=\"data row5 col1\" >T1059.001</td>\n",
|
||
" <td id=\"T_97b18_row5_col2\" class=\"data row5 col2\" >T1053.005</td>\n",
|
||
" <td id=\"T_97b18_row5_col3\" class=\"data row5 col3\" >T1036.003</td>\n",
|
||
" <td id=\"T_97b18_row5_col4\" class=\"data row5 col4\" >T1053.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row6\" class=\"row_heading level0 row6\" >6</th>\n",
|
||
" <td id=\"T_97b18_row6_col0\" class=\"data row6 col0\" >T1070</td>\n",
|
||
" <td id=\"T_97b18_row6_col1\" class=\"data row6 col1\" >T1068</td>\n",
|
||
" <td id=\"T_97b18_row6_col2\" class=\"data row6 col2\" >T1059</td>\n",
|
||
" <td id=\"T_97b18_row6_col3\" class=\"data row6 col3\" >T1047</td>\n",
|
||
" <td id=\"T_97b18_row6_col4\" class=\"data row6 col4\" >T1055</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row7\" class=\"row_heading level0 row7\" >7</th>\n",
|
||
" <td id=\"T_97b18_row7_col0\" class=\"data row7 col0\" >T1112</td>\n",
|
||
" <td id=\"T_97b18_row7_col1\" class=\"data row7 col1\" >T1071</td>\n",
|
||
" <td id=\"T_97b18_row7_col2\" class=\"data row7 col2\" >T1059.001</td>\n",
|
||
" <td id=\"T_97b18_row7_col3\" class=\"data row7 col3\" >T1049</td>\n",
|
||
" <td id=\"T_97b18_row7_col4\" class=\"data row7 col4\" >T1059</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row8\" class=\"row_heading level0 row8\" >8</th>\n",
|
||
" <td id=\"T_97b18_row8_col0\" class=\"data row8 col0\" >T1113</td>\n",
|
||
" <td id=\"T_97b18_row8_col1\" class=\"data row8 col1\" >T1071.003</td>\n",
|
||
" <td id=\"T_97b18_row8_col2\" class=\"data row8 col2\" >T1059.003</td>\n",
|
||
" <td id=\"T_97b18_row8_col3\" class=\"data row8 col3\" >T1053</td>\n",
|
||
" <td id=\"T_97b18_row8_col4\" class=\"data row8 col4\" >T1087</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row9\" class=\"row_heading level0 row9\" >9</th>\n",
|
||
" <td id=\"T_97b18_row9_col0\" class=\"data row9 col0\" >T1134</td>\n",
|
||
" <td id=\"T_97b18_row9_col1\" class=\"data row9 col1\" >T1204</td>\n",
|
||
" <td id=\"T_97b18_row9_col2\" class=\"data row9 col2\" >T1069</td>\n",
|
||
" <td id=\"T_97b18_row9_col3\" class=\"data row9 col3\" >T1053.005</td>\n",
|
||
" <td id=\"T_97b18_row9_col4\" class=\"data row9 col4\" >T1087.002</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row10\" class=\"row_heading level0 row10\" >10</th>\n",
|
||
" <td id=\"T_97b18_row10_col0\" class=\"data row10 col0\" >T1134.004</td>\n",
|
||
" <td id=\"T_97b18_row10_col1\" class=\"data row10 col1\" >T1204.001</td>\n",
|
||
" <td id=\"T_97b18_row10_col2\" class=\"data row10 col2\" >T1069.001</td>\n",
|
||
" <td id=\"T_97b18_row10_col3\" class=\"data row10 col3\" >T1055</td>\n",
|
||
" <td id=\"T_97b18_row10_col4\" class=\"data row10 col4\" >T1218</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row11\" class=\"row_heading level0 row11\" >11</th>\n",
|
||
" <td id=\"T_97b18_row11_col0\" class=\"data row11 col0\" >T1204</td>\n",
|
||
" <td id=\"T_97b18_row11_col1\" class=\"data row11 col1\" >T1218</td>\n",
|
||
" <td id=\"T_97b18_row11_col2\" class=\"data row11 col2\" >T1071</td>\n",
|
||
" <td id=\"T_97b18_row11_col3\" class=\"data row11 col3\" >T1055.001</td>\n",
|
||
" <td id=\"T_97b18_row11_col4\" class=\"data row11 col4\" >T1218.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row12\" class=\"row_heading level0 row12\" >12</th>\n",
|
||
" <td id=\"T_97b18_row12_col0\" class=\"data row12 col0\" >T1204.001</td>\n",
|
||
" <td id=\"T_97b18_row12_col1\" class=\"data row12 col1\" >T1218.001</td>\n",
|
||
" <td id=\"T_97b18_row12_col2\" class=\"data row12 col2\" >T1112</td>\n",
|
||
" <td id=\"T_97b18_row12_col3\" class=\"data row12 col3\" >T1055.002</td>\n",
|
||
" <td id=\"T_97b18_row12_col4\" class=\"data row12 col4\" >T1218.011</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row13\" class=\"row_heading level0 row13\" >13</th>\n",
|
||
" <td id=\"T_97b18_row13_col0\" class=\"data row13 col0\" >T1218</td>\n",
|
||
" <td id=\"T_97b18_row13_col1\" class=\"data row13 col1\" >T1543</td>\n",
|
||
" <td id=\"T_97b18_row13_col2\" class=\"data row13 col2\" >T1136</td>\n",
|
||
" <td id=\"T_97b18_row13_col3\" class=\"data row13 col3\" >T1059</td>\n",
|
||
" <td id=\"T_97b18_row13_col4\" class=\"data row13 col4\" >T1543</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row14\" class=\"row_heading level0 row14\" >14</th>\n",
|
||
" <td id=\"T_97b18_row14_col0\" class=\"data row14 col0\" >T1218.010</td>\n",
|
||
" <td id=\"T_97b18_row14_col1\" class=\"data row14 col1\" >T1543.003</td>\n",
|
||
" <td id=\"T_97b18_row14_col2\" class=\"data row14 col2\" >T1136.001</td>\n",
|
||
" <td id=\"T_97b18_row14_col3\" class=\"data row14 col3\" >T1059.001</td>\n",
|
||
" <td id=\"T_97b18_row14_col4\" class=\"data row14 col4\" >T1562</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row15\" class=\"row_heading level0 row15\" >15</th>\n",
|
||
" <td id=\"T_97b18_row15_col0\" class=\"data row15 col0\" >T1543</td>\n",
|
||
" <td id=\"T_97b18_row15_col1\" class=\"data row15 col1\" >T1548</td>\n",
|
||
" <td id=\"T_97b18_row15_col2\" class=\"data row15 col2\" >T1204</td>\n",
|
||
" <td id=\"T_97b18_row15_col3\" class=\"data row15 col3\" >T1059.003</td>\n",
|
||
" <td id=\"T_97b18_row15_col4\" class=\"data row15 col4\" >T1562.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row16\" class=\"row_heading level0 row16\" >16</th>\n",
|
||
" <td id=\"T_97b18_row16_col0\" class=\"data row16 col0\" >T1547</td>\n",
|
||
" <td id=\"T_97b18_row16_col1\" class=\"data row16 col1\" >T1548.002</td>\n",
|
||
" <td id=\"T_97b18_row16_col2\" class=\"data row16 col2\" >T1204.001</td>\n",
|
||
" <td id=\"T_97b18_row16_col3\" class=\"data row16 col3\" >T1059.007</td>\n",
|
||
" <td id=\"T_97b18_row16_col4\" class=\"data row16 col4\" >T1566</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row17\" class=\"row_heading level0 row17\" >17</th>\n",
|
||
" <td id=\"T_97b18_row17_col0\" class=\"data row17 col0\" >T1547.001</td>\n",
|
||
" <td id=\"T_97b18_row17_col1\" class=\"data row17 col1\" >T1555</td>\n",
|
||
" <td id=\"T_97b18_row17_col2\" class=\"data row17 col2\" >T1219</td>\n",
|
||
" <td id=\"T_97b18_row17_col3\" class=\"data row17 col3\" >T1071</td>\n",
|
||
" <td id=\"T_97b18_row17_col4\" class=\"data row17 col4\" >T1566.001</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row18\" class=\"row_heading level0 row18\" >18</th>\n",
|
||
" <td id=\"T_97b18_row18_col0\" class=\"data row18 col0\" >T1548</td>\n",
|
||
" <td id=\"T_97b18_row18_col1\" class=\"data row18 col1\" >T1555.003</td>\n",
|
||
" <td id=\"T_97b18_row18_col2\" class=\"data row18 col2\" >T1222</td>\n",
|
||
" <td id=\"T_97b18_row18_col3\" class=\"data row18 col3\" >T1112</td>\n",
|
||
" <td id=\"T_97b18_row18_col4\" class=\"data row18 col4\" >T1590</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row19\" class=\"row_heading level0 row19\" >19</th>\n",
|
||
" <td id=\"T_97b18_row19_col0\" class=\"data row19 col0\" >T1548.002</td>\n",
|
||
" <td id=\"T_97b18_row19_col1\" class=\"data row19 col1\" >T1562</td>\n",
|
||
" <td id=\"T_97b18_row19_col2\" class=\"data row19 col2\" >T1222.001</td>\n",
|
||
" <td id=\"T_97b18_row19_col3\" class=\"data row19 col3\" >T1204</td>\n",
|
||
" <td id=\"T_97b18_row19_col4\" class=\"data row19 col4\" >T1590.005</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row20\" class=\"row_heading level0 row20\" >20</th>\n",
|
||
" <td id=\"T_97b18_row20_col0\" class=\"data row20 col0\" >T1555</td>\n",
|
||
" <td id=\"T_97b18_row20_col1\" class=\"data row20 col1\" >T1562.001</td>\n",
|
||
" <td id=\"T_97b18_row20_col2\" class=\"data row20 col2\" >T1489</td>\n",
|
||
" <td id=\"T_97b18_row20_col3\" class=\"data row20 col3\" >T1204.001</td>\n",
|
||
" <td id=\"T_97b18_row20_col4\" class=\"data row20 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row21\" class=\"row_heading level0 row21\" >21</th>\n",
|
||
" <td id=\"T_97b18_row21_col0\" class=\"data row21 col0\" >T1555.003</td>\n",
|
||
" <td id=\"T_97b18_row21_col1\" class=\"data row21 col1\" >T1566</td>\n",
|
||
" <td id=\"T_97b18_row21_col2\" class=\"data row21 col2\" >T1531</td>\n",
|
||
" <td id=\"T_97b18_row21_col3\" class=\"data row21 col3\" >T1218</td>\n",
|
||
" <td id=\"T_97b18_row21_col4\" class=\"data row21 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row22\" class=\"row_heading level0 row22\" >22</th>\n",
|
||
" <td id=\"T_97b18_row22_col0\" class=\"data row22 col0\" >T1559.001</td>\n",
|
||
" <td id=\"T_97b18_row22_col1\" class=\"data row22 col1\" >T1566.001</td>\n",
|
||
" <td id=\"T_97b18_row22_col2\" class=\"data row22 col2\" >T1543</td>\n",
|
||
" <td id=\"T_97b18_row22_col3\" class=\"data row22 col3\" >T1218.010</td>\n",
|
||
" <td id=\"T_97b18_row22_col4\" class=\"data row22 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row23\" class=\"row_heading level0 row23\" >23</th>\n",
|
||
" <td id=\"T_97b18_row23_col0\" class=\"data row23 col0\" >T1562</td>\n",
|
||
" <td id=\"T_97b18_row23_col1\" class=\"data row23 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row23_col2\" class=\"data row23 col2\" >T1543.003</td>\n",
|
||
" <td id=\"T_97b18_row23_col3\" class=\"data row23 col3\" >T1482</td>\n",
|
||
" <td id=\"T_97b18_row23_col4\" class=\"data row23 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row24\" class=\"row_heading level0 row24\" >24</th>\n",
|
||
" <td id=\"T_97b18_row24_col0\" class=\"data row24 col0\" >T1562.001</td>\n",
|
||
" <td id=\"T_97b18_row24_col1\" class=\"data row24 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row24_col2\" class=\"data row24 col2\" >T1547</td>\n",
|
||
" <td id=\"T_97b18_row24_col3\" class=\"data row24 col3\" >T1543</td>\n",
|
||
" <td id=\"T_97b18_row24_col4\" class=\"data row24 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row25\" class=\"row_heading level0 row25\" >25</th>\n",
|
||
" <td id=\"T_97b18_row25_col0\" class=\"data row25 col0\" >T1566</td>\n",
|
||
" <td id=\"T_97b18_row25_col1\" class=\"data row25 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row25_col2\" class=\"data row25 col2\" >T1547.001</td>\n",
|
||
" <td id=\"T_97b18_row25_col3\" class=\"data row25 col3\" >T1543.003</td>\n",
|
||
" <td id=\"T_97b18_row25_col4\" class=\"data row25 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row26\" class=\"row_heading level0 row26\" >26</th>\n",
|
||
" <td id=\"T_97b18_row26_col0\" class=\"data row26 col0\" >T1566.001</td>\n",
|
||
" <td id=\"T_97b18_row26_col1\" class=\"data row26 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row26_col2\" class=\"data row26 col2\" >T1548</td>\n",
|
||
" <td id=\"T_97b18_row26_col3\" class=\"data row26 col3\" >T1547</td>\n",
|
||
" <td id=\"T_97b18_row26_col4\" class=\"data row26 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row27\" class=\"row_heading level0 row27\" >27</th>\n",
|
||
" <td id=\"T_97b18_row27_col0\" class=\"data row27 col0\" >T1592</td>\n",
|
||
" <td id=\"T_97b18_row27_col1\" class=\"data row27 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row27_col2\" class=\"data row27 col2\" >T1548.002</td>\n",
|
||
" <td id=\"T_97b18_row27_col3\" class=\"data row27 col3\" >T1547.001</td>\n",
|
||
" <td id=\"T_97b18_row27_col4\" class=\"data row27 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row28\" class=\"row_heading level0 row28\" >28</th>\n",
|
||
" <td id=\"T_97b18_row28_col0\" class=\"data row28 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row28_col1\" class=\"data row28 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row28_col2\" class=\"data row28 col2\" >T1555</td>\n",
|
||
" <td id=\"T_97b18_row28_col3\" class=\"data row28 col3\" >T1562</td>\n",
|
||
" <td id=\"T_97b18_row28_col4\" class=\"data row28 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row29\" class=\"row_heading level0 row29\" >29</th>\n",
|
||
" <td id=\"T_97b18_row29_col0\" class=\"data row29 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row29_col1\" class=\"data row29 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row29_col2\" class=\"data row29 col2\" >T1555.003</td>\n",
|
||
" <td id=\"T_97b18_row29_col3\" class=\"data row29 col3\" >T1562.001</td>\n",
|
||
" <td id=\"T_97b18_row29_col4\" class=\"data row29 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row30\" class=\"row_heading level0 row30\" >30</th>\n",
|
||
" <td id=\"T_97b18_row30_col0\" class=\"data row30 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row30_col1\" class=\"data row30 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row30_col2\" class=\"data row30 col2\" >T1562</td>\n",
|
||
" <td id=\"T_97b18_row30_col3\" class=\"data row30 col3\" >T1566</td>\n",
|
||
" <td id=\"T_97b18_row30_col4\" class=\"data row30 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row31\" class=\"row_heading level0 row31\" >31</th>\n",
|
||
" <td id=\"T_97b18_row31_col0\" class=\"data row31 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row31_col1\" class=\"data row31 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row31_col2\" class=\"data row31 col2\" >T1562.001</td>\n",
|
||
" <td id=\"T_97b18_row31_col3\" class=\"data row31 col3\" >T1566.001</td>\n",
|
||
" <td id=\"T_97b18_row31_col4\" class=\"data row31 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row32\" class=\"row_heading level0 row32\" >32</th>\n",
|
||
" <td id=\"T_97b18_row32_col0\" class=\"data row32 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row32_col1\" class=\"data row32 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row32_col2\" class=\"data row32 col2\" >T1562.004</td>\n",
|
||
" <td id=\"T_97b18_row32_col3\" class=\"data row32 col3\" >T1566.002</td>\n",
|
||
" <td id=\"T_97b18_row32_col4\" class=\"data row32 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row33\" class=\"row_heading level0 row33\" >33</th>\n",
|
||
" <td id=\"T_97b18_row33_col0\" class=\"data row33 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row33_col1\" class=\"data row33 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row33_col2\" class=\"data row33 col2\" >T1564</td>\n",
|
||
" <td id=\"T_97b18_row33_col3\" class=\"data row33 col3\" >T1569</td>\n",
|
||
" <td id=\"T_97b18_row33_col4\" class=\"data row33 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row34\" class=\"row_heading level0 row34\" >34</th>\n",
|
||
" <td id=\"T_97b18_row34_col0\" class=\"data row34 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row34_col1\" class=\"data row34 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row34_col2\" class=\"data row34 col2\" >T1564.001</td>\n",
|
||
" <td id=\"T_97b18_row34_col3\" class=\"data row34 col3\" >T1569.002</td>\n",
|
||
" <td id=\"T_97b18_row34_col4\" class=\"data row34 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row35\" class=\"row_heading level0 row35\" >35</th>\n",
|
||
" <td id=\"T_97b18_row35_col0\" class=\"data row35 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row35_col1\" class=\"data row35 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row35_col2\" class=\"data row35 col2\" >T1566</td>\n",
|
||
" <td id=\"T_97b18_row35_col3\" class=\"data row35 col3\" >T1574</td>\n",
|
||
" <td id=\"T_97b18_row35_col4\" class=\"data row35 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row36\" class=\"row_heading level0 row36\" >36</th>\n",
|
||
" <td id=\"T_97b18_row36_col0\" class=\"data row36 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row36_col1\" class=\"data row36 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row36_col2\" class=\"data row36 col2\" >T1566.001</td>\n",
|
||
" <td id=\"T_97b18_row36_col3\" class=\"data row36 col3\" >T1574.001</td>\n",
|
||
" <td id=\"T_97b18_row36_col4\" class=\"data row36 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row37\" class=\"row_heading level0 row37\" >37</th>\n",
|
||
" <td id=\"T_97b18_row37_col0\" class=\"data row37 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row37_col1\" class=\"data row37 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row37_col2\" class=\"data row37 col2\" >T1569</td>\n",
|
||
" <td id=\"T_97b18_row37_col3\" class=\"data row37 col3\" >T1574.002</td>\n",
|
||
" <td id=\"T_97b18_row37_col4\" class=\"data row37 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row38\" class=\"row_heading level0 row38\" >38</th>\n",
|
||
" <td id=\"T_97b18_row38_col0\" class=\"data row38 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row38_col1\" class=\"data row38 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row38_col2\" class=\"data row38 col2\" >T1569.002</td>\n",
|
||
" <td id=\"T_97b18_row38_col3\" class=\"data row38 col3\" >T1592</td>\n",
|
||
" <td id=\"T_97b18_row38_col4\" class=\"data row38 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row39\" class=\"row_heading level0 row39\" >39</th>\n",
|
||
" <td id=\"T_97b18_row39_col0\" class=\"data row39 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row39_col1\" class=\"data row39 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row39_col2\" class=\"data row39 col2\" >T1590</td>\n",
|
||
" <td id=\"T_97b18_row39_col3\" class=\"data row39 col3\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row39_col4\" class=\"data row39 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_97b18_level0_row40\" class=\"row_heading level0 row40\" >40</th>\n",
|
||
" <td id=\"T_97b18_row40_col0\" class=\"data row40 col0\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row40_col1\" class=\"data row40 col1\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row40_col2\" class=\"data row40 col2\" >T1590.005</td>\n",
|
||
" <td id=\"T_97b18_row40_col3\" class=\"data row40 col3\" >nan</td>\n",
|
||
" <td id=\"T_97b18_row40_col4\" class=\"data row40 col4\" >nan</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c252fa0>"
|
||
]
|
||
},
|
||
"execution_count": 30,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"df.style.applymap(highlight_cells_1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "b55314eb-390a-4396-acf6-4532b0480482",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Summary of Mitre Attack ID that detects 1/5 malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 31,
|
||
"id": "04b58cd6-09ae-41df-bd11-e973b7954b95",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>0</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.001</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1068</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1071.003</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1014</th>\n",
|
||
" <td>AgentTesla</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1136</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1222.001</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1564</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1564.001</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1531</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1069</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1136.001</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1069.001</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1489</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1219</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1222</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1562.004</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1021.001</th>\n",
|
||
" <td>Azorult</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566.002</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574.002</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1482</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1036.003</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1055.002</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1047</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574.001</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1016.001</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1016</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1033</th>\n",
|
||
" <td>Qakbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1134</th>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1134.004</th>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.005</th>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1070</th>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1113</th>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1559.001</th>\n",
|
||
" <td>Remcos</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1021.002</th>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1087</th>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1087.002</th>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.005</th>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.011</th>\n",
|
||
" <td>Trickbot</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" 0\n",
|
||
"T1218.001 AgentTesla\n",
|
||
"T1068 AgentTesla\n",
|
||
"T1071.003 AgentTesla\n",
|
||
"T1014 AgentTesla\n",
|
||
"T1136 Azorult\n",
|
||
"T1222.001 Azorult\n",
|
||
"T1564 Azorult\n",
|
||
"T1564.001 Azorult\n",
|
||
"T1531 Azorult\n",
|
||
"T1069 Azorult\n",
|
||
"T1136.001 Azorult\n",
|
||
"T1069.001 Azorult\n",
|
||
"T1489 Azorult\n",
|
||
"T1219 Azorult\n",
|
||
"T1222 Azorult\n",
|
||
"T1562.004 Azorult\n",
|
||
"T1021.001 Azorult\n",
|
||
"T1566.002 Qakbot\n",
|
||
"T1574.002 Qakbot\n",
|
||
"T1482 Qakbot\n",
|
||
"T1036.003 Qakbot\n",
|
||
"T1574 Qakbot\n",
|
||
"T1055.002 Qakbot\n",
|
||
"T1047 Qakbot\n",
|
||
"T1574.001 Qakbot\n",
|
||
"T1016.001 Qakbot\n",
|
||
"T1016 Qakbot\n",
|
||
"T1033 Qakbot\n",
|
||
"T1134 Remcos\n",
|
||
"T1134.004 Remcos\n",
|
||
"T1059.005 Remcos\n",
|
||
"T1070 Remcos\n",
|
||
"T1113 Remcos\n",
|
||
"T1559.001 Remcos\n",
|
||
"T1021.002 Trickbot\n",
|
||
"T1087 Trickbot\n",
|
||
"T1087.002 Trickbot\n",
|
||
"T1218.005 Trickbot\n",
|
||
"T1218.011 Trickbot"
|
||
]
|
||
},
|
||
"execution_count": 31,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"temp_dict = summary_table_of_id(mitre_attack_tid_dict, 1)\n",
|
||
"tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n",
|
||
"tdf = tdf.sort_values(by=[0])\n",
|
||
"tdf"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "c74c33a6-86e8-4897-aa03-64b1a1085ddf",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection list for Mitre Attack ID that detects 1/5 malware families"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 32,
|
||
"id": "98f8eec2-b101-4cb2-b46d-182de0a7523c",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(39, 5)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.005</th>\n",
|
||
" <td>[suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1113</th>\n",
|
||
" <td>[remcos_rat_file_creation_in_remcos_folder.yml, suspicious_image_creation_in_appdata_folder.yml, suspicious_wav_file_in_appdata_folder.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1070</th>\n",
|
||
" <td>[process_deleting_its_process_file_path.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1559.001</th>\n",
|
||
" <td>[process_writing_dynamicwrapperx.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1134.004</th>\n",
|
||
" <td>[wscript_or_cscript_suspicious_child_process.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1134</th>\n",
|
||
" <td>[wscript_or_cscript_suspicious_child_process.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1021.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1489</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[excessive_attempt_to_disable_services.yml, windows_service_stop_by_deletion.yml, windows_valid_account_with_never_expires_password.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1219</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_remote_access_software_rms_registry.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1562.004</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[firewall_allowed_program_enable.yml, processes_launching_netsh.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1222</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[excessive_usage_of_cacls_app.yml, hiding_files_and_directories_with_attrib_exe.yml, icacls_deny_command.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1136.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[create_local_admin_accounts_using_net_exe.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1136</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[create_local_admin_accounts_using_net_exe.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1531</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[excessive_usage_of_net_app.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1564.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[disable_show_hidden_files.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1564</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[disable_show_hidden_files.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1222.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[hiding_files_and_directories_with_attrib_exe.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1069</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[net_localgroup_discovery.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1069.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[net_localgroup_discovery.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1055.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_process_injection_remote_thread.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1033</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[system_user_discovery_with_whoami.yml, windows_system_discovery_using_ldap_nslookup.yml, windows_system_discovery_using_qwinsta.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1047</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_wmi_impersonate_token.yml, windows_wmi_process_call_create.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_dll_search_order_hijacking_hunt_with_sysmon.yml, windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1016</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[network_discovery_using_route_windows_app.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1016.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[network_discovery_using_route_windows_app.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1036.003</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[process_creating_lnk_file_in_suspicious_location.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1482</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[nltest_domain_trust_discovery.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_dll_search_order_hijacking_hunt_with_sysmon.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1071.003</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1014</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_driver_load_non_standard_path.yml, windows_drivers_loaded_by_signature.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1068</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[windows_drivers_loaded_by_signature.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[detect_html_help_spawn_child_process.yml]</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.005</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[mshta_spawning_rundll32_or_regsvr32_process.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1087.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[account_discovery_with_net_app.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1087</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[account_discovery_with_net_app.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.011</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[suspicious_rundll32_startw.yml]</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1021.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>[executable_file_written_in_administrative_smb_share.yml]</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" Remcos \\\n",
|
||
"T1059.005 [suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml] \n",
|
||
"T1113 [remcos_rat_file_creation_in_remcos_folder.yml, suspicious_image_creation_in_appdata_folder.yml, suspicious_wav_file_in_appdata_folder.yml] \n",
|
||
"T1070 [process_deleting_its_process_file_path.yml] \n",
|
||
"T1559.001 [process_writing_dynamicwrapperx.yml] \n",
|
||
"T1134.004 [wscript_or_cscript_suspicious_child_process.yml] \n",
|
||
"T1134 [wscript_or_cscript_suspicious_child_process.yml] \n",
|
||
"T1021.001 NaN \n",
|
||
"T1489 NaN \n",
|
||
"T1219 NaN \n",
|
||
"T1562.004 NaN \n",
|
||
"T1222 NaN \n",
|
||
"T1136.001 NaN \n",
|
||
"T1136 NaN \n",
|
||
"T1531 NaN \n",
|
||
"T1564.001 NaN \n",
|
||
"T1564 NaN \n",
|
||
"T1222.001 NaN \n",
|
||
"T1069 NaN \n",
|
||
"T1069.001 NaN \n",
|
||
"T1055.002 NaN \n",
|
||
"T1033 NaN \n",
|
||
"T1047 NaN \n",
|
||
"T1574.002 NaN \n",
|
||
"T1574 NaN \n",
|
||
"T1016 NaN \n",
|
||
"T1016.001 NaN \n",
|
||
"T1036.003 NaN \n",
|
||
"T1566.002 NaN \n",
|
||
"T1482 NaN \n",
|
||
"T1574.001 NaN \n",
|
||
"T1071.003 NaN \n",
|
||
"T1014 NaN \n",
|
||
"T1068 NaN \n",
|
||
"T1218.001 NaN \n",
|
||
"T1218.005 NaN \n",
|
||
"T1087.002 NaN \n",
|
||
"T1087 NaN \n",
|
||
"T1218.011 NaN \n",
|
||
"T1021.002 NaN \n",
|
||
"\n",
|
||
" Azorult \\\n",
|
||
"T1059.005 NaN \n",
|
||
"T1113 NaN \n",
|
||
"T1070 NaN \n",
|
||
"T1559.001 NaN \n",
|
||
"T1134.004 NaN \n",
|
||
"T1134 NaN \n",
|
||
"T1021.001 [allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml] \n",
|
||
"T1489 [excessive_attempt_to_disable_services.yml, windows_service_stop_by_deletion.yml, windows_valid_account_with_never_expires_password.yml] \n",
|
||
"T1219 [windows_remote_access_software_rms_registry.yml] \n",
|
||
"T1562.004 [firewall_allowed_program_enable.yml, processes_launching_netsh.yml] \n",
|
||
"T1222 [excessive_usage_of_cacls_app.yml, hiding_files_and_directories_with_attrib_exe.yml, icacls_deny_command.yml] \n",
|
||
"T1136.001 [create_local_admin_accounts_using_net_exe.yml] \n",
|
||
"T1136 [create_local_admin_accounts_using_net_exe.yml] \n",
|
||
"T1531 [excessive_usage_of_net_app.yml] \n",
|
||
"T1564.001 [disable_show_hidden_files.yml] \n",
|
||
"T1564 [disable_show_hidden_files.yml] \n",
|
||
"T1222.001 [hiding_files_and_directories_with_attrib_exe.yml] \n",
|
||
"T1069 [net_localgroup_discovery.yml] \n",
|
||
"T1069.001 [net_localgroup_discovery.yml] \n",
|
||
"T1055.002 NaN \n",
|
||
"T1033 NaN \n",
|
||
"T1047 NaN \n",
|
||
"T1574.002 NaN \n",
|
||
"T1574 NaN \n",
|
||
"T1016 NaN \n",
|
||
"T1016.001 NaN \n",
|
||
"T1036.003 NaN \n",
|
||
"T1566.002 NaN \n",
|
||
"T1482 NaN \n",
|
||
"T1574.001 NaN \n",
|
||
"T1071.003 NaN \n",
|
||
"T1014 NaN \n",
|
||
"T1068 NaN \n",
|
||
"T1218.001 NaN \n",
|
||
"T1218.005 NaN \n",
|
||
"T1087.002 NaN \n",
|
||
"T1087 NaN \n",
|
||
"T1218.011 NaN \n",
|
||
"T1021.002 NaN \n",
|
||
"\n",
|
||
" Qakbot \\\n",
|
||
"T1059.005 NaN \n",
|
||
"T1113 NaN \n",
|
||
"T1070 NaN \n",
|
||
"T1559.001 NaN \n",
|
||
"T1134.004 NaN \n",
|
||
"T1134 NaN \n",
|
||
"T1021.001 NaN \n",
|
||
"T1489 NaN \n",
|
||
"T1219 NaN \n",
|
||
"T1562.004 NaN \n",
|
||
"T1222 NaN \n",
|
||
"T1136.001 NaN \n",
|
||
"T1136 NaN \n",
|
||
"T1531 NaN \n",
|
||
"T1564.001 NaN \n",
|
||
"T1564 NaN \n",
|
||
"T1222.001 NaN \n",
|
||
"T1069 NaN \n",
|
||
"T1069.001 NaN \n",
|
||
"T1055.002 [windows_process_injection_remote_thread.yml] \n",
|
||
"T1033 [system_user_discovery_with_whoami.yml, windows_system_discovery_using_ldap_nslookup.yml, windows_system_discovery_using_qwinsta.yml] \n",
|
||
"T1047 [windows_wmi_impersonate_token.yml, windows_wmi_process_call_create.yml] \n",
|
||
"T1574.002 [windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml] \n",
|
||
"T1574 [windows_dll_search_order_hijacking_hunt_with_sysmon.yml, windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml] \n",
|
||
"T1016 [network_discovery_using_route_windows_app.yml] \n",
|
||
"T1016.001 [network_discovery_using_route_windows_app.yml] \n",
|
||
"T1036.003 [suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml] \n",
|
||
"T1566.002 [process_creating_lnk_file_in_suspicious_location.yml] \n",
|
||
"T1482 [nltest_domain_trust_discovery.yml] \n",
|
||
"T1574.001 [windows_dll_search_order_hijacking_hunt_with_sysmon.yml] \n",
|
||
"T1071.003 NaN \n",
|
||
"T1014 NaN \n",
|
||
"T1068 NaN \n",
|
||
"T1218.001 NaN \n",
|
||
"T1218.005 NaN \n",
|
||
"T1087.002 NaN \n",
|
||
"T1087 NaN \n",
|
||
"T1218.011 NaN \n",
|
||
"T1021.002 NaN \n",
|
||
"\n",
|
||
" AgentTesla \\\n",
|
||
"T1059.005 NaN \n",
|
||
"T1113 NaN \n",
|
||
"T1070 NaN \n",
|
||
"T1559.001 NaN \n",
|
||
"T1134.004 NaN \n",
|
||
"T1134 NaN \n",
|
||
"T1021.001 NaN \n",
|
||
"T1489 NaN \n",
|
||
"T1219 NaN \n",
|
||
"T1562.004 NaN \n",
|
||
"T1222 NaN \n",
|
||
"T1136.001 NaN \n",
|
||
"T1136 NaN \n",
|
||
"T1531 NaN \n",
|
||
"T1564.001 NaN \n",
|
||
"T1564 NaN \n",
|
||
"T1222.001 NaN \n",
|
||
"T1069 NaN \n",
|
||
"T1069.001 NaN \n",
|
||
"T1055.002 NaN \n",
|
||
"T1033 NaN \n",
|
||
"T1047 NaN \n",
|
||
"T1574.002 NaN \n",
|
||
"T1574 NaN \n",
|
||
"T1016 NaN \n",
|
||
"T1016.001 NaN \n",
|
||
"T1036.003 NaN \n",
|
||
"T1566.002 NaN \n",
|
||
"T1482 NaN \n",
|
||
"T1574.001 NaN \n",
|
||
"T1071.003 [windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml] \n",
|
||
"T1014 [windows_driver_load_non_standard_path.yml, windows_drivers_loaded_by_signature.yml] \n",
|
||
"T1068 [windows_drivers_loaded_by_signature.yml] \n",
|
||
"T1218.001 [detect_html_help_spawn_child_process.yml] \n",
|
||
"T1218.005 NaN \n",
|
||
"T1087.002 NaN \n",
|
||
"T1087 NaN \n",
|
||
"T1218.011 NaN \n",
|
||
"T1021.002 NaN \n",
|
||
"\n",
|
||
" Trickbot \n",
|
||
"T1059.005 NaN \n",
|
||
"T1113 NaN \n",
|
||
"T1070 NaN \n",
|
||
"T1559.001 NaN \n",
|
||
"T1134.004 NaN \n",
|
||
"T1134 NaN \n",
|
||
"T1021.001 NaN \n",
|
||
"T1489 NaN \n",
|
||
"T1219 NaN \n",
|
||
"T1562.004 NaN \n",
|
||
"T1222 NaN \n",
|
||
"T1136.001 NaN \n",
|
||
"T1136 NaN \n",
|
||
"T1531 NaN \n",
|
||
"T1564.001 NaN \n",
|
||
"T1564 NaN \n",
|
||
"T1222.001 NaN \n",
|
||
"T1069 NaN \n",
|
||
"T1069.001 NaN \n",
|
||
"T1055.002 NaN \n",
|
||
"T1033 NaN \n",
|
||
"T1047 NaN \n",
|
||
"T1574.002 NaN \n",
|
||
"T1574 NaN \n",
|
||
"T1016 NaN \n",
|
||
"T1016.001 NaN \n",
|
||
"T1036.003 NaN \n",
|
||
"T1566.002 NaN \n",
|
||
"T1482 NaN \n",
|
||
"T1574.001 NaN \n",
|
||
"T1071.003 NaN \n",
|
||
"T1014 NaN \n",
|
||
"T1068 NaN \n",
|
||
"T1218.001 NaN \n",
|
||
"T1218.005 [mshta_spawning_rundll32_or_regsvr32_process.yml] \n",
|
||
"T1087.002 [account_discovery_with_net_app.yml] \n",
|
||
"T1087 [account_discovery_with_net_app.yml] \n",
|
||
"T1218.011 [suspicious_rundll32_startw.yml] \n",
|
||
"T1021.002 [executable_file_written_in_administrative_smb_share.yml] "
|
||
]
|
||
},
|
||
"execution_count": 32,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"det_table_dict = detection_list_by_id(temp_dict)\n",
|
||
"tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf "
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "9ad6099d-a1cf-464c-8678-50d013436254",
|
||
"metadata": {},
|
||
"source": [
|
||
"### detection count per mitre attack id in each malware family"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 33,
|
||
"id": "0f0abfc2-e6d8-4a42-b881-d4357b667a91",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<div>\n",
|
||
"<style scoped>\n",
|
||
" .dataframe tbody tr th:only-of-type {\n",
|
||
" vertical-align: middle;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe tbody tr th {\n",
|
||
" vertical-align: top;\n",
|
||
" }\n",
|
||
"\n",
|
||
" .dataframe thead th {\n",
|
||
" text-align: right;\n",
|
||
" }\n",
|
||
"</style>\n",
|
||
"<table border=\"1\" class=\"dataframe\">\n",
|
||
" <thead>\n",
|
||
" <tr style=\"text-align: right;\">\n",
|
||
" <th></th>\n",
|
||
" <th>Remcos</th>\n",
|
||
" <th>Azorult</th>\n",
|
||
" <th>Qakbot</th>\n",
|
||
" <th>AgentTesla</th>\n",
|
||
" <th>Trickbot</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th>T1059.005</th>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1113</th>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1070</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1559.001</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1134.004</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1134</th>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1021.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(5)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1489</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1219</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1562.004</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1222</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1136.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1136</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1531</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1564.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1564</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1222.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1069</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1069.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1055.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1033</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1047</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(4)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1016</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1016.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1036.003</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1566.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1482</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1574.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1071.003</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(3)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1014</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(2)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1068</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.001</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.005</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1087.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1087</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1218.011</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th>T1021.002</th>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>NaN</td>\n",
|
||
" <td>(1)-detection count</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n",
|
||
"</div>"
|
||
],
|
||
"text/plain": [
|
||
" Remcos Azorult Qakbot \\\n",
|
||
"T1059.005 (2)-detection count NaN NaN \n",
|
||
"T1113 (3)-detection count NaN NaN \n",
|
||
"T1070 (1)-detection count NaN NaN \n",
|
||
"T1559.001 (1)-detection count NaN NaN \n",
|
||
"T1134.004 (1)-detection count NaN NaN \n",
|
||
"T1134 (1)-detection count NaN NaN \n",
|
||
"T1021.001 NaN (5)-detection count NaN \n",
|
||
"T1489 NaN (3)-detection count NaN \n",
|
||
"T1219 NaN (1)-detection count NaN \n",
|
||
"T1562.004 NaN (2)-detection count NaN \n",
|
||
"T1222 NaN (3)-detection count NaN \n",
|
||
"T1136.001 NaN (1)-detection count NaN \n",
|
||
"T1136 NaN (1)-detection count NaN \n",
|
||
"T1531 NaN (1)-detection count NaN \n",
|
||
"T1564.001 NaN (1)-detection count NaN \n",
|
||
"T1564 NaN (1)-detection count NaN \n",
|
||
"T1222.001 NaN (1)-detection count NaN \n",
|
||
"T1069 NaN (1)-detection count NaN \n",
|
||
"T1069.001 NaN (1)-detection count NaN \n",
|
||
"T1055.002 NaN NaN (1)-detection count \n",
|
||
"T1033 NaN NaN (3)-detection count \n",
|
||
"T1047 NaN NaN (2)-detection count \n",
|
||
"T1574.002 NaN NaN (3)-detection count \n",
|
||
"T1574 NaN NaN (4)-detection count \n",
|
||
"T1016 NaN NaN (1)-detection count \n",
|
||
"T1016.001 NaN NaN (1)-detection count \n",
|
||
"T1036.003 NaN NaN (2)-detection count \n",
|
||
"T1566.002 NaN NaN (1)-detection count \n",
|
||
"T1482 NaN NaN (1)-detection count \n",
|
||
"T1574.001 NaN NaN (1)-detection count \n",
|
||
"T1071.003 NaN NaN NaN \n",
|
||
"T1014 NaN NaN NaN \n",
|
||
"T1068 NaN NaN NaN \n",
|
||
"T1218.001 NaN NaN NaN \n",
|
||
"T1218.005 NaN NaN NaN \n",
|
||
"T1087.002 NaN NaN NaN \n",
|
||
"T1087 NaN NaN NaN \n",
|
||
"T1218.011 NaN NaN NaN \n",
|
||
"T1021.002 NaN NaN NaN \n",
|
||
"\n",
|
||
" AgentTesla Trickbot \n",
|
||
"T1059.005 NaN NaN \n",
|
||
"T1113 NaN NaN \n",
|
||
"T1070 NaN NaN \n",
|
||
"T1559.001 NaN NaN \n",
|
||
"T1134.004 NaN NaN \n",
|
||
"T1134 NaN NaN \n",
|
||
"T1021.001 NaN NaN \n",
|
||
"T1489 NaN NaN \n",
|
||
"T1219 NaN NaN \n",
|
||
"T1562.004 NaN NaN \n",
|
||
"T1222 NaN NaN \n",
|
||
"T1136.001 NaN NaN \n",
|
||
"T1136 NaN NaN \n",
|
||
"T1531 NaN NaN \n",
|
||
"T1564.001 NaN NaN \n",
|
||
"T1564 NaN NaN \n",
|
||
"T1222.001 NaN NaN \n",
|
||
"T1069 NaN NaN \n",
|
||
"T1069.001 NaN NaN \n",
|
||
"T1055.002 NaN NaN \n",
|
||
"T1033 NaN NaN \n",
|
||
"T1047 NaN NaN \n",
|
||
"T1574.002 NaN NaN \n",
|
||
"T1574 NaN NaN \n",
|
||
"T1016 NaN NaN \n",
|
||
"T1016.001 NaN NaN \n",
|
||
"T1036.003 NaN NaN \n",
|
||
"T1566.002 NaN NaN \n",
|
||
"T1482 NaN NaN \n",
|
||
"T1574.001 NaN NaN \n",
|
||
"T1071.003 (3)-detection count NaN \n",
|
||
"T1014 (2)-detection count NaN \n",
|
||
"T1068 (1)-detection count NaN \n",
|
||
"T1218.001 (1)-detection count NaN \n",
|
||
"T1218.005 NaN (1)-detection count \n",
|
||
"T1087.002 NaN (1)-detection count \n",
|
||
"T1087 NaN (1)-detection count \n",
|
||
"T1218.011 NaN (1)-detection count \n",
|
||
"T1021.002 NaN (1)-detection count "
|
||
]
|
||
},
|
||
"execution_count": 33,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"detection_list_by_count(det_table_dict)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 34,
|
||
"id": "9a275cc7-9c29-492e-a266-7e5e15ca0874",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"['T1014', 'T1016', 'T1016.001', 'T1021', 'T1021.001', 'T1021.002', 'T1027', 'T1033', 'T1036', 'T1036.003', 'T1047', 'T1049', 'T1053', 'T1053.005', 'T1055', 'T1055.001', 'T1055.002', 'T1059', 'T1059.001', 'T1059.003', 'T1059.005', 'T1059.007', 'T1068', 'T1069', 'T1069.001', 'T1070', 'T1071', 'T1071.003', 'T1087', 'T1087.002', 'T1112', 'T1113', 'T1134', 'T1134.004', 'T1136', 'T1136.001', 'T1204', 'T1204.001', 'T1218', 'T1218.001', 'T1218.005', 'T1218.010', 'T1218.011', 'T1219', 'T1222', 'T1222.001', 'T1482', 'T1489', 'T1531', 'T1543', 'T1543.003', 'T1547', 'T1547.001', 'T1548', 'T1548.002', 'T1555', 'T1555.003', 'T1559.001', 'T1562', 'T1562.001', 'T1562.004', 'T1564', 'T1564.001', 'T1566', 'T1566.001', 'T1566.002', 'T1569', 'T1569.002', 'T1574', 'T1574.001', 'T1574.002', 'T1590', 'T1590.005', 'T1592']\n"
|
||
]
|
||
}
|
||
],
|
||
"source": [
|
||
"detection_tid_list =[]\n",
|
||
"for k,v in mitre_attack_tid_dict.items():\n",
|
||
" detection_tid_list.append(k)\n",
|
||
"\n",
|
||
"print(sorted(detection_tid_list))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "e62ffc04-7445-479c-a5a8-751d0abd1b0f",
|
||
"metadata": {},
|
||
"source": [
|
||
"### truth table splunk detection name vs analytic story (malware family)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 35,
|
||
"id": "31decfcb-ca16-479c-88cc-51b5a72422f6",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(140, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_9f55b_row0_col0, #T_9f55b_row0_col1, #T_9f55b_row0_col2, #T_9f55b_row0_col3, #T_9f55b_row0_col4, #T_9f55b_row0_col5, #T_9f55b_row1_col0, #T_9f55b_row1_col1, #T_9f55b_row1_col2, #T_9f55b_row1_col3, #T_9f55b_row1_col4, #T_9f55b_row1_col5, #T_9f55b_row2_col0, #T_9f55b_row2_col1, #T_9f55b_row2_col2, #T_9f55b_row2_col3, #T_9f55b_row2_col4, #T_9f55b_row2_col5, #T_9f55b_row3_col0, #T_9f55b_row3_col1, #T_9f55b_row3_col2, #T_9f55b_row3_col3, #T_9f55b_row3_col4, #T_9f55b_row3_col5 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_9f55b_row4_col0, #T_9f55b_row4_col1, #T_9f55b_row4_col2, #T_9f55b_row4_col3, #T_9f55b_row4_col4, #T_9f55b_row4_col5, #T_9f55b_row5_col0, #T_9f55b_row5_col1, #T_9f55b_row5_col2, #T_9f55b_row5_col3, #T_9f55b_row5_col4, #T_9f55b_row5_col5, #T_9f55b_row6_col0, #T_9f55b_row6_col1, #T_9f55b_row6_col2, #T_9f55b_row6_col3, #T_9f55b_row6_col4, #T_9f55b_row6_col5 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_9f55b_row7_col0, #T_9f55b_row7_col1, #T_9f55b_row7_col2, #T_9f55b_row7_col3, #T_9f55b_row7_col4, #T_9f55b_row7_col5, #T_9f55b_row8_col0, #T_9f55b_row8_col1, #T_9f55b_row8_col2, #T_9f55b_row8_col3, #T_9f55b_row8_col4, #T_9f55b_row8_col5, #T_9f55b_row9_col0, #T_9f55b_row9_col1, #T_9f55b_row9_col2, #T_9f55b_row9_col3, #T_9f55b_row9_col4, #T_9f55b_row9_col5, #T_9f55b_row10_col0, #T_9f55b_row10_col1, #T_9f55b_row10_col2, #T_9f55b_row10_col3, #T_9f55b_row10_col4, #T_9f55b_row10_col5 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_9f55b_row11_col0, #T_9f55b_row11_col1, #T_9f55b_row11_col2, #T_9f55b_row11_col3, #T_9f55b_row11_col4, #T_9f55b_row11_col5, #T_9f55b_row12_col0, #T_9f55b_row12_col1, #T_9f55b_row12_col2, #T_9f55b_row12_col3, #T_9f55b_row12_col4, #T_9f55b_row12_col5, #T_9f55b_row13_col0, #T_9f55b_row13_col1, #T_9f55b_row13_col2, #T_9f55b_row13_col3, #T_9f55b_row13_col4, #T_9f55b_row13_col5, #T_9f55b_row14_col0, #T_9f55b_row14_col1, #T_9f55b_row14_col2, #T_9f55b_row14_col3, #T_9f55b_row14_col4, #T_9f55b_row14_col5, #T_9f55b_row15_col0, #T_9f55b_row15_col1, #T_9f55b_row15_col2, #T_9f55b_row15_col3, #T_9f55b_row15_col4, #T_9f55b_row15_col5, #T_9f55b_row16_col0, #T_9f55b_row16_col1, #T_9f55b_row16_col2, #T_9f55b_row16_col3, #T_9f55b_row16_col4, #T_9f55b_row16_col5, #T_9f55b_row17_col0, #T_9f55b_row17_col1, #T_9f55b_row17_col2, #T_9f55b_row17_col3, #T_9f55b_row17_col4, #T_9f55b_row17_col5, #T_9f55b_row18_col0, #T_9f55b_row18_col1, #T_9f55b_row18_col2, #T_9f55b_row18_col3, #T_9f55b_row18_col4, #T_9f55b_row18_col5, #T_9f55b_row19_col0, #T_9f55b_row19_col1, #T_9f55b_row19_col2, #T_9f55b_row19_col3, #T_9f55b_row19_col4, #T_9f55b_row19_col5, #T_9f55b_row20_col0, #T_9f55b_row20_col1, #T_9f55b_row20_col2, #T_9f55b_row20_col3, #T_9f55b_row20_col4, #T_9f55b_row20_col5, #T_9f55b_row21_col0, #T_9f55b_row21_col1, #T_9f55b_row21_col2, #T_9f55b_row21_col3, #T_9f55b_row21_col4, #T_9f55b_row21_col5 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_9f55b_row22_col0, #T_9f55b_row22_col1, #T_9f55b_row22_col2, #T_9f55b_row22_col3, #T_9f55b_row22_col4, #T_9f55b_row22_col5, #T_9f55b_row23_col0, #T_9f55b_row23_col1, #T_9f55b_row23_col2, #T_9f55b_row23_col3, #T_9f55b_row23_col4, #T_9f55b_row23_col5, #T_9f55b_row24_col0, #T_9f55b_row24_col1, #T_9f55b_row24_col2, #T_9f55b_row24_col3, #T_9f55b_row24_col4, #T_9f55b_row24_col5, #T_9f55b_row25_col0, #T_9f55b_row25_col1, #T_9f55b_row25_col2, #T_9f55b_row25_col3, #T_9f55b_row25_col4, #T_9f55b_row25_col5, #T_9f55b_row26_col0, #T_9f55b_row26_col1, #T_9f55b_row26_col2, #T_9f55b_row26_col3, #T_9f55b_row26_col4, #T_9f55b_row26_col5, #T_9f55b_row27_col0, #T_9f55b_row27_col1, #T_9f55b_row27_col2, #T_9f55b_row27_col3, #T_9f55b_row27_col4, #T_9f55b_row27_col5, #T_9f55b_row28_col0, #T_9f55b_row28_col1, #T_9f55b_row28_col2, #T_9f55b_row28_col3, #T_9f55b_row28_col4, #T_9f55b_row28_col5, #T_9f55b_row29_col0, #T_9f55b_row29_col1, #T_9f55b_row29_col2, #T_9f55b_row29_col3, #T_9f55b_row29_col4, #T_9f55b_row29_col5, #T_9f55b_row30_col0, #T_9f55b_row30_col1, #T_9f55b_row30_col2, #T_9f55b_row30_col3, #T_9f55b_row30_col4, #T_9f55b_row30_col5, #T_9f55b_row31_col0, #T_9f55b_row31_col1, #T_9f55b_row31_col2, #T_9f55b_row31_col3, #T_9f55b_row31_col4, #T_9f55b_row31_col5, #T_9f55b_row32_col0, #T_9f55b_row32_col1, #T_9f55b_row32_col2, #T_9f55b_row32_col3, #T_9f55b_row32_col4, #T_9f55b_row32_col5, #T_9f55b_row33_col0, #T_9f55b_row33_col1, #T_9f55b_row33_col2, #T_9f55b_row33_col3, #T_9f55b_row33_col4, #T_9f55b_row33_col5, #T_9f55b_row34_col0, #T_9f55b_row34_col1, #T_9f55b_row34_col2, #T_9f55b_row34_col3, #T_9f55b_row34_col4, #T_9f55b_row34_col5, #T_9f55b_row35_col0, #T_9f55b_row35_col1, #T_9f55b_row35_col2, #T_9f55b_row35_col3, #T_9f55b_row35_col4, #T_9f55b_row35_col5, #T_9f55b_row36_col0, #T_9f55b_row36_col1, #T_9f55b_row36_col2, #T_9f55b_row36_col3, #T_9f55b_row36_col4, #T_9f55b_row36_col5, #T_9f55b_row37_col0, #T_9f55b_row37_col1, #T_9f55b_row37_col2, #T_9f55b_row37_col3, #T_9f55b_row37_col4, #T_9f55b_row37_col5, #T_9f55b_row38_col0, #T_9f55b_row38_col1, #T_9f55b_row38_col2, #T_9f55b_row38_col3, #T_9f55b_row38_col4, #T_9f55b_row38_col5, #T_9f55b_row39_col0, #T_9f55b_row39_col1, #T_9f55b_row39_col2, #T_9f55b_row39_col3, #T_9f55b_row39_col4, #T_9f55b_row39_col5, #T_9f55b_row40_col0, #T_9f55b_row40_col1, #T_9f55b_row40_col2, #T_9f55b_row40_col3, #T_9f55b_row40_col4, #T_9f55b_row40_col5, #T_9f55b_row41_col0, #T_9f55b_row41_col1, #T_9f55b_row41_col2, #T_9f55b_row41_col3, #T_9f55b_row41_col4, #T_9f55b_row41_col5, #T_9f55b_row42_col0, #T_9f55b_row42_col1, #T_9f55b_row42_col2, #T_9f55b_row42_col3, #T_9f55b_row42_col4, #T_9f55b_row42_col5, #T_9f55b_row43_col0, #T_9f55b_row43_col1, #T_9f55b_row43_col2, #T_9f55b_row43_col3, #T_9f55b_row43_col4, #T_9f55b_row43_col5, #T_9f55b_row44_col0, #T_9f55b_row44_col1, #T_9f55b_row44_col2, #T_9f55b_row44_col3, #T_9f55b_row44_col4, #T_9f55b_row44_col5, #T_9f55b_row45_col0, #T_9f55b_row45_col1, #T_9f55b_row45_col2, #T_9f55b_row45_col3, #T_9f55b_row45_col4, #T_9f55b_row45_col5, #T_9f55b_row46_col0, #T_9f55b_row46_col1, #T_9f55b_row46_col2, #T_9f55b_row46_col3, #T_9f55b_row46_col4, #T_9f55b_row46_col5, #T_9f55b_row47_col0, #T_9f55b_row47_col1, #T_9f55b_row47_col2, #T_9f55b_row47_col3, #T_9f55b_row47_col4, #T_9f55b_row47_col5, #T_9f55b_row48_col0, #T_9f55b_row48_col1, #T_9f55b_row48_col2, #T_9f55b_row48_col3, #T_9f55b_row48_col4, #T_9f55b_row48_col5, #T_9f55b_row49_col0, #T_9f55b_row49_col1, #T_9f55b_row49_col2, #T_9f55b_row49_col3, #T_9f55b_row49_col4, #T_9f55b_row49_col5, #T_9f55b_row50_col0, #T_9f55b_row50_col1, #T_9f55b_row50_col2, #T_9f55b_row50_col3, #T_9f55b_row50_col4, #T_9f55b_row50_col5, #T_9f55b_row51_col0, #T_9f55b_row51_col1, #T_9f55b_row51_col2, #T_9f55b_row51_col3, #T_9f55b_row51_col4, #T_9f55b_row51_col5, #T_9f55b_row52_col0, #T_9f55b_row52_col1, #T_9f55b_row52_col2, #T_9f55b_row52_col3, #T_9f55b_row52_col4, #T_9f55b_row52_col5, #T_9f55b_row53_col0, #T_9f55b_row53_col1, #T_9f55b_row53_col2, #T_9f55b_row53_col3, #T_9f55b_row53_col4, #T_9f55b_row53_col5, #T_9f55b_row54_col0, #T_9f55b_row54_col1, #T_9f55b_row54_col2, #T_9f55b_row54_col3, #T_9f55b_row54_col4, #T_9f55b_row54_col5, #T_9f55b_row55_col0, #T_9f55b_row55_col1, #T_9f55b_row55_col2, #T_9f55b_row55_col3, #T_9f55b_row55_col4, #T_9f55b_row55_col5, #T_9f55b_row56_col0, #T_9f55b_row56_col1, #T_9f55b_row56_col2, #T_9f55b_row56_col3, #T_9f55b_row56_col4, #T_9f55b_row56_col5, #T_9f55b_row57_col0, #T_9f55b_row57_col1, #T_9f55b_row57_col2, #T_9f55b_row57_col3, #T_9f55b_row57_col4, #T_9f55b_row57_col5, #T_9f55b_row58_col0, #T_9f55b_row58_col1, #T_9f55b_row58_col2, #T_9f55b_row58_col3, #T_9f55b_row58_col4, #T_9f55b_row58_col5, #T_9f55b_row59_col0, #T_9f55b_row59_col1, #T_9f55b_row59_col2, #T_9f55b_row59_col3, #T_9f55b_row59_col4, #T_9f55b_row59_col5, #T_9f55b_row60_col0, #T_9f55b_row60_col1, #T_9f55b_row60_col2, #T_9f55b_row60_col3, #T_9f55b_row60_col4, #T_9f55b_row60_col5, #T_9f55b_row61_col0, #T_9f55b_row61_col1, #T_9f55b_row61_col2, #T_9f55b_row61_col3, #T_9f55b_row61_col4, #T_9f55b_row61_col5, #T_9f55b_row62_col0, #T_9f55b_row62_col1, #T_9f55b_row62_col2, #T_9f55b_row62_col3, #T_9f55b_row62_col4, #T_9f55b_row62_col5, #T_9f55b_row63_col0, #T_9f55b_row63_col1, #T_9f55b_row63_col2, #T_9f55b_row63_col3, #T_9f55b_row63_col4, #T_9f55b_row63_col5, #T_9f55b_row64_col0, #T_9f55b_row64_col1, #T_9f55b_row64_col2, #T_9f55b_row64_col3, #T_9f55b_row64_col4, #T_9f55b_row64_col5, #T_9f55b_row65_col0, #T_9f55b_row65_col1, #T_9f55b_row65_col2, #T_9f55b_row65_col3, #T_9f55b_row65_col4, #T_9f55b_row65_col5, #T_9f55b_row66_col0, #T_9f55b_row66_col1, #T_9f55b_row66_col2, #T_9f55b_row66_col3, #T_9f55b_row66_col4, #T_9f55b_row66_col5, #T_9f55b_row67_col0, #T_9f55b_row67_col1, #T_9f55b_row67_col2, #T_9f55b_row67_col3, #T_9f55b_row67_col4, #T_9f55b_row67_col5, #T_9f55b_row68_col0, #T_9f55b_row68_col1, #T_9f55b_row68_col2, #T_9f55b_row68_col3, #T_9f55b_row68_col4, #T_9f55b_row68_col5, #T_9f55b_row69_col0, #T_9f55b_row69_col1, #T_9f55b_row69_col2, #T_9f55b_row69_col3, #T_9f55b_row69_col4, #T_9f55b_row69_col5, #T_9f55b_row70_col0, #T_9f55b_row70_col1, #T_9f55b_row70_col2, #T_9f55b_row70_col3, #T_9f55b_row70_col4, #T_9f55b_row70_col5, #T_9f55b_row71_col0, #T_9f55b_row71_col1, #T_9f55b_row71_col2, #T_9f55b_row71_col3, #T_9f55b_row71_col4, #T_9f55b_row71_col5, #T_9f55b_row72_col0, #T_9f55b_row72_col1, #T_9f55b_row72_col2, #T_9f55b_row72_col3, #T_9f55b_row72_col4, #T_9f55b_row72_col5, #T_9f55b_row73_col0, #T_9f55b_row73_col1, #T_9f55b_row73_col2, #T_9f55b_row73_col3, #T_9f55b_row73_col4, #T_9f55b_row73_col5, #T_9f55b_row74_col0, #T_9f55b_row74_col1, #T_9f55b_row74_col2, #T_9f55b_row74_col3, #T_9f55b_row74_col4, #T_9f55b_row74_col5, #T_9f55b_row75_col0, #T_9f55b_row75_col1, #T_9f55b_row75_col2, #T_9f55b_row75_col3, #T_9f55b_row75_col4, #T_9f55b_row75_col5, #T_9f55b_row76_col0, #T_9f55b_row76_col1, #T_9f55b_row76_col2, #T_9f55b_row76_col3, #T_9f55b_row76_col4, #T_9f55b_row76_col5, #T_9f55b_row77_col0, #T_9f55b_row77_col1, #T_9f55b_row77_col2, #T_9f55b_row77_col3, #T_9f55b_row77_col4, #T_9f55b_row77_col5, #T_9f55b_row78_col0, #T_9f55b_row78_col1, #T_9f55b_row78_col2, #T_9f55b_row78_col3, #T_9f55b_row78_col4, #T_9f55b_row78_col5, #T_9f55b_row79_col0, #T_9f55b_row79_col1, #T_9f55b_row79_col2, #T_9f55b_row79_col3, #T_9f55b_row79_col4, #T_9f55b_row79_col5, #T_9f55b_row80_col0, #T_9f55b_row80_col1, #T_9f55b_row80_col2, #T_9f55b_row80_col3, #T_9f55b_row80_col4, #T_9f55b_row80_col5, #T_9f55b_row81_col0, #T_9f55b_row81_col1, #T_9f55b_row81_col2, #T_9f55b_row81_col3, #T_9f55b_row81_col4, #T_9f55b_row81_col5, #T_9f55b_row82_col0, #T_9f55b_row82_col1, #T_9f55b_row82_col2, #T_9f55b_row82_col3, #T_9f55b_row82_col4, #T_9f55b_row82_col5, #T_9f55b_row83_col0, #T_9f55b_row83_col1, #T_9f55b_row83_col2, #T_9f55b_row83_col3, #T_9f55b_row83_col4, #T_9f55b_row83_col5, #T_9f55b_row84_col0, #T_9f55b_row84_col1, #T_9f55b_row84_col2, #T_9f55b_row84_col3, #T_9f55b_row84_col4, #T_9f55b_row84_col5, #T_9f55b_row85_col0, #T_9f55b_row85_col1, #T_9f55b_row85_col2, #T_9f55b_row85_col3, #T_9f55b_row85_col4, #T_9f55b_row85_col5, #T_9f55b_row86_col0, #T_9f55b_row86_col1, #T_9f55b_row86_col2, #T_9f55b_row86_col3, #T_9f55b_row86_col4, #T_9f55b_row86_col5, #T_9f55b_row87_col0, #T_9f55b_row87_col1, #T_9f55b_row87_col2, #T_9f55b_row87_col3, #T_9f55b_row87_col4, #T_9f55b_row87_col5, #T_9f55b_row88_col0, #T_9f55b_row88_col1, #T_9f55b_row88_col2, #T_9f55b_row88_col3, #T_9f55b_row88_col4, #T_9f55b_row88_col5, #T_9f55b_row89_col0, #T_9f55b_row89_col1, #T_9f55b_row89_col2, #T_9f55b_row89_col3, #T_9f55b_row89_col4, #T_9f55b_row89_col5, #T_9f55b_row90_col0, #T_9f55b_row90_col1, #T_9f55b_row90_col2, #T_9f55b_row90_col3, #T_9f55b_row90_col4, #T_9f55b_row90_col5, #T_9f55b_row91_col0, #T_9f55b_row91_col1, #T_9f55b_row91_col2, #T_9f55b_row91_col3, #T_9f55b_row91_col4, #T_9f55b_row91_col5, #T_9f55b_row92_col0, #T_9f55b_row92_col1, #T_9f55b_row92_col2, #T_9f55b_row92_col3, #T_9f55b_row92_col4, #T_9f55b_row92_col5, #T_9f55b_row93_col0, #T_9f55b_row93_col1, #T_9f55b_row93_col2, #T_9f55b_row93_col3, #T_9f55b_row93_col4, #T_9f55b_row93_col5, #T_9f55b_row94_col0, #T_9f55b_row94_col1, #T_9f55b_row94_col2, #T_9f55b_row94_col3, #T_9f55b_row94_col4, #T_9f55b_row94_col5, #T_9f55b_row95_col0, #T_9f55b_row95_col1, #T_9f55b_row95_col2, #T_9f55b_row95_col3, #T_9f55b_row95_col4, #T_9f55b_row95_col5, #T_9f55b_row96_col0, #T_9f55b_row96_col1, #T_9f55b_row96_col2, #T_9f55b_row96_col3, #T_9f55b_row96_col4, #T_9f55b_row96_col5, #T_9f55b_row97_col0, #T_9f55b_row97_col1, #T_9f55b_row97_col2, #T_9f55b_row97_col3, #T_9f55b_row97_col4, #T_9f55b_row97_col5, #T_9f55b_row98_col0, #T_9f55b_row98_col1, #T_9f55b_row98_col2, #T_9f55b_row98_col3, #T_9f55b_row98_col4, #T_9f55b_row98_col5, #T_9f55b_row99_col0, #T_9f55b_row99_col1, #T_9f55b_row99_col2, #T_9f55b_row99_col3, #T_9f55b_row99_col4, #T_9f55b_row99_col5, #T_9f55b_row100_col0, #T_9f55b_row100_col1, #T_9f55b_row100_col2, #T_9f55b_row100_col3, #T_9f55b_row100_col4, #T_9f55b_row100_col5, #T_9f55b_row101_col0, #T_9f55b_row101_col1, #T_9f55b_row101_col2, #T_9f55b_row101_col3, #T_9f55b_row101_col4, #T_9f55b_row101_col5, #T_9f55b_row102_col0, #T_9f55b_row102_col1, #T_9f55b_row102_col2, #T_9f55b_row102_col3, #T_9f55b_row102_col4, #T_9f55b_row102_col5, #T_9f55b_row103_col0, #T_9f55b_row103_col1, #T_9f55b_row103_col2, #T_9f55b_row103_col3, #T_9f55b_row103_col4, #T_9f55b_row103_col5, #T_9f55b_row104_col0, #T_9f55b_row104_col1, #T_9f55b_row104_col2, #T_9f55b_row104_col3, #T_9f55b_row104_col4, #T_9f55b_row104_col5, #T_9f55b_row105_col0, #T_9f55b_row105_col1, #T_9f55b_row105_col2, #T_9f55b_row105_col3, #T_9f55b_row105_col4, #T_9f55b_row105_col5, #T_9f55b_row106_col0, #T_9f55b_row106_col1, #T_9f55b_row106_col2, #T_9f55b_row106_col3, #T_9f55b_row106_col4, #T_9f55b_row106_col5, #T_9f55b_row107_col0, #T_9f55b_row107_col1, #T_9f55b_row107_col2, #T_9f55b_row107_col3, #T_9f55b_row107_col4, #T_9f55b_row107_col5, #T_9f55b_row108_col0, #T_9f55b_row108_col1, #T_9f55b_row108_col2, #T_9f55b_row108_col3, #T_9f55b_row108_col4, #T_9f55b_row108_col5, #T_9f55b_row109_col0, #T_9f55b_row109_col1, #T_9f55b_row109_col2, #T_9f55b_row109_col3, #T_9f55b_row109_col4, #T_9f55b_row109_col5, #T_9f55b_row110_col0, #T_9f55b_row110_col1, #T_9f55b_row110_col2, #T_9f55b_row110_col3, #T_9f55b_row110_col4, #T_9f55b_row110_col5, #T_9f55b_row111_col0, #T_9f55b_row111_col1, #T_9f55b_row111_col2, #T_9f55b_row111_col3, #T_9f55b_row111_col4, #T_9f55b_row111_col5, #T_9f55b_row112_col0, #T_9f55b_row112_col1, #T_9f55b_row112_col2, #T_9f55b_row112_col3, #T_9f55b_row112_col4, #T_9f55b_row112_col5, #T_9f55b_row113_col0, #T_9f55b_row113_col1, #T_9f55b_row113_col2, #T_9f55b_row113_col3, #T_9f55b_row113_col4, #T_9f55b_row113_col5, #T_9f55b_row114_col0, #T_9f55b_row114_col1, #T_9f55b_row114_col2, #T_9f55b_row114_col3, #T_9f55b_row114_col4, #T_9f55b_row114_col5, #T_9f55b_row115_col0, #T_9f55b_row115_col1, #T_9f55b_row115_col2, #T_9f55b_row115_col3, #T_9f55b_row115_col4, #T_9f55b_row115_col5, #T_9f55b_row116_col0, #T_9f55b_row116_col1, #T_9f55b_row116_col2, #T_9f55b_row116_col3, #T_9f55b_row116_col4, #T_9f55b_row116_col5, #T_9f55b_row117_col0, #T_9f55b_row117_col1, #T_9f55b_row117_col2, #T_9f55b_row117_col3, #T_9f55b_row117_col4, #T_9f55b_row117_col5, #T_9f55b_row118_col0, #T_9f55b_row118_col1, #T_9f55b_row118_col2, #T_9f55b_row118_col3, #T_9f55b_row118_col4, #T_9f55b_row118_col5, #T_9f55b_row119_col0, #T_9f55b_row119_col1, #T_9f55b_row119_col2, #T_9f55b_row119_col3, #T_9f55b_row119_col4, #T_9f55b_row119_col5, #T_9f55b_row120_col0, #T_9f55b_row120_col1, #T_9f55b_row120_col2, #T_9f55b_row120_col3, #T_9f55b_row120_col4, #T_9f55b_row120_col5, #T_9f55b_row121_col0, #T_9f55b_row121_col1, #T_9f55b_row121_col2, #T_9f55b_row121_col3, #T_9f55b_row121_col4, #T_9f55b_row121_col5, #T_9f55b_row122_col0, #T_9f55b_row122_col1, #T_9f55b_row122_col2, #T_9f55b_row122_col3, #T_9f55b_row122_col4, #T_9f55b_row122_col5, #T_9f55b_row123_col0, #T_9f55b_row123_col1, #T_9f55b_row123_col2, #T_9f55b_row123_col3, #T_9f55b_row123_col4, #T_9f55b_row123_col5, #T_9f55b_row124_col0, #T_9f55b_row124_col1, #T_9f55b_row124_col2, #T_9f55b_row124_col3, #T_9f55b_row124_col4, #T_9f55b_row124_col5, #T_9f55b_row125_col0, #T_9f55b_row125_col1, #T_9f55b_row125_col2, #T_9f55b_row125_col3, #T_9f55b_row125_col4, #T_9f55b_row125_col5, #T_9f55b_row126_col0, #T_9f55b_row126_col1, #T_9f55b_row126_col2, #T_9f55b_row126_col3, #T_9f55b_row126_col4, #T_9f55b_row126_col5, #T_9f55b_row127_col0, #T_9f55b_row127_col1, #T_9f55b_row127_col2, #T_9f55b_row127_col3, #T_9f55b_row127_col4, #T_9f55b_row127_col5, #T_9f55b_row128_col0, #T_9f55b_row128_col1, #T_9f55b_row128_col2, #T_9f55b_row128_col3, #T_9f55b_row128_col4, #T_9f55b_row128_col5, #T_9f55b_row129_col0, #T_9f55b_row129_col1, #T_9f55b_row129_col2, #T_9f55b_row129_col3, #T_9f55b_row129_col4, #T_9f55b_row129_col5, #T_9f55b_row130_col0, #T_9f55b_row130_col1, #T_9f55b_row130_col2, #T_9f55b_row130_col3, #T_9f55b_row130_col4, #T_9f55b_row130_col5, #T_9f55b_row131_col0, #T_9f55b_row131_col1, #T_9f55b_row131_col2, #T_9f55b_row131_col3, #T_9f55b_row131_col4, #T_9f55b_row131_col5, #T_9f55b_row132_col0, #T_9f55b_row132_col1, #T_9f55b_row132_col2, #T_9f55b_row132_col3, #T_9f55b_row132_col4, #T_9f55b_row132_col5, #T_9f55b_row133_col0, #T_9f55b_row133_col1, #T_9f55b_row133_col2, #T_9f55b_row133_col3, #T_9f55b_row133_col4, #T_9f55b_row133_col5, #T_9f55b_row134_col0, #T_9f55b_row134_col1, #T_9f55b_row134_col2, #T_9f55b_row134_col3, #T_9f55b_row134_col4, #T_9f55b_row134_col5, #T_9f55b_row135_col0, #T_9f55b_row135_col1, #T_9f55b_row135_col2, #T_9f55b_row135_col3, #T_9f55b_row135_col4, #T_9f55b_row135_col5, #T_9f55b_row136_col0, #T_9f55b_row136_col1, #T_9f55b_row136_col2, #T_9f55b_row136_col3, #T_9f55b_row136_col4, #T_9f55b_row136_col5, #T_9f55b_row137_col0, #T_9f55b_row137_col1, #T_9f55b_row137_col2, #T_9f55b_row137_col3, #T_9f55b_row137_col4, #T_9f55b_row137_col5, #T_9f55b_row138_col0, #T_9f55b_row138_col1, #T_9f55b_row138_col2, #T_9f55b_row138_col3, #T_9f55b_row138_col4, #T_9f55b_row138_col5, #T_9f55b_row139_col0, #T_9f55b_row139_col1, #T_9f55b_row139_col2, #T_9f55b_row139_col3, #T_9f55b_row139_col4, #T_9f55b_row139_col5 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_9f55b\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_9f55b_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_9f55b_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_9f55b_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_9f55b_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_9f55b_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_9f55b_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row0\" class=\"row_heading level0 row0\" >office_document_executing_macro_code.yml</th>\n",
|
||
" <td id=\"T_9f55b_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row0_col5\" class=\"data row0 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row1\" class=\"row_heading level0 row1\" >suspicious_process_file_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row1_col5\" class=\"data row1 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row2\" class=\"row_heading level0 row2\" >executables_or_script_creation_in_suspicious_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row2_col5\" class=\"data row2 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row3\" class=\"row_heading level0 row3\" >office_product_spawn_cmd_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row3_col5\" class=\"data row3 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row4\" class=\"row_heading level0 row4\" >windows_phishing_recent_iso_exec_registry.yml</th>\n",
|
||
" <td id=\"T_9f55b_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row4_col3\" class=\"data row4 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row4_col5\" class=\"data row4 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row5\" class=\"row_heading level0 row5\" >windows_iso_lnk_file_creation.yml</th>\n",
|
||
" <td id=\"T_9f55b_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row5_col3\" class=\"data row5 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row5_col5\" class=\"data row5 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row6\" class=\"row_heading level0 row6\" >scheduled_task_deleted_or_created_via_cmd.yml</th>\n",
|
||
" <td id=\"T_9f55b_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row6_col2\" class=\"data row6 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row6_col5\" class=\"data row6 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row7\" class=\"row_heading level0 row7\" >registry_keys_used_for_persistence.yml</th>\n",
|
||
" <td id=\"T_9f55b_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row7_col5\" class=\"data row7 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row8\" class=\"row_heading level0 row8\" >non_firefox_process_access_firefox_profile_dir.yml</th>\n",
|
||
" <td id=\"T_9f55b_row8_col0\" class=\"data row8 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row8_col5\" class=\"data row8 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row9\" class=\"row_heading level0 row9\" >windows_defender_exclusion_registry_entry.yml</th>\n",
|
||
" <td id=\"T_9f55b_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row9_col5\" class=\"data row9 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row10\" class=\"row_heading level0 row10\" >disabling_remote_user_account_control.yml</th>\n",
|
||
" <td id=\"T_9f55b_row10_col0\" class=\"data row10 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row10_col3\" class=\"data row10 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row10_col5\" class=\"data row10 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row11\" class=\"row_heading level0 row11\" >add_or_set_windows_defender_exclusion.yml</th>\n",
|
||
" <td id=\"T_9f55b_row11_col0\" class=\"data row11 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row11_col1\" class=\"data row11 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row11_col3\" class=\"data row11 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row11_col4\" class=\"data row11 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row11_col5\" class=\"data row11 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row12\" class=\"row_heading level0 row12\" >disable_defender_spynet_reporting.yml</th>\n",
|
||
" <td id=\"T_9f55b_row12_col0\" class=\"data row12 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row12_col2\" class=\"data row12 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row12_col3\" class=\"data row12 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row12_col4\" class=\"data row12 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row12_col5\" class=\"data row12 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row13\" class=\"row_heading level0 row13\" >office_product_spawning_certutil.yml</th>\n",
|
||
" <td id=\"T_9f55b_row13_col0\" class=\"data row13 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row13_col1\" class=\"data row13 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row13_col2\" class=\"data row13 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row13_col3\" class=\"data row13 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row13_col4\" class=\"data row13 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row13_col5\" class=\"data row13 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row14\" class=\"row_heading level0 row14\" >excessive_usage_of_taskkill.yml</th>\n",
|
||
" <td id=\"T_9f55b_row14_col0\" class=\"data row14 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row14_col2\" class=\"data row14 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row14_col3\" class=\"data row14 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row14_col4\" class=\"data row14 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row14_col5\" class=\"data row14 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row15\" class=\"row_heading level0 row15\" >regsvr32_with_known_silent_switch_cmdline.yml</th>\n",
|
||
" <td id=\"T_9f55b_row15_col0\" class=\"data row15 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row15_col1\" class=\"data row15 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row15_col3\" class=\"data row15 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row15_col4\" class=\"data row15 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row15_col5\" class=\"data row15 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row16\" class=\"row_heading level0 row16\" >cmd_carry_out_string_command_parameter.yml</th>\n",
|
||
" <td id=\"T_9f55b_row16_col0\" class=\"data row16 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row16_col1\" class=\"data row16 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row16_col2\" class=\"data row16 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row16_col3\" class=\"data row16 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row16_col4\" class=\"data row16 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row16_col5\" class=\"data row16 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row17\" class=\"row_heading level0 row17\" >office_application_spawn_rundll32_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row17_col0\" class=\"data row17 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row17_col1\" class=\"data row17 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row17_col2\" class=\"data row17 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row17_col3\" class=\"data row17 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row17_col4\" class=\"data row17 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row17_col5\" class=\"data row17 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row18\" class=\"row_heading level0 row18\" >powershell_windows_defender_exclusion_commands.yml</th>\n",
|
||
" <td id=\"T_9f55b_row18_col0\" class=\"data row18 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row18_col1\" class=\"data row18 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row18_col2\" class=\"data row18 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row18_col3\" class=\"data row18 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row18_col4\" class=\"data row18 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row18_col5\" class=\"data row18 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row19\" class=\"row_heading level0 row19\" >attempt_to_stop_security_service.yml</th>\n",
|
||
" <td id=\"T_9f55b_row19_col0\" class=\"data row19 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row19_col2\" class=\"data row19 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row19_col3\" class=\"data row19 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row19_col4\" class=\"data row19 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row19_col5\" class=\"data row19 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row20\" class=\"row_heading level0 row20\" >wermgr_process_spawned_cmd_or_powershell_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row20_col0\" class=\"data row20 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row20_col1\" class=\"data row20 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row20_col2\" class=\"data row20 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row20_col3\" class=\"data row20 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row20_col4\" class=\"data row20 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row20_col5\" class=\"data row20 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row21\" class=\"row_heading level0 row21\" >non_chrome_process_accessing_chrome_default_dir.yml</th>\n",
|
||
" <td id=\"T_9f55b_row21_col0\" class=\"data row21 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row21_col1\" class=\"data row21 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row21_col2\" class=\"data row21 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row21_col3\" class=\"data row21 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row21_col4\" class=\"data row21 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row21_col5\" class=\"data row21 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row22\" class=\"row_heading level0 row22\" >chcp_command_execution.yml</th>\n",
|
||
" <td id=\"T_9f55b_row22_col0\" class=\"data row22 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row22_col2\" class=\"data row22 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row22_col3\" class=\"data row22 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row22_col4\" class=\"data row22 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row22_col5\" class=\"data row22 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row23\" class=\"row_heading level0 row23\" >jscript_execution_using_cscript_app.yml</th>\n",
|
||
" <td id=\"T_9f55b_row23_col0\" class=\"data row23 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row23_col1\" class=\"data row23 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row23_col2\" class=\"data row23 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row23_col3\" class=\"data row23 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row23_col4\" class=\"data row23 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row23_col5\" class=\"data row23 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row24\" class=\"row_heading level0 row24\" >wmic_noninteractive_app_uninstallation.yml</th>\n",
|
||
" <td id=\"T_9f55b_row24_col0\" class=\"data row24 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row24_col1\" class=\"data row24 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row24_col2\" class=\"data row24 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row24_col3\" class=\"data row24 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row24_col4\" class=\"data row24 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row24_col5\" class=\"data row24 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row25\" class=\"row_heading level0 row25\" >executable_file_written_in_administrative_smb_share.yml</th>\n",
|
||
" <td id=\"T_9f55b_row25_col0\" class=\"data row25 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row25_col1\" class=\"data row25 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row25_col2\" class=\"data row25 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row25_col3\" class=\"data row25 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row25_col4\" class=\"data row25 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row25_col5\" class=\"data row25 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row26\" class=\"row_heading level0 row26\" >windows_powershell_import_applocker_policy.yml</th>\n",
|
||
" <td id=\"T_9f55b_row26_col0\" class=\"data row26 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row26_col1\" class=\"data row26 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row26_col2\" class=\"data row26 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row26_col3\" class=\"data row26 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row26_col4\" class=\"data row26 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row26_col5\" class=\"data row26 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row27\" class=\"row_heading level0 row27\" >windows_service_stop_by_deletion.yml</th>\n",
|
||
" <td id=\"T_9f55b_row27_col0\" class=\"data row27 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row27_col1\" class=\"data row27 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row27_col2\" class=\"data row27 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row27_col3\" class=\"data row27 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row27_col4\" class=\"data row27 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row27_col5\" class=\"data row27 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row28\" class=\"row_heading level0 row28\" >disable_defender_submit_samples_consent_feature.yml</th>\n",
|
||
" <td id=\"T_9f55b_row28_col0\" class=\"data row28 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row28_col2\" class=\"data row28 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row28_col3\" class=\"data row28 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row28_col4\" class=\"data row28 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row28_col5\" class=\"data row28 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row29\" class=\"row_heading level0 row29\" >schedule_task_with_rundll32_command_trigger.yml</th>\n",
|
||
" <td id=\"T_9f55b_row29_col0\" class=\"data row29 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row29_col1\" class=\"data row29 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row29_col2\" class=\"data row29 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row29_col3\" class=\"data row29 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row29_col4\" class=\"data row29 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row29_col5\" class=\"data row29 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row30\" class=\"row_heading level0 row30\" >suspicious_copy_on_system32.yml</th>\n",
|
||
" <td id=\"T_9f55b_row30_col0\" class=\"data row30 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row30_col1\" class=\"data row30 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row30_col2\" class=\"data row30 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row30_col3\" class=\"data row30 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row30_col4\" class=\"data row30 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row30_col5\" class=\"data row30 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row31\" class=\"row_heading level0 row31\" >detect_html_help_spawn_child_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row31_col0\" class=\"data row31 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row31_col1\" class=\"data row31 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row31_col2\" class=\"data row31 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row31_col3\" class=\"data row31 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row31_col5\" class=\"data row31 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row32\" class=\"row_heading level0 row32\" >windows_modify_registry_disallow_windows_app.yml</th>\n",
|
||
" <td id=\"T_9f55b_row32_col0\" class=\"data row32 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row32_col1\" class=\"data row32 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row32_col2\" class=\"data row32 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row32_col3\" class=\"data row32 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row32_col4\" class=\"data row32 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row32_col5\" class=\"data row32 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row33\" class=\"row_heading level0 row33\" >services_exe_lolbas_execution_process_spawn.yml</th>\n",
|
||
" <td id=\"T_9f55b_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row33_col1\" class=\"data row33 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row33_col2\" class=\"data row33 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row33_col3\" class=\"data row33 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row33_col4\" class=\"data row33 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row33_col5\" class=\"data row33 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row34\" class=\"row_heading level0 row34\" >windows_gather_victim_network_info_through_ip_check_web_services.yml</th>\n",
|
||
" <td id=\"T_9f55b_row34_col0\" class=\"data row34 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row34_col2\" class=\"data row34 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row34_col3\" class=\"data row34 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row34_col4\" class=\"data row34 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row34_col5\" class=\"data row34 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row35\" class=\"row_heading level0 row35\" >suspicious_rundll32_startw.yml</th>\n",
|
||
" <td id=\"T_9f55b_row35_col0\" class=\"data row35 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row35_col1\" class=\"data row35 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row35_col2\" class=\"data row35 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row35_col3\" class=\"data row35 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row35_col4\" class=\"data row35 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row35_col5\" class=\"data row35 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row36\" class=\"row_heading level0 row36\" >windows_regsvr32_renamed_binary.yml</th>\n",
|
||
" <td id=\"T_9f55b_row36_col0\" class=\"data row36 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row36_col1\" class=\"data row36 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row36_col2\" class=\"data row36 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row36_col3\" class=\"data row36 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row36_col4\" class=\"data row36 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row36_col5\" class=\"data row36 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row37\" class=\"row_heading level0 row37\" >winhlp32_spawning_a_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row37_col0\" class=\"data row37 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row37_col1\" class=\"data row37 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row37_col2\" class=\"data row37 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row37_col3\" class=\"data row37 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row37_col4\" class=\"data row37 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row37_col5\" class=\"data row37 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row38\" class=\"row_heading level0 row38\" >account_discovery_with_net_app.yml</th>\n",
|
||
" <td id=\"T_9f55b_row38_col0\" class=\"data row38 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row38_col1\" class=\"data row38 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row38_col2\" class=\"data row38 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row38_col3\" class=\"data row38 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row38_col4\" class=\"data row38 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row38_col5\" class=\"data row38 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row39\" class=\"row_heading level0 row39\" >excessive_usage_of_sc_service_utility.yml</th>\n",
|
||
" <td id=\"T_9f55b_row39_col0\" class=\"data row39 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row39_col1\" class=\"data row39 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row39_col2\" class=\"data row39 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row39_col3\" class=\"data row39 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row39_col4\" class=\"data row39 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row39_col5\" class=\"data row39 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row40\" class=\"row_heading level0 row40\" >disable_show_hidden_files.yml</th>\n",
|
||
" <td id=\"T_9f55b_row40_col0\" class=\"data row40 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row40_col1\" class=\"data row40 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row40_col2\" class=\"data row40 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row40_col3\" class=\"data row40 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row40_col4\" class=\"data row40 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row40_col5\" class=\"data row40 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row41\" class=\"row_heading level0 row41\" >windows_modify_registry_disable_win_defender_raw_write_notif.yml</th>\n",
|
||
" <td id=\"T_9f55b_row41_col0\" class=\"data row41 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row41_col1\" class=\"data row41 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row41_col2\" class=\"data row41 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row41_col3\" class=\"data row41 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row41_col4\" class=\"data row41 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row41_col5\" class=\"data row41 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row42\" class=\"row_heading level0 row42\" >process_writing_dynamicwrapperx.yml</th>\n",
|
||
" <td id=\"T_9f55b_row42_col0\" class=\"data row42 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row42_col1\" class=\"data row42 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row42_col2\" class=\"data row42 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row42_col3\" class=\"data row42 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row42_col4\" class=\"data row42 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row42_col5\" class=\"data row42 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row43\" class=\"row_heading level0 row43\" >detect_use_of_cmd_exe_to_launch_script_interpreters.yml</th>\n",
|
||
" <td id=\"T_9f55b_row43_col0\" class=\"data row43 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row43_col1\" class=\"data row43 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row43_col2\" class=\"data row43 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row43_col3\" class=\"data row43 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row43_col4\" class=\"data row43 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row43_col5\" class=\"data row43 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row44\" class=\"row_heading level0 row44\" >windows_valid_account_with_never_expires_password.yml</th>\n",
|
||
" <td id=\"T_9f55b_row44_col0\" class=\"data row44 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row44_col1\" class=\"data row44 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row44_col2\" class=\"data row44 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row44_col3\" class=\"data row44 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row44_col4\" class=\"data row44 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row44_col5\" class=\"data row44 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row45\" class=\"row_heading level0 row45\" >windows_schtasks_create_run_as_system.yml</th>\n",
|
||
" <td id=\"T_9f55b_row45_col0\" class=\"data row45 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row45_col1\" class=\"data row45 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row45_col2\" class=\"data row45 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row45_col3\" class=\"data row45 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row45_col4\" class=\"data row45 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row45_col5\" class=\"data row45 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row46\" class=\"row_heading level0 row46\" >windows_driver_load_non_standard_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row46_col0\" class=\"data row46 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row46_col1\" class=\"data row46 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row46_col2\" class=\"data row46 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row46_col3\" class=\"data row46 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row46_col4\" class=\"data row46 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row46_col5\" class=\"data row46 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row47\" class=\"row_heading level0 row47\" >windows_impair_defense_deny_security_software_with_applocker.yml</th>\n",
|
||
" <td id=\"T_9f55b_row47_col0\" class=\"data row47 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row47_col1\" class=\"data row47 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row47_col2\" class=\"data row47 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row47_col3\" class=\"data row47 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row47_col4\" class=\"data row47 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row47_col5\" class=\"data row47 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row48\" class=\"row_heading level0 row48\" >windows_dll_side_loading_process_child_of_calc.yml</th>\n",
|
||
" <td id=\"T_9f55b_row48_col0\" class=\"data row48 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row48_col1\" class=\"data row48 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row48_col2\" class=\"data row48 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row48_col3\" class=\"data row48 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row48_col4\" class=\"data row48 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row48_col5\" class=\"data row48 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row49\" class=\"row_heading level0 row49\" >windows_modify_registry_disabling_wer_settings.yml</th>\n",
|
||
" <td id=\"T_9f55b_row49_col0\" class=\"data row49 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row49_col1\" class=\"data row49 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row49_col2\" class=\"data row49 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row49_col3\" class=\"data row49 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row49_col4\" class=\"data row49 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row49_col5\" class=\"data row49 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row50\" class=\"row_heading level0 row50\" >net_localgroup_discovery.yml</th>\n",
|
||
" <td id=\"T_9f55b_row50_col0\" class=\"data row50 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row50_col1\" class=\"data row50 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row50_col2\" class=\"data row50 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row50_col3\" class=\"data row50 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row50_col4\" class=\"data row50 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row50_col5\" class=\"data row50 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row51\" class=\"row_heading level0 row51\" >windows_dll_search_order_hijacking_hunt_with_sysmon.yml</th>\n",
|
||
" <td id=\"T_9f55b_row51_col0\" class=\"data row51 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row51_col1\" class=\"data row51 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row51_col2\" class=\"data row51 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row51_col3\" class=\"data row51 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row51_col4\" class=\"data row51 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row51_col5\" class=\"data row51 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row52\" class=\"row_heading level0 row52\" >disable_defender_blockatfirstseen_feature.yml</th>\n",
|
||
" <td id=\"T_9f55b_row52_col0\" class=\"data row52 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row52_col1\" class=\"data row52 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row52_col2\" class=\"data row52 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row52_col3\" class=\"data row52 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row52_col4\" class=\"data row52 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row52_col5\" class=\"data row52 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row53\" class=\"row_heading level0 row53\" >powershell___connect_to_internet_with_hidden_window.yml</th>\n",
|
||
" <td id=\"T_9f55b_row53_col0\" class=\"data row53 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row53_col1\" class=\"data row53 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row53_col2\" class=\"data row53 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row53_col3\" class=\"data row53 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row53_col4\" class=\"data row53 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row53_col5\" class=\"data row53 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row54\" class=\"row_heading level0 row54\" >wscript_or_cscript_suspicious_child_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row54_col0\" class=\"data row54 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row54_col1\" class=\"data row54 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row54_col2\" class=\"data row54 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row54_col3\" class=\"data row54 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row54_col4\" class=\"data row54 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row54_col5\" class=\"data row54 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row55\" class=\"row_heading level0 row55\" >hiding_files_and_directories_with_attrib_exe.yml</th>\n",
|
||
" <td id=\"T_9f55b_row55_col0\" class=\"data row55 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row55_col2\" class=\"data row55 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row55_col3\" class=\"data row55 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row55_col4\" class=\"data row55 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row55_col5\" class=\"data row55 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row56\" class=\"row_heading level0 row56\" >windows_modify_registry_disable_toast_notifications.yml</th>\n",
|
||
" <td id=\"T_9f55b_row56_col0\" class=\"data row56 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row56_col2\" class=\"data row56 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row56_col3\" class=\"data row56 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row56_col4\" class=\"data row56 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row56_col5\" class=\"data row56 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row57\" class=\"row_heading level0 row57\" >windows_modify_registry_disable_windows_security_center_notif.yml</th>\n",
|
||
" <td id=\"T_9f55b_row57_col0\" class=\"data row57 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row57_col1\" class=\"data row57 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row57_col2\" class=\"data row57 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row57_col3\" class=\"data row57 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row57_col4\" class=\"data row57 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row57_col5\" class=\"data row57 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row58\" class=\"row_heading level0 row58\" >windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml</th>\n",
|
||
" <td id=\"T_9f55b_row58_col0\" class=\"data row58 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row58_col1\" class=\"data row58 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row58_col2\" class=\"data row58 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row58_col3\" class=\"data row58 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row58_col4\" class=\"data row58 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row58_col5\" class=\"data row58 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row59\" class=\"row_heading level0 row59\" >windows_wmi_impersonate_token.yml</th>\n",
|
||
" <td id=\"T_9f55b_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row59_col1\" class=\"data row59 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row59_col2\" class=\"data row59 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row59_col3\" class=\"data row59 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row59_col4\" class=\"data row59 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row59_col5\" class=\"data row59 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row60\" class=\"row_heading level0 row60\" >office_application_spawn_regsvr32_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row60_col1\" class=\"data row60 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row60_col2\" class=\"data row60 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row60_col3\" class=\"data row60 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row60_col4\" class=\"data row60 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row60_col5\" class=\"data row60 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row61\" class=\"row_heading level0 row61\" >windows_modify_registry_qakbot_binary_data_registry.yml</th>\n",
|
||
" <td id=\"T_9f55b_row61_col0\" class=\"data row61 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row61_col1\" class=\"data row61 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row61_col2\" class=\"data row61 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row61_col3\" class=\"data row61 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row61_col4\" class=\"data row61 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row61_col5\" class=\"data row61 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row62\" class=\"row_heading level0 row62\" >nltest_domain_trust_discovery.yml</th>\n",
|
||
" <td id=\"T_9f55b_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row62_col1\" class=\"data row62 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row62_col2\" class=\"data row62 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row62_col3\" class=\"data row62 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row62_col4\" class=\"data row62 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row62_col5\" class=\"data row62 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row63\" class=\"row_heading level0 row63\" >windows_modify_registry_suppress_win_defender_notif.yml</th>\n",
|
||
" <td id=\"T_9f55b_row63_col0\" class=\"data row63 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row63_col1\" class=\"data row63 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row63_col2\" class=\"data row63 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row63_col3\" class=\"data row63 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row63_col4\" class=\"data row63 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row63_col5\" class=\"data row63 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row64\" class=\"row_heading level0 row64\" >process_creating_lnk_file_in_suspicious_location.yml</th>\n",
|
||
" <td id=\"T_9f55b_row64_col0\" class=\"data row64 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row64_col1\" class=\"data row64 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row64_col2\" class=\"data row64 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row64_col3\" class=\"data row64 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row64_col4\" class=\"data row64 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row64_col5\" class=\"data row64 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row65\" class=\"row_heading level0 row65\" >office_application_drop_executable.yml</th>\n",
|
||
" <td id=\"T_9f55b_row65_col0\" class=\"data row65 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row65_col1\" class=\"data row65 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row65_col2\" class=\"data row65 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row65_col3\" class=\"data row65 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row65_col4\" class=\"data row65 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row65_col5\" class=\"data row65 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row66\" class=\"row_heading level0 row66\" >allow_inbound_traffic_by_firewall_rule_registry.yml</th>\n",
|
||
" <td id=\"T_9f55b_row66_col0\" class=\"data row66 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row66_col1\" class=\"data row66 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row66_col2\" class=\"data row66 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row66_col3\" class=\"data row66 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row66_col4\" class=\"data row66 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row66_col5\" class=\"data row66 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row67\" class=\"row_heading level0 row67\" >disable_defender_enhanced_notification.yml</th>\n",
|
||
" <td id=\"T_9f55b_row67_col0\" class=\"data row67 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row67_col1\" class=\"data row67 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row67_col2\" class=\"data row67 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row67_col3\" class=\"data row67 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row67_col4\" class=\"data row67 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row67_col5\" class=\"data row67 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row68\" class=\"row_heading level0 row68\" >powershell_remote_thread_to_known_windows_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row68_col0\" class=\"data row68 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row68_col1\" class=\"data row68 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row68_col2\" class=\"data row68 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row68_col3\" class=\"data row68 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row68_col4\" class=\"data row68 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row68_col5\" class=\"data row68 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row69\" class=\"row_heading level0 row69\" >windows_process_injection_of_wermgr_to_known_browser.yml</th>\n",
|
||
" <td id=\"T_9f55b_row69_col0\" class=\"data row69 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row69_col1\" class=\"data row69 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row69_col2\" class=\"data row69 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row69_col3\" class=\"data row69 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row69_col4\" class=\"data row69 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row69_col5\" class=\"data row69 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row70\" class=\"row_heading level0 row70\" >windows_multi_hop_proxy_tor_website_query.yml</th>\n",
|
||
" <td id=\"T_9f55b_row70_col0\" class=\"data row70 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row70_col1\" class=\"data row70 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row70_col2\" class=\"data row70 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row70_col3\" class=\"data row70 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row70_col4\" class=\"data row70 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row70_col5\" class=\"data row70 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row71\" class=\"row_heading level0 row71\" >system_info_gathering_using_dxdiag_application.yml</th>\n",
|
||
" <td id=\"T_9f55b_row71_col0\" class=\"data row71 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row71_col1\" class=\"data row71 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row71_col2\" class=\"data row71 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row71_col3\" class=\"data row71 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row71_col4\" class=\"data row71 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row71_col5\" class=\"data row71 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row72\" class=\"row_heading level0 row72\" >windows_mail_protocol_in_non_common_process_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row72_col0\" class=\"data row72 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row72_col1\" class=\"data row72 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row72_col2\" class=\"data row72 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row72_col3\" class=\"data row72 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row72_col4\" class=\"data row72 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row72_col5\" class=\"data row72 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row73\" class=\"row_heading level0 row73\" >winevent_windows_task_scheduler_event_action_started.yml</th>\n",
|
||
" <td id=\"T_9f55b_row73_col0\" class=\"data row73 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row73_col1\" class=\"data row73 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row73_col2\" class=\"data row73 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row73_col3\" class=\"data row73 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row73_col4\" class=\"data row73 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row73_col5\" class=\"data row73 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row74\" class=\"row_heading level0 row74\" >regsvr32_silent_and_install_param_dll_loading.yml</th>\n",
|
||
" <td id=\"T_9f55b_row74_col0\" class=\"data row74 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row74_col1\" class=\"data row74 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row74_col2\" class=\"data row74 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row74_col3\" class=\"data row74 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row74_col4\" class=\"data row74 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row74_col5\" class=\"data row74 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row75\" class=\"row_heading level0 row75\" >network_connection_discovery_net.yml</th>\n",
|
||
" <td id=\"T_9f55b_row75_col0\" class=\"data row75 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row75_col1\" class=\"data row75 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row75_col2\" class=\"data row75 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row75_col3\" class=\"data row75 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row75_col4\" class=\"data row75 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row75_col5\" class=\"data row75 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row76\" class=\"row_heading level0 row76\" >windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml</th>\n",
|
||
" <td id=\"T_9f55b_row76_col0\" class=\"data row76 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row76_col1\" class=\"data row76 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row76_col2\" class=\"data row76 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row76_col3\" class=\"data row76 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row76_col4\" class=\"data row76 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row76_col5\" class=\"data row76 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row77\" class=\"row_heading level0 row77\" >sc_exe_manipulating_windows_services.yml</th>\n",
|
||
" <td id=\"T_9f55b_row77_col0\" class=\"data row77 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row77_col1\" class=\"data row77 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row77_col2\" class=\"data row77 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row77_col3\" class=\"data row77 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row77_col4\" class=\"data row77 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row77_col5\" class=\"data row77 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row78\" class=\"row_heading level0 row78\" >disable_windows_behavior_monitoring.yml</th>\n",
|
||
" <td id=\"T_9f55b_row78_col0\" class=\"data row78 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row78_col1\" class=\"data row78 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row78_col2\" class=\"data row78 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row78_col3\" class=\"data row78 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row78_col4\" class=\"data row78 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row78_col5\" class=\"data row78 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row79\" class=\"row_heading level0 row79\" >create_remote_thread_in_shell_application.yml</th>\n",
|
||
" <td id=\"T_9f55b_row79_col0\" class=\"data row79 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row79_col1\" class=\"data row79 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row79_col2\" class=\"data row79 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row79_col3\" class=\"data row79 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row79_col4\" class=\"data row79 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row79_col5\" class=\"data row79 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row80\" class=\"row_heading level0 row80\" >network_connection_discovery_arp.yml</th>\n",
|
||
" <td id=\"T_9f55b_row80_col0\" class=\"data row80 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row80_col1\" class=\"data row80 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row80_col2\" class=\"data row80 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row80_col3\" class=\"data row80 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row80_col4\" class=\"data row80 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row80_col5\" class=\"data row80 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row81\" class=\"row_heading level0 row81\" >schtasks_run_task_on_demand.yml</th>\n",
|
||
" <td id=\"T_9f55b_row81_col0\" class=\"data row81 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row81_col1\" class=\"data row81 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row81_col2\" class=\"data row81 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row81_col3\" class=\"data row81 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row81_col4\" class=\"data row81 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row81_col5\" class=\"data row81 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row82\" class=\"row_heading level0 row82\" >windows_masquerading_explorer_as_child_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row82_col0\" class=\"data row82 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row82_col1\" class=\"data row82 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row82_col2\" class=\"data row82 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row82_col3\" class=\"data row82 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row82_col4\" class=\"data row82 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row82_col5\" class=\"data row82 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row83\" class=\"row_heading level0 row83\" >windows_wmi_process_call_create.yml</th>\n",
|
||
" <td id=\"T_9f55b_row83_col0\" class=\"data row83 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row83_col1\" class=\"data row83 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row83_col2\" class=\"data row83 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row83_col3\" class=\"data row83 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row83_col4\" class=\"data row83 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row83_col5\" class=\"data row83 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row84\" class=\"row_heading level0 row84\" >cmdline_tool_not_executed_in_cmd_shell.yml</th>\n",
|
||
" <td id=\"T_9f55b_row84_col0\" class=\"data row84 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row84_col1\" class=\"data row84 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row84_col2\" class=\"data row84 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row84_col3\" class=\"data row84 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row84_col4\" class=\"data row84 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row84_col5\" class=\"data row84 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row85\" class=\"row_heading level0 row85\" >windows_modify_registry_regedit_silent_reg_import.yml</th>\n",
|
||
" <td id=\"T_9f55b_row85_col0\" class=\"data row85 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row85_col1\" class=\"data row85 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row85_col2\" class=\"data row85 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row85_col3\" class=\"data row85 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row85_col4\" class=\"data row85 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row85_col5\" class=\"data row85 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row86\" class=\"row_heading level0 row86\" >windows_file_transfer_protocol_in_non_common_process_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row86_col0\" class=\"data row86 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row86_col1\" class=\"data row86 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row86_col2\" class=\"data row86 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row86_col3\" class=\"data row86 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row86_col4\" class=\"data row86 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row86_col5\" class=\"data row86 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row87\" class=\"row_heading level0 row87\" >network_connection_discovery_netstat.yml</th>\n",
|
||
" <td id=\"T_9f55b_row87_col0\" class=\"data row87 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row87_col1\" class=\"data row87 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row87_col2\" class=\"data row87 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row87_col3\" class=\"data row87 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row87_col4\" class=\"data row87 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row87_col5\" class=\"data row87 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row88\" class=\"row_heading level0 row88\" >windows_remote_services_rdp_enable.yml</th>\n",
|
||
" <td id=\"T_9f55b_row88_col0\" class=\"data row88 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row88_col1\" class=\"data row88 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row88_col2\" class=\"data row88 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row88_col3\" class=\"data row88 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row88_col4\" class=\"data row88 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row88_col5\" class=\"data row88 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row89\" class=\"row_heading level0 row89\" >suspicious_wav_file_in_appdata_folder.yml</th>\n",
|
||
" <td id=\"T_9f55b_row89_col0\" class=\"data row89 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row89_col1\" class=\"data row89 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row89_col2\" class=\"data row89 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row89_col3\" class=\"data row89 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row89_col4\" class=\"data row89 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row89_col5\" class=\"data row89 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row90\" class=\"row_heading level0 row90\" >allow_operation_with_consent_admin.yml</th>\n",
|
||
" <td id=\"T_9f55b_row90_col0\" class=\"data row90 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row90_col1\" class=\"data row90 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row90_col2\" class=\"data row90 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row90_col3\" class=\"data row90 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row90_col4\" class=\"data row90 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row90_col5\" class=\"data row90 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row91\" class=\"row_heading level0 row91\" >windows_remote_services_allow_rdp_in_firewall.yml</th>\n",
|
||
" <td id=\"T_9f55b_row91_col0\" class=\"data row91 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row91_col1\" class=\"data row91 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row91_col2\" class=\"data row91 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row91_col3\" class=\"data row91 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row91_col4\" class=\"data row91 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row91_col5\" class=\"data row91 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row92\" class=\"row_heading level0 row92\" >suspicious_process_dns_query_known_abuse_web_services.yml</th>\n",
|
||
" <td id=\"T_9f55b_row92_col0\" class=\"data row92 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row92_col1\" class=\"data row92 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row92_col2\" class=\"data row92 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row92_col3\" class=\"data row92 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row92_col4\" class=\"data row92 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row92_col5\" class=\"data row92 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row93\" class=\"row_heading level0 row93\" >icacls_deny_command.yml</th>\n",
|
||
" <td id=\"T_9f55b_row93_col0\" class=\"data row93 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row93_col1\" class=\"data row93 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row93_col2\" class=\"data row93 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row93_col3\" class=\"data row93 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row93_col4\" class=\"data row93 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row93_col5\" class=\"data row93 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row94\" class=\"row_heading level0 row94\" >processes_launching_netsh.yml</th>\n",
|
||
" <td id=\"T_9f55b_row94_col0\" class=\"data row94 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row94_col1\" class=\"data row94 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row94_col2\" class=\"data row94 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row94_col3\" class=\"data row94 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row94_col4\" class=\"data row94 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row94_col5\" class=\"data row94 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row95\" class=\"row_heading level0 row95\" >wermgr_process_connecting_to_ip_check_web_services.yml</th>\n",
|
||
" <td id=\"T_9f55b_row95_col0\" class=\"data row95 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row95_col1\" class=\"data row95 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row95_col2\" class=\"data row95 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row95_col3\" class=\"data row95 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row95_col4\" class=\"data row95 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row95_col5\" class=\"data row95 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row96\" class=\"row_heading level0 row96\" >hide_user_account_from_sign_in_screen.yml</th>\n",
|
||
" <td id=\"T_9f55b_row96_col0\" class=\"data row96 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row96_col1\" class=\"data row96 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row96_col2\" class=\"data row96 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row96_col3\" class=\"data row96 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row96_col4\" class=\"data row96 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row96_col5\" class=\"data row96 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row97\" class=\"row_heading level0 row97\" >remcos_rat_file_creation_in_remcos_folder.yml</th>\n",
|
||
" <td id=\"T_9f55b_row97_col0\" class=\"data row97 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row97_col1\" class=\"data row97 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row97_col2\" class=\"data row97 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row97_col3\" class=\"data row97 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row97_col4\" class=\"data row97 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row97_col5\" class=\"data row97 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row98\" class=\"row_heading level0 row98\" >windows_impair_defense_add_xml_applocker_rules.yml</th>\n",
|
||
" <td id=\"T_9f55b_row98_col0\" class=\"data row98 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row98_col1\" class=\"data row98 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row98_col2\" class=\"data row98 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row98_col3\" class=\"data row98 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row98_col4\" class=\"data row98 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row98_col5\" class=\"data row98 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row99\" class=\"row_heading level0 row99\" >windows_system_discovery_using_qwinsta.yml</th>\n",
|
||
" <td id=\"T_9f55b_row99_col0\" class=\"data row99 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row99_col1\" class=\"data row99 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row99_col2\" class=\"data row99 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row99_col3\" class=\"data row99 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row99_col4\" class=\"data row99 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row99_col5\" class=\"data row99 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row100\" class=\"row_heading level0 row100\" >wermgr_process_create_executable_file.yml</th>\n",
|
||
" <td id=\"T_9f55b_row100_col0\" class=\"data row100 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row100_col1\" class=\"data row100 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row100_col2\" class=\"data row100 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row100_col3\" class=\"data row100 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row100_col4\" class=\"data row100 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row100_col5\" class=\"data row100 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row101\" class=\"row_heading level0 row101\" >system_user_discovery_with_whoami.yml</th>\n",
|
||
" <td id=\"T_9f55b_row101_col0\" class=\"data row101 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row101_col1\" class=\"data row101 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row101_col2\" class=\"data row101 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row101_col3\" class=\"data row101 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row101_col4\" class=\"data row101 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row101_col5\" class=\"data row101 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row102\" class=\"row_heading level0 row102\" >windows_remote_services_allow_remote_assistance.yml</th>\n",
|
||
" <td id=\"T_9f55b_row102_col0\" class=\"data row102 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row102_col1\" class=\"data row102 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row102_col2\" class=\"data row102 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row102_col3\" class=\"data row102 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row102_col4\" class=\"data row102 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row102_col5\" class=\"data row102 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row103\" class=\"row_heading level0 row103\" >windows_remote_access_software_rms_registry.yml</th>\n",
|
||
" <td id=\"T_9f55b_row103_col0\" class=\"data row103 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row103_col1\" class=\"data row103 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row103_col2\" class=\"data row103 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row103_col3\" class=\"data row103 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row103_col4\" class=\"data row103 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row103_col5\" class=\"data row103 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row104\" class=\"row_heading level0 row104\" >windows_process_injection_remote_thread.yml</th>\n",
|
||
" <td id=\"T_9f55b_row104_col0\" class=\"data row104 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row104_col1\" class=\"data row104 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row104_col2\" class=\"data row104 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row104_col3\" class=\"data row104 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row104_col4\" class=\"data row104 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row104_col5\" class=\"data row104 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row105\" class=\"row_heading level0 row105\" >excessive_attempt_to_disable_services.yml</th>\n",
|
||
" <td id=\"T_9f55b_row105_col0\" class=\"data row105 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row105_col1\" class=\"data row105 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row105_col2\" class=\"data row105 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row105_col3\" class=\"data row105 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row105_col4\" class=\"data row105 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row105_col5\" class=\"data row105 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row106\" class=\"row_heading level0 row106\" >windows_remote_service_rdpwinst_tool_execution.yml</th>\n",
|
||
" <td id=\"T_9f55b_row106_col0\" class=\"data row106 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row106_col1\" class=\"data row106 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row106_col2\" class=\"data row106 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row106_col3\" class=\"data row106 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row106_col4\" class=\"data row106 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row106_col5\" class=\"data row106 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row107\" class=\"row_heading level0 row107\" >excessive_usage_of_cacls_app.yml</th>\n",
|
||
" <td id=\"T_9f55b_row107_col0\" class=\"data row107 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row107_col1\" class=\"data row107 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row107_col2\" class=\"data row107 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row107_col3\" class=\"data row107 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row107_col4\" class=\"data row107 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row107_col5\" class=\"data row107 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row108\" class=\"row_heading level0 row108\" >loading_of_dynwrapx_module.yml</th>\n",
|
||
" <td id=\"T_9f55b_row108_col0\" class=\"data row108 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row108_col1\" class=\"data row108 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row108_col2\" class=\"data row108 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row108_col3\" class=\"data row108 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row108_col4\" class=\"data row108 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row108_col5\" class=\"data row108 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row109\" class=\"row_heading level0 row109\" >possible_browser_pass_view_parameter.yml</th>\n",
|
||
" <td id=\"T_9f55b_row109_col0\" class=\"data row109 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row109_col1\" class=\"data row109 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row109_col2\" class=\"data row109 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row109_col3\" class=\"data row109 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row109_col4\" class=\"data row109 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row109_col5\" class=\"data row109 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row110\" class=\"row_heading level0 row110\" >excessive_usage_of_net_app.yml</th>\n",
|
||
" <td id=\"T_9f55b_row110_col0\" class=\"data row110 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row110_col1\" class=\"data row110 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row110_col2\" class=\"data row110 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row110_col3\" class=\"data row110 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row110_col4\" class=\"data row110 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row110_col5\" class=\"data row110 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row111\" class=\"row_heading level0 row111\" >windows_process_injection_wermgr_child_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row111_col0\" class=\"data row111 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row111_col1\" class=\"data row111 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row111_col2\" class=\"data row111 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row111_col3\" class=\"data row111 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row111_col4\" class=\"data row111 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row111_col5\" class=\"data row111 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row112\" class=\"row_heading level0 row112\" >vbscript_execution_using_wscript_app.yml</th>\n",
|
||
" <td id=\"T_9f55b_row112_col0\" class=\"data row112 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row112_col1\" class=\"data row112 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row112_col2\" class=\"data row112 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row112_col3\" class=\"data row112 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row112_col4\" class=\"data row112 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row112_col5\" class=\"data row112 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row113\" class=\"row_heading level0 row113\" >office_product_spawning_mshta.yml</th>\n",
|
||
" <td id=\"T_9f55b_row113_col0\" class=\"data row113 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row113_col1\" class=\"data row113 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row113_col2\" class=\"data row113 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row113_col3\" class=\"data row113 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row113_col4\" class=\"data row113 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row113_col5\" class=\"data row113 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row114\" class=\"row_heading level0 row114\" >windows_disableantispyware_reg.yml</th>\n",
|
||
" <td id=\"T_9f55b_row114_col0\" class=\"data row114 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row114_col1\" class=\"data row114 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row114_col2\" class=\"data row114 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row114_col3\" class=\"data row114 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row114_col4\" class=\"data row114 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row114_col5\" class=\"data row114 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row115\" class=\"row_heading level0 row115\" >suspicious_driver_loaded_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row115_col0\" class=\"data row115 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row115_col1\" class=\"data row115 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row115_col2\" class=\"data row115 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row115_col3\" class=\"data row115 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row115_col4\" class=\"data row115 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row115_col5\" class=\"data row115 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row116\" class=\"row_heading level0 row116\" >system_processes_run_from_unexpected_locations.yml</th>\n",
|
||
" <td id=\"T_9f55b_row116_col0\" class=\"data row116 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row116_col1\" class=\"data row116 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row116_col2\" class=\"data row116 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row116_col3\" class=\"data row116 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row116_col4\" class=\"data row116 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row116_col5\" class=\"data row116 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row117\" class=\"row_heading level0 row117\" >trickbot_named_pipe.yml</th>\n",
|
||
" <td id=\"T_9f55b_row117_col0\" class=\"data row117 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row117_col1\" class=\"data row117 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row117_col2\" class=\"data row117 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row117_col3\" class=\"data row117 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row117_col4\" class=\"data row117 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row117_col5\" class=\"data row117 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row118\" class=\"row_heading level0 row118\" >windows_service_created_with_suspicious_service_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row118_col0\" class=\"data row118 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row118_col1\" class=\"data row118 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row118_col2\" class=\"data row118 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row118_col3\" class=\"data row118 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row118_col4\" class=\"data row118 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row118_col5\" class=\"data row118 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row119\" class=\"row_heading level0 row119\" >windows_system_discovery_using_ldap_nslookup.yml</th>\n",
|
||
" <td id=\"T_9f55b_row119_col0\" class=\"data row119 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row119_col1\" class=\"data row119 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row119_col2\" class=\"data row119 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row119_col3\" class=\"data row119 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row119_col4\" class=\"data row119 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row119_col5\" class=\"data row119 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row120\" class=\"row_heading level0 row120\" >windows_app_layer_protocol_qakbot_namedpipe.yml</th>\n",
|
||
" <td id=\"T_9f55b_row120_col0\" class=\"data row120 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row120_col1\" class=\"data row120 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row120_col2\" class=\"data row120 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row120_col3\" class=\"data row120 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row120_col4\" class=\"data row120 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row120_col5\" class=\"data row120 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row121\" class=\"row_heading level0 row121\" >recon_using_wmi_class.yml</th>\n",
|
||
" <td id=\"T_9f55b_row121_col0\" class=\"data row121 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row121_col1\" class=\"data row121 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row121_col2\" class=\"data row121 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row121_col3\" class=\"data row121 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row121_col4\" class=\"data row121 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row121_col5\" class=\"data row121 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row122\" class=\"row_heading level0 row122\" >firewall_allowed_program_enable.yml</th>\n",
|
||
" <td id=\"T_9f55b_row122_col0\" class=\"data row122 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row122_col1\" class=\"data row122 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row122_col2\" class=\"data row122 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row122_col3\" class=\"data row122 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row122_col4\" class=\"data row122 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row122_col5\" class=\"data row122 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row123\" class=\"row_heading level0 row123\" >windows_command_shell_fetch_env_variables.yml</th>\n",
|
||
" <td id=\"T_9f55b_row123_col0\" class=\"data row123 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row123_col1\" class=\"data row123 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row123_col2\" class=\"data row123 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row123_col3\" class=\"data row123 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row123_col4\" class=\"data row123 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row123_col5\" class=\"data row123 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row124\" class=\"row_heading level0 row124\" >process_deleting_its_process_file_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row124_col0\" class=\"data row124 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row124_col1\" class=\"data row124 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row124_col2\" class=\"data row124 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row124_col3\" class=\"data row124 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row124_col4\" class=\"data row124 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row124_col5\" class=\"data row124 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row125\" class=\"row_heading level0 row125\" >network_discovery_using_route_windows_app.yml</th>\n",
|
||
" <td id=\"T_9f55b_row125_col0\" class=\"data row125 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row125_col1\" class=\"data row125 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row125_col2\" class=\"data row125 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row125_col3\" class=\"data row125 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row125_col4\" class=\"data row125 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row125_col5\" class=\"data row125 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row126\" class=\"row_heading level0 row126\" >office_product_spawning_windows_script_host.yml</th>\n",
|
||
" <td id=\"T_9f55b_row126_col0\" class=\"data row126 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row126_col1\" class=\"data row126 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row126_col2\" class=\"data row126 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row126_col3\" class=\"data row126 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row126_col4\" class=\"data row126 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row126_col5\" class=\"data row126 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row127\" class=\"row_heading level0 row127\" >create_local_admin_accounts_using_net_exe.yml</th>\n",
|
||
" <td id=\"T_9f55b_row127_col0\" class=\"data row127 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row127_col1\" class=\"data row127 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row127_col2\" class=\"data row127 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row127_col3\" class=\"data row127 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row127_col4\" class=\"data row127 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row127_col5\" class=\"data row127 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row128\" class=\"row_heading level0 row128\" >suspicious_image_creation_in_appdata_folder.yml</th>\n",
|
||
" <td id=\"T_9f55b_row128_col0\" class=\"data row128 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row128_col1\" class=\"data row128 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row128_col2\" class=\"data row128 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row128_col3\" class=\"data row128 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row128_col4\" class=\"data row128 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row128_col5\" class=\"data row128 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row129\" class=\"row_heading level0 row129\" >cobalt_strike_named_pipes.yml</th>\n",
|
||
" <td id=\"T_9f55b_row129_col0\" class=\"data row129 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row129_col1\" class=\"data row129 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row129_col2\" class=\"data row129 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row129_col3\" class=\"data row129 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row129_col4\" class=\"data row129 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row129_col5\" class=\"data row129 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row130\" class=\"row_heading level0 row130\" >windows_dll_side_loading_in_calc.yml</th>\n",
|
||
" <td id=\"T_9f55b_row130_col0\" class=\"data row130 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row130_col1\" class=\"data row130 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row130_col2\" class=\"data row130 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row130_col3\" class=\"data row130 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row130_col4\" class=\"data row130 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row130_col5\" class=\"data row130 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row131\" class=\"row_heading level0 row131\" >remcos_client_registry_install_entry.yml</th>\n",
|
||
" <td id=\"T_9f55b_row131_col0\" class=\"data row131 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row131_col1\" class=\"data row131 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row131_col2\" class=\"data row131 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row131_col3\" class=\"data row131 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row131_col4\" class=\"data row131 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row131_col5\" class=\"data row131 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row132\" class=\"row_heading level0 row132\" >powershell_loading_dotnet_into_memory_via_reflection.yml</th>\n",
|
||
" <td id=\"T_9f55b_row132_col0\" class=\"data row132 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row132_col1\" class=\"data row132 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row132_col2\" class=\"data row132 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row132_col3\" class=\"data row132 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row132_col4\" class=\"data row132 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row132_col5\" class=\"data row132 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row133\" class=\"row_heading level0 row133\" >suspicious_scheduled_task_from_public_directory.yml</th>\n",
|
||
" <td id=\"T_9f55b_row133_col0\" class=\"data row133 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row133_col1\" class=\"data row133 col1\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row133_col2\" class=\"data row133 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row133_col3\" class=\"data row133 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row133_col4\" class=\"data row133 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row133_col5\" class=\"data row133 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row134\" class=\"row_heading level0 row134\" >recon_avproduct_through_pwh_or_wmi.yml</th>\n",
|
||
" <td id=\"T_9f55b_row134_col0\" class=\"data row134 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row134_col1\" class=\"data row134 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row134_col2\" class=\"data row134 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row134_col3\" class=\"data row134 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row134_col4\" class=\"data row134 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row134_col5\" class=\"data row134 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row135\" class=\"row_heading level0 row135\" >suspicious_regsvr32_register_suspicious_path.yml</th>\n",
|
||
" <td id=\"T_9f55b_row135_col0\" class=\"data row135 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row135_col1\" class=\"data row135 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row135_col2\" class=\"data row135 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row135_col3\" class=\"data row135 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row135_col4\" class=\"data row135 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row135_col5\" class=\"data row135 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row136\" class=\"row_heading level0 row136\" >windows_drivers_loaded_by_signature.yml</th>\n",
|
||
" <td id=\"T_9f55b_row136_col0\" class=\"data row136 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row136_col1\" class=\"data row136 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row136_col2\" class=\"data row136 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row136_col3\" class=\"data row136 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row136_col4\" class=\"data row136 col4\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row136_col5\" class=\"data row136 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row137\" class=\"row_heading level0 row137\" >malicious_powershell_process___encoded_command.yml</th>\n",
|
||
" <td id=\"T_9f55b_row137_col0\" class=\"data row137 col0\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row137_col1\" class=\"data row137 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row137_col2\" class=\"data row137 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row137_col3\" class=\"data row137 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row137_col4\" class=\"data row137 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row137_col5\" class=\"data row137 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row138\" class=\"row_heading level0 row138\" >mshta_spawning_rundll32_or_regsvr32_process.yml</th>\n",
|
||
" <td id=\"T_9f55b_row138_col0\" class=\"data row138 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row138_col1\" class=\"data row138 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row138_col2\" class=\"data row138 col2\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row138_col3\" class=\"data row138 col3\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row138_col4\" class=\"data row138 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row138_col5\" class=\"data row138 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_9f55b_level0_row139\" class=\"row_heading level0 row139\" >malicious_inprocserver32_modification.yml</th>\n",
|
||
" <td id=\"T_9f55b_row139_col0\" class=\"data row139 col0\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row139_col1\" class=\"data row139 col1\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row139_col2\" class=\"data row139 col2\" >yes</td>\n",
|
||
" <td id=\"T_9f55b_row139_col3\" class=\"data row139 col3\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row139_col4\" class=\"data row139 col4\" >no</td>\n",
|
||
" <td id=\"T_9f55b_row139_col5\" class=\"data row139 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c220b50>"
|
||
]
|
||
},
|
||
"execution_count": 35,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"def yes_no_table(dict_data, story_name_list):\n",
|
||
" det_by_analytics = defaultdict(list)\n",
|
||
"\n",
|
||
" for k, v in dict_data.items():\n",
|
||
" found_list = []\n",
|
||
" det_ctr = 0\n",
|
||
" for st in story_name_list:\n",
|
||
" if st in v:\n",
|
||
" found_list.append(\"yes\")\n",
|
||
" det_by_analytics[k].append(\"yes\")\n",
|
||
" det_ctr += 1\n",
|
||
" else:\n",
|
||
" found_list.append(\"no\")\n",
|
||
" det_by_analytics[k].append(\"no\")\n",
|
||
" det_by_analytics[k].append(det_ctr)\n",
|
||
"\n",
|
||
" return det_by_analytics\n",
|
||
"\n",
|
||
"def highlight_rows(x):\n",
|
||
" if x.total_coverage == 1:\n",
|
||
" return['background-color: lightgray'] * 6\n",
|
||
" elif x.total_coverage == 2:\n",
|
||
" return['background-color: lightblue'] * 6\n",
|
||
" elif x.total_coverage == 3:\n",
|
||
" return['background-color: lightgreen'] * 6 \n",
|
||
" elif x.total_coverage == 4:\n",
|
||
" return['background-color: orange'] * 6 \n",
|
||
" elif x.total_coverage == 5:\n",
|
||
" return['background-color: yellow'] * 6 \n",
|
||
"story_name_list = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]\n",
|
||
"det_by_analytics = yes_no_table(mitre_attack_id_info_dict, story_name_list)\n",
|
||
"tdf = pd.DataFrame.from_dict(det_by_analytics, orient=\"index\")\n",
|
||
"tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n",
|
||
"tdf.style.apply(highlight_rows, axis=1)\n"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "74485c0e-d4c0-4f26-9e7f-f13a2a9b6b98",
|
||
"metadata": {},
|
||
"source": [
|
||
"### breakdown of detection coverage for 5 malware family or story"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 36,
|
||
"id": "8d075f5c-818b-4fd6-8fdb-d6a3e75cbfb4",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(4, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_e51f9_row0_col0, #T_e51f9_row0_col1, #T_e51f9_row0_col2, #T_e51f9_row0_col3, #T_e51f9_row0_col4, #T_e51f9_row0_col5, #T_e51f9_row1_col0, #T_e51f9_row1_col1, #T_e51f9_row1_col2, #T_e51f9_row1_col3, #T_e51f9_row1_col4, #T_e51f9_row1_col5, #T_e51f9_row2_col0, #T_e51f9_row2_col1, #T_e51f9_row2_col2, #T_e51f9_row2_col3, #T_e51f9_row2_col4, #T_e51f9_row2_col5, #T_e51f9_row3_col0, #T_e51f9_row3_col1, #T_e51f9_row3_col2, #T_e51f9_row3_col3, #T_e51f9_row3_col4, #T_e51f9_row3_col5 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_e51f9\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_e51f9_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_e51f9_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_e51f9_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_e51f9_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_e51f9_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_e51f9_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e51f9_level0_row0\" class=\"row_heading level0 row0\" >office_document_executing_macro_code.yml</th>\n",
|
||
" <td id=\"T_e51f9_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row0_col5\" class=\"data row0 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e51f9_level0_row1\" class=\"row_heading level0 row1\" >suspicious_process_file_path.yml</th>\n",
|
||
" <td id=\"T_e51f9_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row1_col5\" class=\"data row1 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e51f9_level0_row2\" class=\"row_heading level0 row2\" >executables_or_script_creation_in_suspicious_path.yml</th>\n",
|
||
" <td id=\"T_e51f9_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row2_col5\" class=\"data row2 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_e51f9_level0_row3\" class=\"row_heading level0 row3\" >office_product_spawn_cmd_process.yml</th>\n",
|
||
" <td id=\"T_e51f9_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_e51f9_row3_col5\" class=\"data row3 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c259a90>"
|
||
]
|
||
},
|
||
"execution_count": 36,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 5]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)\n"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 37,
|
||
"id": "7652ddc4-d9f8-4449-9f6a-d39900e9433f",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(3, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_48a2e_row0_col0, #T_48a2e_row0_col1, #T_48a2e_row0_col2, #T_48a2e_row0_col3, #T_48a2e_row0_col4, #T_48a2e_row0_col5, #T_48a2e_row1_col0, #T_48a2e_row1_col1, #T_48a2e_row1_col2, #T_48a2e_row1_col3, #T_48a2e_row1_col4, #T_48a2e_row1_col5, #T_48a2e_row2_col0, #T_48a2e_row2_col1, #T_48a2e_row2_col2, #T_48a2e_row2_col3, #T_48a2e_row2_col4, #T_48a2e_row2_col5 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_48a2e\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_48a2e_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_48a2e_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_48a2e_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_48a2e_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_48a2e_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_48a2e_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_48a2e_level0_row0\" class=\"row_heading level0 row0\" >windows_phishing_recent_iso_exec_registry.yml</th>\n",
|
||
" <td id=\"T_48a2e_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_48a2e_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row0_col5\" class=\"data row0 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_48a2e_level0_row1\" class=\"row_heading level0 row1\" >windows_iso_lnk_file_creation.yml</th>\n",
|
||
" <td id=\"T_48a2e_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_48a2e_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row1_col5\" class=\"data row1 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_48a2e_level0_row2\" class=\"row_heading level0 row2\" >scheduled_task_deleted_or_created_via_cmd.yml</th>\n",
|
||
" <td id=\"T_48a2e_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_48a2e_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_48a2e_row2_col5\" class=\"data row2 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c2598e0>"
|
||
]
|
||
},
|
||
"execution_count": 37,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 4]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 38,
|
||
"id": "48201916-b89c-4934-bbb4-b1d02ccd7de1",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(4, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_5650c_row0_col0, #T_5650c_row0_col1, #T_5650c_row0_col2, #T_5650c_row0_col3, #T_5650c_row0_col4, #T_5650c_row0_col5, #T_5650c_row1_col0, #T_5650c_row1_col1, #T_5650c_row1_col2, #T_5650c_row1_col3, #T_5650c_row1_col4, #T_5650c_row1_col5, #T_5650c_row2_col0, #T_5650c_row2_col1, #T_5650c_row2_col2, #T_5650c_row2_col3, #T_5650c_row2_col4, #T_5650c_row2_col5, #T_5650c_row3_col0, #T_5650c_row3_col1, #T_5650c_row3_col2, #T_5650c_row3_col3, #T_5650c_row3_col4, #T_5650c_row3_col5 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_5650c\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_5650c_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_5650c_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_5650c_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_5650c_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_5650c_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_5650c_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5650c_level0_row0\" class=\"row_heading level0 row0\" >registry_keys_used_for_persistence.yml</th>\n",
|
||
" <td id=\"T_5650c_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_5650c_row0_col4\" class=\"data row0 col4\" >no</td>\n",
|
||
" <td id=\"T_5650c_row0_col5\" class=\"data row0 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5650c_level0_row1\" class=\"row_heading level0 row1\" >non_firefox_process_access_firefox_profile_dir.yml</th>\n",
|
||
" <td id=\"T_5650c_row1_col0\" class=\"data row1 col0\" >no</td>\n",
|
||
" <td id=\"T_5650c_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_5650c_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row1_col5\" class=\"data row1 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5650c_level0_row2\" class=\"row_heading level0 row2\" >windows_defender_exclusion_registry_entry.yml</th>\n",
|
||
" <td id=\"T_5650c_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row2_col3\" class=\"data row2 col3\" >no</td>\n",
|
||
" <td id=\"T_5650c_row2_col4\" class=\"data row2 col4\" >no</td>\n",
|
||
" <td id=\"T_5650c_row2_col5\" class=\"data row2 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5650c_level0_row3\" class=\"row_heading level0 row3\" >disabling_remote_user_account_control.yml</th>\n",
|
||
" <td id=\"T_5650c_row3_col0\" class=\"data row3 col0\" >no</td>\n",
|
||
" <td id=\"T_5650c_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row3_col3\" class=\"data row3 col3\" >no</td>\n",
|
||
" <td id=\"T_5650c_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_5650c_row3_col5\" class=\"data row3 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c21af70>"
|
||
]
|
||
},
|
||
"execution_count": 38,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 3]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 39,
|
||
"id": "8ad5bd62-c881-4f72-8c84-c2f05729e271",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(11, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_eaa59_row0_col0, #T_eaa59_row0_col1, #T_eaa59_row0_col2, #T_eaa59_row0_col3, #T_eaa59_row0_col4, #T_eaa59_row0_col5, #T_eaa59_row1_col0, #T_eaa59_row1_col1, #T_eaa59_row1_col2, #T_eaa59_row1_col3, #T_eaa59_row1_col4, #T_eaa59_row1_col5, #T_eaa59_row2_col0, #T_eaa59_row2_col1, #T_eaa59_row2_col2, #T_eaa59_row2_col3, #T_eaa59_row2_col4, #T_eaa59_row2_col5, #T_eaa59_row3_col0, #T_eaa59_row3_col1, #T_eaa59_row3_col2, #T_eaa59_row3_col3, #T_eaa59_row3_col4, #T_eaa59_row3_col5, #T_eaa59_row4_col0, #T_eaa59_row4_col1, #T_eaa59_row4_col2, #T_eaa59_row4_col3, #T_eaa59_row4_col4, #T_eaa59_row4_col5, #T_eaa59_row5_col0, #T_eaa59_row5_col1, #T_eaa59_row5_col2, #T_eaa59_row5_col3, #T_eaa59_row5_col4, #T_eaa59_row5_col5, #T_eaa59_row6_col0, #T_eaa59_row6_col1, #T_eaa59_row6_col2, #T_eaa59_row6_col3, #T_eaa59_row6_col4, #T_eaa59_row6_col5, #T_eaa59_row7_col0, #T_eaa59_row7_col1, #T_eaa59_row7_col2, #T_eaa59_row7_col3, #T_eaa59_row7_col4, #T_eaa59_row7_col5, #T_eaa59_row8_col0, #T_eaa59_row8_col1, #T_eaa59_row8_col2, #T_eaa59_row8_col3, #T_eaa59_row8_col4, #T_eaa59_row8_col5, #T_eaa59_row9_col0, #T_eaa59_row9_col1, #T_eaa59_row9_col2, #T_eaa59_row9_col3, #T_eaa59_row9_col4, #T_eaa59_row9_col5, #T_eaa59_row10_col0, #T_eaa59_row10_col1, #T_eaa59_row10_col2, #T_eaa59_row10_col3, #T_eaa59_row10_col4, #T_eaa59_row10_col5 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_eaa59\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_eaa59_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_eaa59_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_eaa59_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_eaa59_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_eaa59_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_eaa59_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row0\" class=\"row_heading level0 row0\" >add_or_set_windows_defender_exclusion.yml</th>\n",
|
||
" <td id=\"T_eaa59_row0_col0\" class=\"data row0 col0\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row0_col1\" class=\"data row0 col1\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row0_col5\" class=\"data row0 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row1\" class=\"row_heading level0 row1\" >disable_defender_spynet_reporting.yml</th>\n",
|
||
" <td id=\"T_eaa59_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row1_col2\" class=\"data row1 col2\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row1_col4\" class=\"data row1 col4\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row1_col5\" class=\"data row1 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row2\" class=\"row_heading level0 row2\" >office_product_spawning_certutil.yml</th>\n",
|
||
" <td id=\"T_eaa59_row2_col0\" class=\"data row2 col0\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row2_col1\" class=\"data row2 col1\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row2_col5\" class=\"data row2 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row3\" class=\"row_heading level0 row3\" >excessive_usage_of_taskkill.yml</th>\n",
|
||
" <td id=\"T_eaa59_row3_col0\" class=\"data row3 col0\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row3_col3\" class=\"data row3 col3\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row3_col5\" class=\"data row3 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row4\" class=\"row_heading level0 row4\" >regsvr32_with_known_silent_switch_cmdline.yml</th>\n",
|
||
" <td id=\"T_eaa59_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row4_col1\" class=\"data row4 col1\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row4_col3\" class=\"data row4 col3\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row4_col4\" class=\"data row4 col4\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row4_col5\" class=\"data row4 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row5\" class=\"row_heading level0 row5\" >cmd_carry_out_string_command_parameter.yml</th>\n",
|
||
" <td id=\"T_eaa59_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row5_col2\" class=\"data row5 col2\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row5_col3\" class=\"data row5 col3\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row5_col5\" class=\"data row5 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row6\" class=\"row_heading level0 row6\" >office_application_spawn_rundll32_process.yml</th>\n",
|
||
" <td id=\"T_eaa59_row6_col0\" class=\"data row6 col0\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row6_col1\" class=\"data row6 col1\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row6_col2\" class=\"data row6 col2\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row6_col5\" class=\"data row6 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row7\" class=\"row_heading level0 row7\" >powershell_windows_defender_exclusion_commands.yml</th>\n",
|
||
" <td id=\"T_eaa59_row7_col0\" class=\"data row7 col0\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row7_col1\" class=\"data row7 col1\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row7_col4\" class=\"data row7 col4\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row7_col5\" class=\"data row7 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row8\" class=\"row_heading level0 row8\" >attempt_to_stop_security_service.yml</th>\n",
|
||
" <td id=\"T_eaa59_row8_col0\" class=\"data row8 col0\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row8_col2\" class=\"data row8 col2\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row8_col3\" class=\"data row8 col3\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row8_col4\" class=\"data row8 col4\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row8_col5\" class=\"data row8 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row9\" class=\"row_heading level0 row9\" >wermgr_process_spawned_cmd_or_powershell_process.yml</th>\n",
|
||
" <td id=\"T_eaa59_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row9_col1\" class=\"data row9 col1\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row9_col2\" class=\"data row9 col2\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row9_col3\" class=\"data row9 col3\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row9_col5\" class=\"data row9 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_eaa59_level0_row10\" class=\"row_heading level0 row10\" >non_chrome_process_accessing_chrome_default_dir.yml</th>\n",
|
||
" <td id=\"T_eaa59_row10_col0\" class=\"data row10 col0\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row10_col1\" class=\"data row10 col1\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row10_col3\" class=\"data row10 col3\" >no</td>\n",
|
||
" <td id=\"T_eaa59_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
|
||
" <td id=\"T_eaa59_row10_col5\" class=\"data row10 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c2207f0>"
|
||
]
|
||
},
|
||
"execution_count": 39,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 2]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 40,
|
||
"id": "24dec7b8-375d-40cb-9b57-84d44921b1e3",
|
||
"metadata": {
|
||
"tags": []
|
||
},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(118, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_3deed_row0_col0, #T_3deed_row0_col1, #T_3deed_row0_col2, #T_3deed_row0_col3, #T_3deed_row0_col4, #T_3deed_row0_col5, #T_3deed_row1_col0, #T_3deed_row1_col1, #T_3deed_row1_col2, #T_3deed_row1_col3, #T_3deed_row1_col4, #T_3deed_row1_col5, #T_3deed_row2_col0, #T_3deed_row2_col1, #T_3deed_row2_col2, #T_3deed_row2_col3, #T_3deed_row2_col4, #T_3deed_row2_col5, #T_3deed_row3_col0, #T_3deed_row3_col1, #T_3deed_row3_col2, #T_3deed_row3_col3, #T_3deed_row3_col4, #T_3deed_row3_col5, #T_3deed_row4_col0, #T_3deed_row4_col1, #T_3deed_row4_col2, #T_3deed_row4_col3, #T_3deed_row4_col4, #T_3deed_row4_col5, #T_3deed_row5_col0, #T_3deed_row5_col1, #T_3deed_row5_col2, #T_3deed_row5_col3, #T_3deed_row5_col4, #T_3deed_row5_col5, #T_3deed_row6_col0, #T_3deed_row6_col1, #T_3deed_row6_col2, #T_3deed_row6_col3, #T_3deed_row6_col4, #T_3deed_row6_col5, #T_3deed_row7_col0, #T_3deed_row7_col1, #T_3deed_row7_col2, #T_3deed_row7_col3, #T_3deed_row7_col4, #T_3deed_row7_col5, #T_3deed_row8_col0, #T_3deed_row8_col1, #T_3deed_row8_col2, #T_3deed_row8_col3, #T_3deed_row8_col4, #T_3deed_row8_col5, #T_3deed_row9_col0, #T_3deed_row9_col1, #T_3deed_row9_col2, #T_3deed_row9_col3, #T_3deed_row9_col4, #T_3deed_row9_col5, #T_3deed_row10_col0, #T_3deed_row10_col1, #T_3deed_row10_col2, #T_3deed_row10_col3, #T_3deed_row10_col4, #T_3deed_row10_col5, #T_3deed_row11_col0, #T_3deed_row11_col1, #T_3deed_row11_col2, #T_3deed_row11_col3, #T_3deed_row11_col4, #T_3deed_row11_col5, #T_3deed_row12_col0, #T_3deed_row12_col1, #T_3deed_row12_col2, #T_3deed_row12_col3, #T_3deed_row12_col4, #T_3deed_row12_col5, #T_3deed_row13_col0, #T_3deed_row13_col1, #T_3deed_row13_col2, #T_3deed_row13_col3, #T_3deed_row13_col4, #T_3deed_row13_col5, #T_3deed_row14_col0, #T_3deed_row14_col1, #T_3deed_row14_col2, #T_3deed_row14_col3, #T_3deed_row14_col4, #T_3deed_row14_col5, #T_3deed_row15_col0, #T_3deed_row15_col1, #T_3deed_row15_col2, #T_3deed_row15_col3, #T_3deed_row15_col4, #T_3deed_row15_col5, #T_3deed_row16_col0, #T_3deed_row16_col1, #T_3deed_row16_col2, #T_3deed_row16_col3, #T_3deed_row16_col4, #T_3deed_row16_col5, #T_3deed_row17_col0, #T_3deed_row17_col1, #T_3deed_row17_col2, #T_3deed_row17_col3, #T_3deed_row17_col4, #T_3deed_row17_col5, #T_3deed_row18_col0, #T_3deed_row18_col1, #T_3deed_row18_col2, #T_3deed_row18_col3, #T_3deed_row18_col4, #T_3deed_row18_col5, #T_3deed_row19_col0, #T_3deed_row19_col1, #T_3deed_row19_col2, #T_3deed_row19_col3, #T_3deed_row19_col4, #T_3deed_row19_col5, #T_3deed_row20_col0, #T_3deed_row20_col1, #T_3deed_row20_col2, #T_3deed_row20_col3, #T_3deed_row20_col4, #T_3deed_row20_col5, #T_3deed_row21_col0, #T_3deed_row21_col1, #T_3deed_row21_col2, #T_3deed_row21_col3, #T_3deed_row21_col4, #T_3deed_row21_col5, #T_3deed_row22_col0, #T_3deed_row22_col1, #T_3deed_row22_col2, #T_3deed_row22_col3, #T_3deed_row22_col4, #T_3deed_row22_col5, #T_3deed_row23_col0, #T_3deed_row23_col1, #T_3deed_row23_col2, #T_3deed_row23_col3, #T_3deed_row23_col4, #T_3deed_row23_col5, #T_3deed_row24_col0, #T_3deed_row24_col1, #T_3deed_row24_col2, #T_3deed_row24_col3, #T_3deed_row24_col4, #T_3deed_row24_col5, #T_3deed_row25_col0, #T_3deed_row25_col1, #T_3deed_row25_col2, #T_3deed_row25_col3, #T_3deed_row25_col4, #T_3deed_row25_col5, #T_3deed_row26_col0, #T_3deed_row26_col1, #T_3deed_row26_col2, #T_3deed_row26_col3, #T_3deed_row26_col4, #T_3deed_row26_col5, #T_3deed_row27_col0, #T_3deed_row27_col1, #T_3deed_row27_col2, #T_3deed_row27_col3, #T_3deed_row27_col4, #T_3deed_row27_col5, #T_3deed_row28_col0, #T_3deed_row28_col1, #T_3deed_row28_col2, #T_3deed_row28_col3, #T_3deed_row28_col4, #T_3deed_row28_col5, #T_3deed_row29_col0, #T_3deed_row29_col1, #T_3deed_row29_col2, #T_3deed_row29_col3, #T_3deed_row29_col4, #T_3deed_row29_col5, #T_3deed_row30_col0, #T_3deed_row30_col1, #T_3deed_row30_col2, #T_3deed_row30_col3, #T_3deed_row30_col4, #T_3deed_row30_col5, #T_3deed_row31_col0, #T_3deed_row31_col1, #T_3deed_row31_col2, #T_3deed_row31_col3, #T_3deed_row31_col4, #T_3deed_row31_col5, #T_3deed_row32_col0, #T_3deed_row32_col1, #T_3deed_row32_col2, #T_3deed_row32_col3, #T_3deed_row32_col4, #T_3deed_row32_col5, #T_3deed_row33_col0, #T_3deed_row33_col1, #T_3deed_row33_col2, #T_3deed_row33_col3, #T_3deed_row33_col4, #T_3deed_row33_col5, #T_3deed_row34_col0, #T_3deed_row34_col1, #T_3deed_row34_col2, #T_3deed_row34_col3, #T_3deed_row34_col4, #T_3deed_row34_col5, #T_3deed_row35_col0, #T_3deed_row35_col1, #T_3deed_row35_col2, #T_3deed_row35_col3, #T_3deed_row35_col4, #T_3deed_row35_col5, #T_3deed_row36_col0, #T_3deed_row36_col1, #T_3deed_row36_col2, #T_3deed_row36_col3, #T_3deed_row36_col4, #T_3deed_row36_col5, #T_3deed_row37_col0, #T_3deed_row37_col1, #T_3deed_row37_col2, #T_3deed_row37_col3, #T_3deed_row37_col4, #T_3deed_row37_col5, #T_3deed_row38_col0, #T_3deed_row38_col1, #T_3deed_row38_col2, #T_3deed_row38_col3, #T_3deed_row38_col4, #T_3deed_row38_col5, #T_3deed_row39_col0, #T_3deed_row39_col1, #T_3deed_row39_col2, #T_3deed_row39_col3, #T_3deed_row39_col4, #T_3deed_row39_col5, #T_3deed_row40_col0, #T_3deed_row40_col1, #T_3deed_row40_col2, #T_3deed_row40_col3, #T_3deed_row40_col4, #T_3deed_row40_col5, #T_3deed_row41_col0, #T_3deed_row41_col1, #T_3deed_row41_col2, #T_3deed_row41_col3, #T_3deed_row41_col4, #T_3deed_row41_col5, #T_3deed_row42_col0, #T_3deed_row42_col1, #T_3deed_row42_col2, #T_3deed_row42_col3, #T_3deed_row42_col4, #T_3deed_row42_col5, #T_3deed_row43_col0, #T_3deed_row43_col1, #T_3deed_row43_col2, #T_3deed_row43_col3, #T_3deed_row43_col4, #T_3deed_row43_col5, #T_3deed_row44_col0, #T_3deed_row44_col1, #T_3deed_row44_col2, #T_3deed_row44_col3, #T_3deed_row44_col4, #T_3deed_row44_col5, #T_3deed_row45_col0, #T_3deed_row45_col1, #T_3deed_row45_col2, #T_3deed_row45_col3, #T_3deed_row45_col4, #T_3deed_row45_col5, #T_3deed_row46_col0, #T_3deed_row46_col1, #T_3deed_row46_col2, #T_3deed_row46_col3, #T_3deed_row46_col4, #T_3deed_row46_col5, #T_3deed_row47_col0, #T_3deed_row47_col1, #T_3deed_row47_col2, #T_3deed_row47_col3, #T_3deed_row47_col4, #T_3deed_row47_col5, #T_3deed_row48_col0, #T_3deed_row48_col1, #T_3deed_row48_col2, #T_3deed_row48_col3, #T_3deed_row48_col4, #T_3deed_row48_col5, #T_3deed_row49_col0, #T_3deed_row49_col1, #T_3deed_row49_col2, #T_3deed_row49_col3, #T_3deed_row49_col4, #T_3deed_row49_col5, #T_3deed_row50_col0, #T_3deed_row50_col1, #T_3deed_row50_col2, #T_3deed_row50_col3, #T_3deed_row50_col4, #T_3deed_row50_col5, #T_3deed_row51_col0, #T_3deed_row51_col1, #T_3deed_row51_col2, #T_3deed_row51_col3, #T_3deed_row51_col4, #T_3deed_row51_col5, #T_3deed_row52_col0, #T_3deed_row52_col1, #T_3deed_row52_col2, #T_3deed_row52_col3, #T_3deed_row52_col4, #T_3deed_row52_col5, #T_3deed_row53_col0, #T_3deed_row53_col1, #T_3deed_row53_col2, #T_3deed_row53_col3, #T_3deed_row53_col4, #T_3deed_row53_col5, #T_3deed_row54_col0, #T_3deed_row54_col1, #T_3deed_row54_col2, #T_3deed_row54_col3, #T_3deed_row54_col4, #T_3deed_row54_col5, #T_3deed_row55_col0, #T_3deed_row55_col1, #T_3deed_row55_col2, #T_3deed_row55_col3, #T_3deed_row55_col4, #T_3deed_row55_col5, #T_3deed_row56_col0, #T_3deed_row56_col1, #T_3deed_row56_col2, #T_3deed_row56_col3, #T_3deed_row56_col4, #T_3deed_row56_col5, #T_3deed_row57_col0, #T_3deed_row57_col1, #T_3deed_row57_col2, #T_3deed_row57_col3, #T_3deed_row57_col4, #T_3deed_row57_col5, #T_3deed_row58_col0, #T_3deed_row58_col1, #T_3deed_row58_col2, #T_3deed_row58_col3, #T_3deed_row58_col4, #T_3deed_row58_col5, #T_3deed_row59_col0, #T_3deed_row59_col1, #T_3deed_row59_col2, #T_3deed_row59_col3, #T_3deed_row59_col4, #T_3deed_row59_col5, #T_3deed_row60_col0, #T_3deed_row60_col1, #T_3deed_row60_col2, #T_3deed_row60_col3, #T_3deed_row60_col4, #T_3deed_row60_col5, #T_3deed_row61_col0, #T_3deed_row61_col1, #T_3deed_row61_col2, #T_3deed_row61_col3, #T_3deed_row61_col4, #T_3deed_row61_col5, #T_3deed_row62_col0, #T_3deed_row62_col1, #T_3deed_row62_col2, #T_3deed_row62_col3, #T_3deed_row62_col4, #T_3deed_row62_col5, #T_3deed_row63_col0, #T_3deed_row63_col1, #T_3deed_row63_col2, #T_3deed_row63_col3, #T_3deed_row63_col4, #T_3deed_row63_col5, #T_3deed_row64_col0, #T_3deed_row64_col1, #T_3deed_row64_col2, #T_3deed_row64_col3, #T_3deed_row64_col4, #T_3deed_row64_col5, #T_3deed_row65_col0, #T_3deed_row65_col1, #T_3deed_row65_col2, #T_3deed_row65_col3, #T_3deed_row65_col4, #T_3deed_row65_col5, #T_3deed_row66_col0, #T_3deed_row66_col1, #T_3deed_row66_col2, #T_3deed_row66_col3, #T_3deed_row66_col4, #T_3deed_row66_col5, #T_3deed_row67_col0, #T_3deed_row67_col1, #T_3deed_row67_col2, #T_3deed_row67_col3, #T_3deed_row67_col4, #T_3deed_row67_col5, #T_3deed_row68_col0, #T_3deed_row68_col1, #T_3deed_row68_col2, #T_3deed_row68_col3, #T_3deed_row68_col4, #T_3deed_row68_col5, #T_3deed_row69_col0, #T_3deed_row69_col1, #T_3deed_row69_col2, #T_3deed_row69_col3, #T_3deed_row69_col4, #T_3deed_row69_col5, #T_3deed_row70_col0, #T_3deed_row70_col1, #T_3deed_row70_col2, #T_3deed_row70_col3, #T_3deed_row70_col4, #T_3deed_row70_col5, #T_3deed_row71_col0, #T_3deed_row71_col1, #T_3deed_row71_col2, #T_3deed_row71_col3, #T_3deed_row71_col4, #T_3deed_row71_col5, #T_3deed_row72_col0, #T_3deed_row72_col1, #T_3deed_row72_col2, #T_3deed_row72_col3, #T_3deed_row72_col4, #T_3deed_row72_col5, #T_3deed_row73_col0, #T_3deed_row73_col1, #T_3deed_row73_col2, #T_3deed_row73_col3, #T_3deed_row73_col4, #T_3deed_row73_col5, #T_3deed_row74_col0, #T_3deed_row74_col1, #T_3deed_row74_col2, #T_3deed_row74_col3, #T_3deed_row74_col4, #T_3deed_row74_col5, #T_3deed_row75_col0, #T_3deed_row75_col1, #T_3deed_row75_col2, #T_3deed_row75_col3, #T_3deed_row75_col4, #T_3deed_row75_col5, #T_3deed_row76_col0, #T_3deed_row76_col1, #T_3deed_row76_col2, #T_3deed_row76_col3, #T_3deed_row76_col4, #T_3deed_row76_col5, #T_3deed_row77_col0, #T_3deed_row77_col1, #T_3deed_row77_col2, #T_3deed_row77_col3, #T_3deed_row77_col4, #T_3deed_row77_col5, #T_3deed_row78_col0, #T_3deed_row78_col1, #T_3deed_row78_col2, #T_3deed_row78_col3, #T_3deed_row78_col4, #T_3deed_row78_col5, #T_3deed_row79_col0, #T_3deed_row79_col1, #T_3deed_row79_col2, #T_3deed_row79_col3, #T_3deed_row79_col4, #T_3deed_row79_col5, #T_3deed_row80_col0, #T_3deed_row80_col1, #T_3deed_row80_col2, #T_3deed_row80_col3, #T_3deed_row80_col4, #T_3deed_row80_col5, #T_3deed_row81_col0, #T_3deed_row81_col1, #T_3deed_row81_col2, #T_3deed_row81_col3, #T_3deed_row81_col4, #T_3deed_row81_col5, #T_3deed_row82_col0, #T_3deed_row82_col1, #T_3deed_row82_col2, #T_3deed_row82_col3, #T_3deed_row82_col4, #T_3deed_row82_col5, #T_3deed_row83_col0, #T_3deed_row83_col1, #T_3deed_row83_col2, #T_3deed_row83_col3, #T_3deed_row83_col4, #T_3deed_row83_col5, #T_3deed_row84_col0, #T_3deed_row84_col1, #T_3deed_row84_col2, #T_3deed_row84_col3, #T_3deed_row84_col4, #T_3deed_row84_col5, #T_3deed_row85_col0, #T_3deed_row85_col1, #T_3deed_row85_col2, #T_3deed_row85_col3, #T_3deed_row85_col4, #T_3deed_row85_col5, #T_3deed_row86_col0, #T_3deed_row86_col1, #T_3deed_row86_col2, #T_3deed_row86_col3, #T_3deed_row86_col4, #T_3deed_row86_col5, #T_3deed_row87_col0, #T_3deed_row87_col1, #T_3deed_row87_col2, #T_3deed_row87_col3, #T_3deed_row87_col4, #T_3deed_row87_col5, #T_3deed_row88_col0, #T_3deed_row88_col1, #T_3deed_row88_col2, #T_3deed_row88_col3, #T_3deed_row88_col4, #T_3deed_row88_col5, #T_3deed_row89_col0, #T_3deed_row89_col1, #T_3deed_row89_col2, #T_3deed_row89_col3, #T_3deed_row89_col4, #T_3deed_row89_col5, #T_3deed_row90_col0, #T_3deed_row90_col1, #T_3deed_row90_col2, #T_3deed_row90_col3, #T_3deed_row90_col4, #T_3deed_row90_col5, #T_3deed_row91_col0, #T_3deed_row91_col1, #T_3deed_row91_col2, #T_3deed_row91_col3, #T_3deed_row91_col4, #T_3deed_row91_col5, #T_3deed_row92_col0, #T_3deed_row92_col1, #T_3deed_row92_col2, #T_3deed_row92_col3, #T_3deed_row92_col4, #T_3deed_row92_col5, #T_3deed_row93_col0, #T_3deed_row93_col1, #T_3deed_row93_col2, #T_3deed_row93_col3, #T_3deed_row93_col4, #T_3deed_row93_col5, #T_3deed_row94_col0, #T_3deed_row94_col1, #T_3deed_row94_col2, #T_3deed_row94_col3, #T_3deed_row94_col4, #T_3deed_row94_col5, #T_3deed_row95_col0, #T_3deed_row95_col1, #T_3deed_row95_col2, #T_3deed_row95_col3, #T_3deed_row95_col4, #T_3deed_row95_col5, #T_3deed_row96_col0, #T_3deed_row96_col1, #T_3deed_row96_col2, #T_3deed_row96_col3, #T_3deed_row96_col4, #T_3deed_row96_col5, #T_3deed_row97_col0, #T_3deed_row97_col1, #T_3deed_row97_col2, #T_3deed_row97_col3, #T_3deed_row97_col4, #T_3deed_row97_col5, #T_3deed_row98_col0, #T_3deed_row98_col1, #T_3deed_row98_col2, #T_3deed_row98_col3, #T_3deed_row98_col4, #T_3deed_row98_col5, #T_3deed_row99_col0, #T_3deed_row99_col1, #T_3deed_row99_col2, #T_3deed_row99_col3, #T_3deed_row99_col4, #T_3deed_row99_col5, #T_3deed_row100_col0, #T_3deed_row100_col1, #T_3deed_row100_col2, #T_3deed_row100_col3, #T_3deed_row100_col4, #T_3deed_row100_col5, #T_3deed_row101_col0, #T_3deed_row101_col1, #T_3deed_row101_col2, #T_3deed_row101_col3, #T_3deed_row101_col4, #T_3deed_row101_col5, #T_3deed_row102_col0, #T_3deed_row102_col1, #T_3deed_row102_col2, #T_3deed_row102_col3, #T_3deed_row102_col4, #T_3deed_row102_col5, #T_3deed_row103_col0, #T_3deed_row103_col1, #T_3deed_row103_col2, #T_3deed_row103_col3, #T_3deed_row103_col4, #T_3deed_row103_col5, #T_3deed_row104_col0, #T_3deed_row104_col1, #T_3deed_row104_col2, #T_3deed_row104_col3, #T_3deed_row104_col4, #T_3deed_row104_col5, #T_3deed_row105_col0, #T_3deed_row105_col1, #T_3deed_row105_col2, #T_3deed_row105_col3, #T_3deed_row105_col4, #T_3deed_row105_col5, #T_3deed_row106_col0, #T_3deed_row106_col1, #T_3deed_row106_col2, #T_3deed_row106_col3, #T_3deed_row106_col4, #T_3deed_row106_col5, #T_3deed_row107_col0, #T_3deed_row107_col1, #T_3deed_row107_col2, #T_3deed_row107_col3, #T_3deed_row107_col4, #T_3deed_row107_col5, #T_3deed_row108_col0, #T_3deed_row108_col1, #T_3deed_row108_col2, #T_3deed_row108_col3, #T_3deed_row108_col4, #T_3deed_row108_col5, #T_3deed_row109_col0, #T_3deed_row109_col1, #T_3deed_row109_col2, #T_3deed_row109_col3, #T_3deed_row109_col4, #T_3deed_row109_col5, #T_3deed_row110_col0, #T_3deed_row110_col1, #T_3deed_row110_col2, #T_3deed_row110_col3, #T_3deed_row110_col4, #T_3deed_row110_col5, #T_3deed_row111_col0, #T_3deed_row111_col1, #T_3deed_row111_col2, #T_3deed_row111_col3, #T_3deed_row111_col4, #T_3deed_row111_col5, #T_3deed_row112_col0, #T_3deed_row112_col1, #T_3deed_row112_col2, #T_3deed_row112_col3, #T_3deed_row112_col4, #T_3deed_row112_col5, #T_3deed_row113_col0, #T_3deed_row113_col1, #T_3deed_row113_col2, #T_3deed_row113_col3, #T_3deed_row113_col4, #T_3deed_row113_col5, #T_3deed_row114_col0, #T_3deed_row114_col1, #T_3deed_row114_col2, #T_3deed_row114_col3, #T_3deed_row114_col4, #T_3deed_row114_col5, #T_3deed_row115_col0, #T_3deed_row115_col1, #T_3deed_row115_col2, #T_3deed_row115_col3, #T_3deed_row115_col4, #T_3deed_row115_col5, #T_3deed_row116_col0, #T_3deed_row116_col1, #T_3deed_row116_col2, #T_3deed_row116_col3, #T_3deed_row116_col4, #T_3deed_row116_col5, #T_3deed_row117_col0, #T_3deed_row117_col1, #T_3deed_row117_col2, #T_3deed_row117_col3, #T_3deed_row117_col4, #T_3deed_row117_col5 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_3deed\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_3deed_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_3deed_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_3deed_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_3deed_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_3deed_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_3deed_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row0\" class=\"row_heading level0 row0\" >chcp_command_execution.yml</th>\n",
|
||
" <td id=\"T_3deed_row0_col0\" class=\"data row0 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row0_col4\" class=\"data row0 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row0_col5\" class=\"data row0 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row1\" class=\"row_heading level0 row1\" >jscript_execution_using_cscript_app.yml</th>\n",
|
||
" <td id=\"T_3deed_row1_col0\" class=\"data row1 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row1_col1\" class=\"data row1 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row1_col4\" class=\"data row1 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row1_col5\" class=\"data row1 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row2\" class=\"row_heading level0 row2\" >wmic_noninteractive_app_uninstallation.yml</th>\n",
|
||
" <td id=\"T_3deed_row2_col0\" class=\"data row2 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row2_col3\" class=\"data row2 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row2_col4\" class=\"data row2 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row2_col5\" class=\"data row2 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row3\" class=\"row_heading level0 row3\" >executable_file_written_in_administrative_smb_share.yml</th>\n",
|
||
" <td id=\"T_3deed_row3_col0\" class=\"data row3 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row3_col1\" class=\"data row3 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row3_col4\" class=\"data row3 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row3_col5\" class=\"data row3 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row4\" class=\"row_heading level0 row4\" >windows_powershell_import_applocker_policy.yml</th>\n",
|
||
" <td id=\"T_3deed_row4_col0\" class=\"data row4 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row4_col2\" class=\"data row4 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row4_col3\" class=\"data row4 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row4_col4\" class=\"data row4 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row4_col5\" class=\"data row4 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row5\" class=\"row_heading level0 row5\" >windows_service_stop_by_deletion.yml</th>\n",
|
||
" <td id=\"T_3deed_row5_col0\" class=\"data row5 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row5_col2\" class=\"data row5 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row5_col3\" class=\"data row5 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row5_col5\" class=\"data row5 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row6\" class=\"row_heading level0 row6\" >disable_defender_submit_samples_consent_feature.yml</th>\n",
|
||
" <td id=\"T_3deed_row6_col0\" class=\"data row6 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row6_col2\" class=\"data row6 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row6_col3\" class=\"data row6 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row6_col4\" class=\"data row6 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row6_col5\" class=\"data row6 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row7\" class=\"row_heading level0 row7\" >schedule_task_with_rundll32_command_trigger.yml</th>\n",
|
||
" <td id=\"T_3deed_row7_col0\" class=\"data row7 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row7_col1\" class=\"data row7 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row7_col2\" class=\"data row7 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row7_col3\" class=\"data row7 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row7_col5\" class=\"data row7 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row8\" class=\"row_heading level0 row8\" >suspicious_copy_on_system32.yml</th>\n",
|
||
" <td id=\"T_3deed_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row8_col1\" class=\"data row8 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row8_col2\" class=\"data row8 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row8_col4\" class=\"data row8 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row8_col5\" class=\"data row8 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row9\" class=\"row_heading level0 row9\" >detect_html_help_spawn_child_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row9_col0\" class=\"data row9 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row9_col1\" class=\"data row9 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row9_col2\" class=\"data row9 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row9_col4\" class=\"data row9 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row9_col5\" class=\"data row9 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row10\" class=\"row_heading level0 row10\" >windows_modify_registry_disallow_windows_app.yml</th>\n",
|
||
" <td id=\"T_3deed_row10_col0\" class=\"data row10 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row10_col2\" class=\"data row10 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row10_col3\" class=\"data row10 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row10_col4\" class=\"data row10 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row10_col5\" class=\"data row10 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row11\" class=\"row_heading level0 row11\" >services_exe_lolbas_execution_process_spawn.yml</th>\n",
|
||
" <td id=\"T_3deed_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row11_col1\" class=\"data row11 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row11_col2\" class=\"data row11 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row11_col3\" class=\"data row11 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row11_col4\" class=\"data row11 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row11_col5\" class=\"data row11 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row12\" class=\"row_heading level0 row12\" >windows_gather_victim_network_info_through_ip_check_web_services.yml</th>\n",
|
||
" <td id=\"T_3deed_row12_col0\" class=\"data row12 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row12_col2\" class=\"data row12 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row12_col3\" class=\"data row12 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row12_col4\" class=\"data row12 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row12_col5\" class=\"data row12 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row13\" class=\"row_heading level0 row13\" >suspicious_rundll32_startw.yml</th>\n",
|
||
" <td id=\"T_3deed_row13_col0\" class=\"data row13 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row13_col1\" class=\"data row13 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row13_col2\" class=\"data row13 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row13_col3\" class=\"data row13 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row13_col4\" class=\"data row13 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row13_col5\" class=\"data row13 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row14\" class=\"row_heading level0 row14\" >windows_regsvr32_renamed_binary.yml</th>\n",
|
||
" <td id=\"T_3deed_row14_col0\" class=\"data row14 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row14_col1\" class=\"data row14 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row14_col2\" class=\"data row14 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row14_col3\" class=\"data row14 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row14_col4\" class=\"data row14 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row14_col5\" class=\"data row14 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row15\" class=\"row_heading level0 row15\" >winhlp32_spawning_a_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row15_col0\" class=\"data row15 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row15_col1\" class=\"data row15 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row15_col3\" class=\"data row15 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row15_col4\" class=\"data row15 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row15_col5\" class=\"data row15 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row16\" class=\"row_heading level0 row16\" >account_discovery_with_net_app.yml</th>\n",
|
||
" <td id=\"T_3deed_row16_col0\" class=\"data row16 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row16_col1\" class=\"data row16 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row16_col2\" class=\"data row16 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row16_col3\" class=\"data row16 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row16_col4\" class=\"data row16 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row16_col5\" class=\"data row16 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row17\" class=\"row_heading level0 row17\" >excessive_usage_of_sc_service_utility.yml</th>\n",
|
||
" <td id=\"T_3deed_row17_col0\" class=\"data row17 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row17_col2\" class=\"data row17 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row17_col3\" class=\"data row17 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row17_col4\" class=\"data row17 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row17_col5\" class=\"data row17 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row18\" class=\"row_heading level0 row18\" >disable_show_hidden_files.yml</th>\n",
|
||
" <td id=\"T_3deed_row18_col0\" class=\"data row18 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row18_col2\" class=\"data row18 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row18_col3\" class=\"data row18 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row18_col4\" class=\"data row18 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row18_col5\" class=\"data row18 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row19\" class=\"row_heading level0 row19\" >windows_modify_registry_disable_win_defender_raw_write_notif.yml</th>\n",
|
||
" <td id=\"T_3deed_row19_col0\" class=\"data row19 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row19_col2\" class=\"data row19 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row19_col3\" class=\"data row19 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row19_col4\" class=\"data row19 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row19_col5\" class=\"data row19 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row20\" class=\"row_heading level0 row20\" >process_writing_dynamicwrapperx.yml</th>\n",
|
||
" <td id=\"T_3deed_row20_col0\" class=\"data row20 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row20_col1\" class=\"data row20 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row20_col2\" class=\"data row20 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row20_col3\" class=\"data row20 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row20_col4\" class=\"data row20 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row20_col5\" class=\"data row20 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row21\" class=\"row_heading level0 row21\" >detect_use_of_cmd_exe_to_launch_script_interpreters.yml</th>\n",
|
||
" <td id=\"T_3deed_row21_col0\" class=\"data row21 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row21_col2\" class=\"data row21 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row21_col3\" class=\"data row21 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row21_col4\" class=\"data row21 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row21_col5\" class=\"data row21 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row22\" class=\"row_heading level0 row22\" >windows_valid_account_with_never_expires_password.yml</th>\n",
|
||
" <td id=\"T_3deed_row22_col0\" class=\"data row22 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row22_col2\" class=\"data row22 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row22_col3\" class=\"data row22 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row22_col4\" class=\"data row22 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row22_col5\" class=\"data row22 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row23\" class=\"row_heading level0 row23\" >windows_schtasks_create_run_as_system.yml</th>\n",
|
||
" <td id=\"T_3deed_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row23_col1\" class=\"data row23 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row23_col2\" class=\"data row23 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row23_col3\" class=\"data row23 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row23_col4\" class=\"data row23 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row23_col5\" class=\"data row23 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row24\" class=\"row_heading level0 row24\" >windows_driver_load_non_standard_path.yml</th>\n",
|
||
" <td id=\"T_3deed_row24_col0\" class=\"data row24 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row24_col1\" class=\"data row24 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row24_col2\" class=\"data row24 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row24_col3\" class=\"data row24 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row24_col4\" class=\"data row24 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row24_col5\" class=\"data row24 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row25\" class=\"row_heading level0 row25\" >windows_impair_defense_deny_security_software_with_applocker.yml</th>\n",
|
||
" <td id=\"T_3deed_row25_col0\" class=\"data row25 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row25_col1\" class=\"data row25 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row25_col2\" class=\"data row25 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row25_col3\" class=\"data row25 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row25_col4\" class=\"data row25 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row25_col5\" class=\"data row25 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row26\" class=\"row_heading level0 row26\" >windows_dll_side_loading_process_child_of_calc.yml</th>\n",
|
||
" <td id=\"T_3deed_row26_col0\" class=\"data row26 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row26_col1\" class=\"data row26 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row26_col2\" class=\"data row26 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row26_col3\" class=\"data row26 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row26_col4\" class=\"data row26 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row26_col5\" class=\"data row26 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row27\" class=\"row_heading level0 row27\" >windows_modify_registry_disabling_wer_settings.yml</th>\n",
|
||
" <td id=\"T_3deed_row27_col0\" class=\"data row27 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row27_col1\" class=\"data row27 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row27_col2\" class=\"data row27 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row27_col3\" class=\"data row27 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row27_col4\" class=\"data row27 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row27_col5\" class=\"data row27 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row28\" class=\"row_heading level0 row28\" >net_localgroup_discovery.yml</th>\n",
|
||
" <td id=\"T_3deed_row28_col0\" class=\"data row28 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row28_col2\" class=\"data row28 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row28_col3\" class=\"data row28 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row28_col4\" class=\"data row28 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row28_col5\" class=\"data row28 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row29\" class=\"row_heading level0 row29\" >windows_dll_search_order_hijacking_hunt_with_sysmon.yml</th>\n",
|
||
" <td id=\"T_3deed_row29_col0\" class=\"data row29 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row29_col1\" class=\"data row29 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row29_col2\" class=\"data row29 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row29_col3\" class=\"data row29 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row29_col4\" class=\"data row29 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row29_col5\" class=\"data row29 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row30\" class=\"row_heading level0 row30\" >disable_defender_blockatfirstseen_feature.yml</th>\n",
|
||
" <td id=\"T_3deed_row30_col0\" class=\"data row30 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row30_col1\" class=\"data row30 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row30_col2\" class=\"data row30 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row30_col3\" class=\"data row30 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row30_col4\" class=\"data row30 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row30_col5\" class=\"data row30 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row31\" class=\"row_heading level0 row31\" >powershell___connect_to_internet_with_hidden_window.yml</th>\n",
|
||
" <td id=\"T_3deed_row31_col0\" class=\"data row31 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row31_col1\" class=\"data row31 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row31_col2\" class=\"data row31 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row31_col3\" class=\"data row31 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row31_col5\" class=\"data row31 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row32\" class=\"row_heading level0 row32\" >wscript_or_cscript_suspicious_child_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row32_col0\" class=\"data row32 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row32_col1\" class=\"data row32 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row32_col2\" class=\"data row32 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row32_col3\" class=\"data row32 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row32_col4\" class=\"data row32 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row32_col5\" class=\"data row32 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row33\" class=\"row_heading level0 row33\" >hiding_files_and_directories_with_attrib_exe.yml</th>\n",
|
||
" <td id=\"T_3deed_row33_col0\" class=\"data row33 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row33_col1\" class=\"data row33 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row33_col2\" class=\"data row33 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row33_col3\" class=\"data row33 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row33_col4\" class=\"data row33 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row33_col5\" class=\"data row33 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row34\" class=\"row_heading level0 row34\" >windows_modify_registry_disable_toast_notifications.yml</th>\n",
|
||
" <td id=\"T_3deed_row34_col0\" class=\"data row34 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row34_col2\" class=\"data row34 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row34_col3\" class=\"data row34 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row34_col4\" class=\"data row34 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row34_col5\" class=\"data row34 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row35\" class=\"row_heading level0 row35\" >windows_modify_registry_disable_windows_security_center_notif.yml</th>\n",
|
||
" <td id=\"T_3deed_row35_col0\" class=\"data row35 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row35_col1\" class=\"data row35 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row35_col2\" class=\"data row35 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row35_col3\" class=\"data row35 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row35_col4\" class=\"data row35 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row35_col5\" class=\"data row35 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row36\" class=\"row_heading level0 row36\" >windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml</th>\n",
|
||
" <td id=\"T_3deed_row36_col0\" class=\"data row36 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row36_col1\" class=\"data row36 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row36_col2\" class=\"data row36 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row36_col3\" class=\"data row36 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row36_col4\" class=\"data row36 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row36_col5\" class=\"data row36 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row37\" class=\"row_heading level0 row37\" >windows_wmi_impersonate_token.yml</th>\n",
|
||
" <td id=\"T_3deed_row37_col0\" class=\"data row37 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row37_col1\" class=\"data row37 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row37_col2\" class=\"data row37 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row37_col3\" class=\"data row37 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row37_col4\" class=\"data row37 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row37_col5\" class=\"data row37 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row38\" class=\"row_heading level0 row38\" >office_application_spawn_regsvr32_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row38_col0\" class=\"data row38 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row38_col1\" class=\"data row38 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row38_col2\" class=\"data row38 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row38_col3\" class=\"data row38 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row38_col4\" class=\"data row38 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row38_col5\" class=\"data row38 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row39\" class=\"row_heading level0 row39\" >windows_modify_registry_qakbot_binary_data_registry.yml</th>\n",
|
||
" <td id=\"T_3deed_row39_col0\" class=\"data row39 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row39_col1\" class=\"data row39 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row39_col2\" class=\"data row39 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row39_col3\" class=\"data row39 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row39_col4\" class=\"data row39 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row39_col5\" class=\"data row39 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row40\" class=\"row_heading level0 row40\" >nltest_domain_trust_discovery.yml</th>\n",
|
||
" <td id=\"T_3deed_row40_col0\" class=\"data row40 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row40_col1\" class=\"data row40 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row40_col2\" class=\"data row40 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row40_col3\" class=\"data row40 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row40_col4\" class=\"data row40 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row40_col5\" class=\"data row40 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row41\" class=\"row_heading level0 row41\" >windows_modify_registry_suppress_win_defender_notif.yml</th>\n",
|
||
" <td id=\"T_3deed_row41_col0\" class=\"data row41 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row41_col1\" class=\"data row41 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row41_col2\" class=\"data row41 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row41_col3\" class=\"data row41 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row41_col4\" class=\"data row41 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row41_col5\" class=\"data row41 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row42\" class=\"row_heading level0 row42\" >process_creating_lnk_file_in_suspicious_location.yml</th>\n",
|
||
" <td id=\"T_3deed_row42_col0\" class=\"data row42 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row42_col1\" class=\"data row42 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row42_col2\" class=\"data row42 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row42_col3\" class=\"data row42 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row42_col4\" class=\"data row42 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row42_col5\" class=\"data row42 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row43\" class=\"row_heading level0 row43\" >office_application_drop_executable.yml</th>\n",
|
||
" <td id=\"T_3deed_row43_col0\" class=\"data row43 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row43_col1\" class=\"data row43 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row43_col2\" class=\"data row43 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row43_col3\" class=\"data row43 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row43_col4\" class=\"data row43 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row43_col5\" class=\"data row43 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row44\" class=\"row_heading level0 row44\" >allow_inbound_traffic_by_firewall_rule_registry.yml</th>\n",
|
||
" <td id=\"T_3deed_row44_col0\" class=\"data row44 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row44_col1\" class=\"data row44 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row44_col2\" class=\"data row44 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row44_col3\" class=\"data row44 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row44_col4\" class=\"data row44 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row44_col5\" class=\"data row44 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row45\" class=\"row_heading level0 row45\" >disable_defender_enhanced_notification.yml</th>\n",
|
||
" <td id=\"T_3deed_row45_col0\" class=\"data row45 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row45_col1\" class=\"data row45 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row45_col2\" class=\"data row45 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row45_col3\" class=\"data row45 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row45_col4\" class=\"data row45 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row45_col5\" class=\"data row45 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row46\" class=\"row_heading level0 row46\" >powershell_remote_thread_to_known_windows_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row46_col0\" class=\"data row46 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row46_col1\" class=\"data row46 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row46_col2\" class=\"data row46 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row46_col3\" class=\"data row46 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row46_col4\" class=\"data row46 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row46_col5\" class=\"data row46 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row47\" class=\"row_heading level0 row47\" >windows_process_injection_of_wermgr_to_known_browser.yml</th>\n",
|
||
" <td id=\"T_3deed_row47_col0\" class=\"data row47 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row47_col1\" class=\"data row47 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row47_col2\" class=\"data row47 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row47_col3\" class=\"data row47 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row47_col4\" class=\"data row47 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row47_col5\" class=\"data row47 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row48\" class=\"row_heading level0 row48\" >windows_multi_hop_proxy_tor_website_query.yml</th>\n",
|
||
" <td id=\"T_3deed_row48_col0\" class=\"data row48 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row48_col1\" class=\"data row48 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row48_col2\" class=\"data row48 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row48_col3\" class=\"data row48 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row48_col4\" class=\"data row48 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row48_col5\" class=\"data row48 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row49\" class=\"row_heading level0 row49\" >system_info_gathering_using_dxdiag_application.yml</th>\n",
|
||
" <td id=\"T_3deed_row49_col0\" class=\"data row49 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row49_col1\" class=\"data row49 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row49_col2\" class=\"data row49 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row49_col3\" class=\"data row49 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row49_col4\" class=\"data row49 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row49_col5\" class=\"data row49 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row50\" class=\"row_heading level0 row50\" >windows_mail_protocol_in_non_common_process_path.yml</th>\n",
|
||
" <td id=\"T_3deed_row50_col0\" class=\"data row50 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row50_col1\" class=\"data row50 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row50_col2\" class=\"data row50 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row50_col3\" class=\"data row50 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row50_col4\" class=\"data row50 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row50_col5\" class=\"data row50 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row51\" class=\"row_heading level0 row51\" >winevent_windows_task_scheduler_event_action_started.yml</th>\n",
|
||
" <td id=\"T_3deed_row51_col0\" class=\"data row51 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row51_col1\" class=\"data row51 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row51_col2\" class=\"data row51 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row51_col3\" class=\"data row51 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row51_col4\" class=\"data row51 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row51_col5\" class=\"data row51 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row52\" class=\"row_heading level0 row52\" >regsvr32_silent_and_install_param_dll_loading.yml</th>\n",
|
||
" <td id=\"T_3deed_row52_col0\" class=\"data row52 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row52_col1\" class=\"data row52 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row52_col2\" class=\"data row52 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row52_col3\" class=\"data row52 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row52_col4\" class=\"data row52 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row52_col5\" class=\"data row52 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row53\" class=\"row_heading level0 row53\" >network_connection_discovery_net.yml</th>\n",
|
||
" <td id=\"T_3deed_row53_col0\" class=\"data row53 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row53_col1\" class=\"data row53 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row53_col2\" class=\"data row53 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row53_col3\" class=\"data row53 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row53_col4\" class=\"data row53 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row53_col5\" class=\"data row53 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row54\" class=\"row_heading level0 row54\" >windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml</th>\n",
|
||
" <td id=\"T_3deed_row54_col0\" class=\"data row54 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row54_col1\" class=\"data row54 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row54_col2\" class=\"data row54 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row54_col3\" class=\"data row54 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row54_col4\" class=\"data row54 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row54_col5\" class=\"data row54 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row55\" class=\"row_heading level0 row55\" >sc_exe_manipulating_windows_services.yml</th>\n",
|
||
" <td id=\"T_3deed_row55_col0\" class=\"data row55 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row55_col2\" class=\"data row55 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row55_col3\" class=\"data row55 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row55_col4\" class=\"data row55 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row55_col5\" class=\"data row55 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row56\" class=\"row_heading level0 row56\" >disable_windows_behavior_monitoring.yml</th>\n",
|
||
" <td id=\"T_3deed_row56_col0\" class=\"data row56 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row56_col2\" class=\"data row56 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row56_col3\" class=\"data row56 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row56_col4\" class=\"data row56 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row56_col5\" class=\"data row56 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row57\" class=\"row_heading level0 row57\" >create_remote_thread_in_shell_application.yml</th>\n",
|
||
" <td id=\"T_3deed_row57_col0\" class=\"data row57 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row57_col1\" class=\"data row57 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row57_col2\" class=\"data row57 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row57_col3\" class=\"data row57 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row57_col4\" class=\"data row57 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row57_col5\" class=\"data row57 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row58\" class=\"row_heading level0 row58\" >network_connection_discovery_arp.yml</th>\n",
|
||
" <td id=\"T_3deed_row58_col0\" class=\"data row58 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row58_col1\" class=\"data row58 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row58_col2\" class=\"data row58 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row58_col3\" class=\"data row58 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row58_col4\" class=\"data row58 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row58_col5\" class=\"data row58 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row59\" class=\"row_heading level0 row59\" >schtasks_run_task_on_demand.yml</th>\n",
|
||
" <td id=\"T_3deed_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row59_col1\" class=\"data row59 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row59_col2\" class=\"data row59 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row59_col3\" class=\"data row59 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row59_col4\" class=\"data row59 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row59_col5\" class=\"data row59 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row60\" class=\"row_heading level0 row60\" >windows_masquerading_explorer_as_child_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row60_col1\" class=\"data row60 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row60_col2\" class=\"data row60 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row60_col3\" class=\"data row60 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row60_col4\" class=\"data row60 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row60_col5\" class=\"data row60 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row61\" class=\"row_heading level0 row61\" >windows_wmi_process_call_create.yml</th>\n",
|
||
" <td id=\"T_3deed_row61_col0\" class=\"data row61 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row61_col1\" class=\"data row61 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row61_col2\" class=\"data row61 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row61_col3\" class=\"data row61 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row61_col4\" class=\"data row61 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row61_col5\" class=\"data row61 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row62\" class=\"row_heading level0 row62\" >cmdline_tool_not_executed_in_cmd_shell.yml</th>\n",
|
||
" <td id=\"T_3deed_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row62_col1\" class=\"data row62 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row62_col2\" class=\"data row62 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row62_col3\" class=\"data row62 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row62_col4\" class=\"data row62 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row62_col5\" class=\"data row62 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row63\" class=\"row_heading level0 row63\" >windows_modify_registry_regedit_silent_reg_import.yml</th>\n",
|
||
" <td id=\"T_3deed_row63_col0\" class=\"data row63 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row63_col1\" class=\"data row63 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row63_col2\" class=\"data row63 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row63_col3\" class=\"data row63 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row63_col4\" class=\"data row63 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row63_col5\" class=\"data row63 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row64\" class=\"row_heading level0 row64\" >windows_file_transfer_protocol_in_non_common_process_path.yml</th>\n",
|
||
" <td id=\"T_3deed_row64_col0\" class=\"data row64 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row64_col1\" class=\"data row64 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row64_col2\" class=\"data row64 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row64_col3\" class=\"data row64 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row64_col4\" class=\"data row64 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row64_col5\" class=\"data row64 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row65\" class=\"row_heading level0 row65\" >network_connection_discovery_netstat.yml</th>\n",
|
||
" <td id=\"T_3deed_row65_col0\" class=\"data row65 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row65_col1\" class=\"data row65 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row65_col2\" class=\"data row65 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row65_col3\" class=\"data row65 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row65_col4\" class=\"data row65 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row65_col5\" class=\"data row65 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row66\" class=\"row_heading level0 row66\" >windows_remote_services_rdp_enable.yml</th>\n",
|
||
" <td id=\"T_3deed_row66_col0\" class=\"data row66 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row66_col1\" class=\"data row66 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row66_col2\" class=\"data row66 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row66_col3\" class=\"data row66 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row66_col4\" class=\"data row66 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row66_col5\" class=\"data row66 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row67\" class=\"row_heading level0 row67\" >suspicious_wav_file_in_appdata_folder.yml</th>\n",
|
||
" <td id=\"T_3deed_row67_col0\" class=\"data row67 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row67_col1\" class=\"data row67 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row67_col2\" class=\"data row67 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row67_col3\" class=\"data row67 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row67_col4\" class=\"data row67 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row67_col5\" class=\"data row67 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row68\" class=\"row_heading level0 row68\" >allow_operation_with_consent_admin.yml</th>\n",
|
||
" <td id=\"T_3deed_row68_col0\" class=\"data row68 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row68_col1\" class=\"data row68 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row68_col2\" class=\"data row68 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row68_col3\" class=\"data row68 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row68_col4\" class=\"data row68 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row68_col5\" class=\"data row68 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row69\" class=\"row_heading level0 row69\" >windows_remote_services_allow_rdp_in_firewall.yml</th>\n",
|
||
" <td id=\"T_3deed_row69_col0\" class=\"data row69 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row69_col1\" class=\"data row69 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row69_col2\" class=\"data row69 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row69_col3\" class=\"data row69 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row69_col4\" class=\"data row69 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row69_col5\" class=\"data row69 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row70\" class=\"row_heading level0 row70\" >suspicious_process_dns_query_known_abuse_web_services.yml</th>\n",
|
||
" <td id=\"T_3deed_row70_col0\" class=\"data row70 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row70_col1\" class=\"data row70 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row70_col2\" class=\"data row70 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row70_col3\" class=\"data row70 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row70_col4\" class=\"data row70 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row70_col5\" class=\"data row70 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row71\" class=\"row_heading level0 row71\" >icacls_deny_command.yml</th>\n",
|
||
" <td id=\"T_3deed_row71_col0\" class=\"data row71 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row71_col1\" class=\"data row71 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row71_col2\" class=\"data row71 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row71_col3\" class=\"data row71 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row71_col4\" class=\"data row71 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row71_col5\" class=\"data row71 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row72\" class=\"row_heading level0 row72\" >processes_launching_netsh.yml</th>\n",
|
||
" <td id=\"T_3deed_row72_col0\" class=\"data row72 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row72_col1\" class=\"data row72 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row72_col2\" class=\"data row72 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row72_col3\" class=\"data row72 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row72_col4\" class=\"data row72 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row72_col5\" class=\"data row72 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row73\" class=\"row_heading level0 row73\" >wermgr_process_connecting_to_ip_check_web_services.yml</th>\n",
|
||
" <td id=\"T_3deed_row73_col0\" class=\"data row73 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row73_col1\" class=\"data row73 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row73_col2\" class=\"data row73 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row73_col3\" class=\"data row73 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row73_col4\" class=\"data row73 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row73_col5\" class=\"data row73 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row74\" class=\"row_heading level0 row74\" >hide_user_account_from_sign_in_screen.yml</th>\n",
|
||
" <td id=\"T_3deed_row74_col0\" class=\"data row74 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row74_col1\" class=\"data row74 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row74_col2\" class=\"data row74 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row74_col3\" class=\"data row74 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row74_col4\" class=\"data row74 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row74_col5\" class=\"data row74 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row75\" class=\"row_heading level0 row75\" >remcos_rat_file_creation_in_remcos_folder.yml</th>\n",
|
||
" <td id=\"T_3deed_row75_col0\" class=\"data row75 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row75_col1\" class=\"data row75 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row75_col2\" class=\"data row75 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row75_col3\" class=\"data row75 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row75_col4\" class=\"data row75 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row75_col5\" class=\"data row75 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row76\" class=\"row_heading level0 row76\" >windows_impair_defense_add_xml_applocker_rules.yml</th>\n",
|
||
" <td id=\"T_3deed_row76_col0\" class=\"data row76 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row76_col1\" class=\"data row76 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row76_col2\" class=\"data row76 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row76_col3\" class=\"data row76 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row76_col4\" class=\"data row76 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row76_col5\" class=\"data row76 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row77\" class=\"row_heading level0 row77\" >windows_system_discovery_using_qwinsta.yml</th>\n",
|
||
" <td id=\"T_3deed_row77_col0\" class=\"data row77 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row77_col1\" class=\"data row77 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row77_col2\" class=\"data row77 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row77_col3\" class=\"data row77 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row77_col4\" class=\"data row77 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row77_col5\" class=\"data row77 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row78\" class=\"row_heading level0 row78\" >wermgr_process_create_executable_file.yml</th>\n",
|
||
" <td id=\"T_3deed_row78_col0\" class=\"data row78 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row78_col1\" class=\"data row78 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row78_col2\" class=\"data row78 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row78_col3\" class=\"data row78 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row78_col4\" class=\"data row78 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row78_col5\" class=\"data row78 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row79\" class=\"row_heading level0 row79\" >system_user_discovery_with_whoami.yml</th>\n",
|
||
" <td id=\"T_3deed_row79_col0\" class=\"data row79 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row79_col1\" class=\"data row79 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row79_col2\" class=\"data row79 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row79_col3\" class=\"data row79 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row79_col4\" class=\"data row79 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row79_col5\" class=\"data row79 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row80\" class=\"row_heading level0 row80\" >windows_remote_services_allow_remote_assistance.yml</th>\n",
|
||
" <td id=\"T_3deed_row80_col0\" class=\"data row80 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row80_col1\" class=\"data row80 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row80_col2\" class=\"data row80 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row80_col3\" class=\"data row80 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row80_col4\" class=\"data row80 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row80_col5\" class=\"data row80 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row81\" class=\"row_heading level0 row81\" >windows_remote_access_software_rms_registry.yml</th>\n",
|
||
" <td id=\"T_3deed_row81_col0\" class=\"data row81 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row81_col1\" class=\"data row81 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row81_col2\" class=\"data row81 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row81_col3\" class=\"data row81 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row81_col4\" class=\"data row81 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row81_col5\" class=\"data row81 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row82\" class=\"row_heading level0 row82\" >windows_process_injection_remote_thread.yml</th>\n",
|
||
" <td id=\"T_3deed_row82_col0\" class=\"data row82 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row82_col1\" class=\"data row82 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row82_col2\" class=\"data row82 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row82_col3\" class=\"data row82 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row82_col4\" class=\"data row82 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row82_col5\" class=\"data row82 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row83\" class=\"row_heading level0 row83\" >excessive_attempt_to_disable_services.yml</th>\n",
|
||
" <td id=\"T_3deed_row83_col0\" class=\"data row83 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row83_col1\" class=\"data row83 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row83_col2\" class=\"data row83 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row83_col3\" class=\"data row83 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row83_col4\" class=\"data row83 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row83_col5\" class=\"data row83 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row84\" class=\"row_heading level0 row84\" >windows_remote_service_rdpwinst_tool_execution.yml</th>\n",
|
||
" <td id=\"T_3deed_row84_col0\" class=\"data row84 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row84_col1\" class=\"data row84 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row84_col2\" class=\"data row84 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row84_col3\" class=\"data row84 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row84_col4\" class=\"data row84 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row84_col5\" class=\"data row84 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row85\" class=\"row_heading level0 row85\" >excessive_usage_of_cacls_app.yml</th>\n",
|
||
" <td id=\"T_3deed_row85_col0\" class=\"data row85 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row85_col1\" class=\"data row85 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row85_col2\" class=\"data row85 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row85_col3\" class=\"data row85 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row85_col4\" class=\"data row85 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row85_col5\" class=\"data row85 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row86\" class=\"row_heading level0 row86\" >loading_of_dynwrapx_module.yml</th>\n",
|
||
" <td id=\"T_3deed_row86_col0\" class=\"data row86 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row86_col1\" class=\"data row86 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row86_col2\" class=\"data row86 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row86_col3\" class=\"data row86 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row86_col4\" class=\"data row86 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row86_col5\" class=\"data row86 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row87\" class=\"row_heading level0 row87\" >possible_browser_pass_view_parameter.yml</th>\n",
|
||
" <td id=\"T_3deed_row87_col0\" class=\"data row87 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row87_col1\" class=\"data row87 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row87_col2\" class=\"data row87 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row87_col3\" class=\"data row87 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row87_col4\" class=\"data row87 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row87_col5\" class=\"data row87 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row88\" class=\"row_heading level0 row88\" >excessive_usage_of_net_app.yml</th>\n",
|
||
" <td id=\"T_3deed_row88_col0\" class=\"data row88 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row88_col1\" class=\"data row88 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row88_col2\" class=\"data row88 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row88_col3\" class=\"data row88 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row88_col4\" class=\"data row88 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row88_col5\" class=\"data row88 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row89\" class=\"row_heading level0 row89\" >windows_process_injection_wermgr_child_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row89_col0\" class=\"data row89 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row89_col1\" class=\"data row89 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row89_col2\" class=\"data row89 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row89_col3\" class=\"data row89 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row89_col4\" class=\"data row89 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row89_col5\" class=\"data row89 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row90\" class=\"row_heading level0 row90\" >vbscript_execution_using_wscript_app.yml</th>\n",
|
||
" <td id=\"T_3deed_row90_col0\" class=\"data row90 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row90_col1\" class=\"data row90 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row90_col2\" class=\"data row90 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row90_col3\" class=\"data row90 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row90_col4\" class=\"data row90 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row90_col5\" class=\"data row90 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row91\" class=\"row_heading level0 row91\" >office_product_spawning_mshta.yml</th>\n",
|
||
" <td id=\"T_3deed_row91_col0\" class=\"data row91 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row91_col1\" class=\"data row91 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row91_col2\" class=\"data row91 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row91_col3\" class=\"data row91 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row91_col4\" class=\"data row91 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row91_col5\" class=\"data row91 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row92\" class=\"row_heading level0 row92\" >windows_disableantispyware_reg.yml</th>\n",
|
||
" <td id=\"T_3deed_row92_col0\" class=\"data row92 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row92_col1\" class=\"data row92 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row92_col2\" class=\"data row92 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row92_col3\" class=\"data row92 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row92_col4\" class=\"data row92 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row92_col5\" class=\"data row92 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row93\" class=\"row_heading level0 row93\" >suspicious_driver_loaded_path.yml</th>\n",
|
||
" <td id=\"T_3deed_row93_col0\" class=\"data row93 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row93_col1\" class=\"data row93 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row93_col2\" class=\"data row93 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row93_col3\" class=\"data row93 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row93_col4\" class=\"data row93 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row93_col5\" class=\"data row93 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row94\" class=\"row_heading level0 row94\" >system_processes_run_from_unexpected_locations.yml</th>\n",
|
||
" <td id=\"T_3deed_row94_col0\" class=\"data row94 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row94_col1\" class=\"data row94 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row94_col2\" class=\"data row94 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row94_col3\" class=\"data row94 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row94_col4\" class=\"data row94 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row94_col5\" class=\"data row94 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row95\" class=\"row_heading level0 row95\" >trickbot_named_pipe.yml</th>\n",
|
||
" <td id=\"T_3deed_row95_col0\" class=\"data row95 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row95_col1\" class=\"data row95 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row95_col2\" class=\"data row95 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row95_col3\" class=\"data row95 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row95_col4\" class=\"data row95 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row95_col5\" class=\"data row95 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row96\" class=\"row_heading level0 row96\" >windows_service_created_with_suspicious_service_path.yml</th>\n",
|
||
" <td id=\"T_3deed_row96_col0\" class=\"data row96 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row96_col1\" class=\"data row96 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row96_col2\" class=\"data row96 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row96_col3\" class=\"data row96 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row96_col4\" class=\"data row96 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row96_col5\" class=\"data row96 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row97\" class=\"row_heading level0 row97\" >windows_system_discovery_using_ldap_nslookup.yml</th>\n",
|
||
" <td id=\"T_3deed_row97_col0\" class=\"data row97 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row97_col1\" class=\"data row97 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row97_col2\" class=\"data row97 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row97_col3\" class=\"data row97 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row97_col4\" class=\"data row97 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row97_col5\" class=\"data row97 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row98\" class=\"row_heading level0 row98\" >windows_app_layer_protocol_qakbot_namedpipe.yml</th>\n",
|
||
" <td id=\"T_3deed_row98_col0\" class=\"data row98 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row98_col1\" class=\"data row98 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row98_col2\" class=\"data row98 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row98_col3\" class=\"data row98 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row98_col4\" class=\"data row98 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row98_col5\" class=\"data row98 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row99\" class=\"row_heading level0 row99\" >recon_using_wmi_class.yml</th>\n",
|
||
" <td id=\"T_3deed_row99_col0\" class=\"data row99 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row99_col1\" class=\"data row99 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row99_col2\" class=\"data row99 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row99_col3\" class=\"data row99 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row99_col4\" class=\"data row99 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row99_col5\" class=\"data row99 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row100\" class=\"row_heading level0 row100\" >firewall_allowed_program_enable.yml</th>\n",
|
||
" <td id=\"T_3deed_row100_col0\" class=\"data row100 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row100_col1\" class=\"data row100 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row100_col2\" class=\"data row100 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row100_col3\" class=\"data row100 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row100_col4\" class=\"data row100 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row100_col5\" class=\"data row100 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row101\" class=\"row_heading level0 row101\" >windows_command_shell_fetch_env_variables.yml</th>\n",
|
||
" <td id=\"T_3deed_row101_col0\" class=\"data row101 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row101_col1\" class=\"data row101 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row101_col2\" class=\"data row101 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row101_col3\" class=\"data row101 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row101_col4\" class=\"data row101 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row101_col5\" class=\"data row101 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row102\" class=\"row_heading level0 row102\" >process_deleting_its_process_file_path.yml</th>\n",
|
||
" <td id=\"T_3deed_row102_col0\" class=\"data row102 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row102_col1\" class=\"data row102 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row102_col2\" class=\"data row102 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row102_col3\" class=\"data row102 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row102_col4\" class=\"data row102 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row102_col5\" class=\"data row102 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row103\" class=\"row_heading level0 row103\" >network_discovery_using_route_windows_app.yml</th>\n",
|
||
" <td id=\"T_3deed_row103_col0\" class=\"data row103 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row103_col1\" class=\"data row103 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row103_col2\" class=\"data row103 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row103_col3\" class=\"data row103 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row103_col4\" class=\"data row103 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row103_col5\" class=\"data row103 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row104\" class=\"row_heading level0 row104\" >office_product_spawning_windows_script_host.yml</th>\n",
|
||
" <td id=\"T_3deed_row104_col0\" class=\"data row104 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row104_col1\" class=\"data row104 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row104_col2\" class=\"data row104 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row104_col3\" class=\"data row104 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row104_col4\" class=\"data row104 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row104_col5\" class=\"data row104 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row105\" class=\"row_heading level0 row105\" >create_local_admin_accounts_using_net_exe.yml</th>\n",
|
||
" <td id=\"T_3deed_row105_col0\" class=\"data row105 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row105_col1\" class=\"data row105 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row105_col2\" class=\"data row105 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row105_col3\" class=\"data row105 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row105_col4\" class=\"data row105 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row105_col5\" class=\"data row105 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row106\" class=\"row_heading level0 row106\" >suspicious_image_creation_in_appdata_folder.yml</th>\n",
|
||
" <td id=\"T_3deed_row106_col0\" class=\"data row106 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row106_col1\" class=\"data row106 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row106_col2\" class=\"data row106 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row106_col3\" class=\"data row106 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row106_col4\" class=\"data row106 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row106_col5\" class=\"data row106 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row107\" class=\"row_heading level0 row107\" >cobalt_strike_named_pipes.yml</th>\n",
|
||
" <td id=\"T_3deed_row107_col0\" class=\"data row107 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row107_col1\" class=\"data row107 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row107_col2\" class=\"data row107 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row107_col3\" class=\"data row107 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row107_col4\" class=\"data row107 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row107_col5\" class=\"data row107 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row108\" class=\"row_heading level0 row108\" >windows_dll_side_loading_in_calc.yml</th>\n",
|
||
" <td id=\"T_3deed_row108_col0\" class=\"data row108 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row108_col1\" class=\"data row108 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row108_col2\" class=\"data row108 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row108_col3\" class=\"data row108 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row108_col4\" class=\"data row108 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row108_col5\" class=\"data row108 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row109\" class=\"row_heading level0 row109\" >remcos_client_registry_install_entry.yml</th>\n",
|
||
" <td id=\"T_3deed_row109_col0\" class=\"data row109 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row109_col1\" class=\"data row109 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row109_col2\" class=\"data row109 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row109_col3\" class=\"data row109 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row109_col4\" class=\"data row109 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row109_col5\" class=\"data row109 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row110\" class=\"row_heading level0 row110\" >powershell_loading_dotnet_into_memory_via_reflection.yml</th>\n",
|
||
" <td id=\"T_3deed_row110_col0\" class=\"data row110 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row110_col1\" class=\"data row110 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row110_col2\" class=\"data row110 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row110_col3\" class=\"data row110 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row110_col4\" class=\"data row110 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row110_col5\" class=\"data row110 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row111\" class=\"row_heading level0 row111\" >suspicious_scheduled_task_from_public_directory.yml</th>\n",
|
||
" <td id=\"T_3deed_row111_col0\" class=\"data row111 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row111_col1\" class=\"data row111 col1\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row111_col2\" class=\"data row111 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row111_col3\" class=\"data row111 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row111_col4\" class=\"data row111 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row111_col5\" class=\"data row111 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row112\" class=\"row_heading level0 row112\" >recon_avproduct_through_pwh_or_wmi.yml</th>\n",
|
||
" <td id=\"T_3deed_row112_col0\" class=\"data row112 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row112_col1\" class=\"data row112 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row112_col2\" class=\"data row112 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row112_col3\" class=\"data row112 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row112_col4\" class=\"data row112 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row112_col5\" class=\"data row112 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row113\" class=\"row_heading level0 row113\" >suspicious_regsvr32_register_suspicious_path.yml</th>\n",
|
||
" <td id=\"T_3deed_row113_col0\" class=\"data row113 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row113_col1\" class=\"data row113 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row113_col2\" class=\"data row113 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row113_col3\" class=\"data row113 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row113_col4\" class=\"data row113 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row113_col5\" class=\"data row113 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row114\" class=\"row_heading level0 row114\" >windows_drivers_loaded_by_signature.yml</th>\n",
|
||
" <td id=\"T_3deed_row114_col0\" class=\"data row114 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row114_col1\" class=\"data row114 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row114_col2\" class=\"data row114 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row114_col3\" class=\"data row114 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row114_col4\" class=\"data row114 col4\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row114_col5\" class=\"data row114 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row115\" class=\"row_heading level0 row115\" >malicious_powershell_process___encoded_command.yml</th>\n",
|
||
" <td id=\"T_3deed_row115_col0\" class=\"data row115 col0\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row115_col1\" class=\"data row115 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row115_col2\" class=\"data row115 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row115_col3\" class=\"data row115 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row115_col4\" class=\"data row115 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row115_col5\" class=\"data row115 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row116\" class=\"row_heading level0 row116\" >mshta_spawning_rundll32_or_regsvr32_process.yml</th>\n",
|
||
" <td id=\"T_3deed_row116_col0\" class=\"data row116 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row116_col1\" class=\"data row116 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row116_col2\" class=\"data row116 col2\" >no</td>\n",
|
||
" <td id=\"T_3deed_row116_col3\" class=\"data row116 col3\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row116_col4\" class=\"data row116 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row116_col5\" class=\"data row116 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_3deed_level0_row117\" class=\"row_heading level0 row117\" >malicious_inprocserver32_modification.yml</th>\n",
|
||
" <td id=\"T_3deed_row117_col0\" class=\"data row117 col0\" >no</td>\n",
|
||
" <td id=\"T_3deed_row117_col1\" class=\"data row117 col1\" >no</td>\n",
|
||
" <td id=\"T_3deed_row117_col2\" class=\"data row117 col2\" >yes</td>\n",
|
||
" <td id=\"T_3deed_row117_col3\" class=\"data row117 col3\" >no</td>\n",
|
||
" <td id=\"T_3deed_row117_col4\" class=\"data row117 col4\" >no</td>\n",
|
||
" <td id=\"T_3deed_row117_col5\" class=\"data row117 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x10cbbca90>"
|
||
]
|
||
},
|
||
"execution_count": 40,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 1]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "e144114f-2282-4169-a577-d690bfc6dbd9",
|
||
"metadata": {},
|
||
"source": [
|
||
"### truth table mitre attack id vs analytic story (malware family)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 41,
|
||
"id": "ee827b0f-acff-4bf6-830e-4e0ec732b932",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(74, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_8ad61_row0_col0, #T_8ad61_row0_col1, #T_8ad61_row0_col2, #T_8ad61_row0_col3, #T_8ad61_row0_col4, #T_8ad61_row0_col5, #T_8ad61_row1_col0, #T_8ad61_row1_col1, #T_8ad61_row1_col2, #T_8ad61_row1_col3, #T_8ad61_row1_col4, #T_8ad61_row1_col5, #T_8ad61_row2_col0, #T_8ad61_row2_col1, #T_8ad61_row2_col2, #T_8ad61_row2_col3, #T_8ad61_row2_col4, #T_8ad61_row2_col5, #T_8ad61_row3_col0, #T_8ad61_row3_col1, #T_8ad61_row3_col2, #T_8ad61_row3_col3, #T_8ad61_row3_col4, #T_8ad61_row3_col5, #T_8ad61_row4_col0, #T_8ad61_row4_col1, #T_8ad61_row4_col2, #T_8ad61_row4_col3, #T_8ad61_row4_col4, #T_8ad61_row4_col5, #T_8ad61_row5_col0, #T_8ad61_row5_col1, #T_8ad61_row5_col2, #T_8ad61_row5_col3, #T_8ad61_row5_col4, #T_8ad61_row5_col5, #T_8ad61_row6_col0, #T_8ad61_row6_col1, #T_8ad61_row6_col2, #T_8ad61_row6_col3, #T_8ad61_row6_col4, #T_8ad61_row6_col5 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_8ad61_row7_col0, #T_8ad61_row7_col1, #T_8ad61_row7_col2, #T_8ad61_row7_col3, #T_8ad61_row7_col4, #T_8ad61_row7_col5, #T_8ad61_row8_col0, #T_8ad61_row8_col1, #T_8ad61_row8_col2, #T_8ad61_row8_col3, #T_8ad61_row8_col4, #T_8ad61_row8_col5, #T_8ad61_row9_col0, #T_8ad61_row9_col1, #T_8ad61_row9_col2, #T_8ad61_row9_col3, #T_8ad61_row9_col4, #T_8ad61_row9_col5, #T_8ad61_row10_col0, #T_8ad61_row10_col1, #T_8ad61_row10_col2, #T_8ad61_row10_col3, #T_8ad61_row10_col4, #T_8ad61_row10_col5, #T_8ad61_row11_col0, #T_8ad61_row11_col1, #T_8ad61_row11_col2, #T_8ad61_row11_col3, #T_8ad61_row11_col4, #T_8ad61_row11_col5 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_8ad61_row12_col0, #T_8ad61_row12_col1, #T_8ad61_row12_col2, #T_8ad61_row12_col3, #T_8ad61_row12_col4, #T_8ad61_row12_col5, #T_8ad61_row13_col0, #T_8ad61_row13_col1, #T_8ad61_row13_col2, #T_8ad61_row13_col3, #T_8ad61_row13_col4, #T_8ad61_row13_col5, #T_8ad61_row14_col0, #T_8ad61_row14_col1, #T_8ad61_row14_col2, #T_8ad61_row14_col3, #T_8ad61_row14_col4, #T_8ad61_row14_col5, #T_8ad61_row15_col0, #T_8ad61_row15_col1, #T_8ad61_row15_col2, #T_8ad61_row15_col3, #T_8ad61_row15_col4, #T_8ad61_row15_col5, #T_8ad61_row16_col0, #T_8ad61_row16_col1, #T_8ad61_row16_col2, #T_8ad61_row16_col3, #T_8ad61_row16_col4, #T_8ad61_row16_col5, #T_8ad61_row17_col0, #T_8ad61_row17_col1, #T_8ad61_row17_col2, #T_8ad61_row17_col3, #T_8ad61_row17_col4, #T_8ad61_row17_col5, #T_8ad61_row18_col0, #T_8ad61_row18_col1, #T_8ad61_row18_col2, #T_8ad61_row18_col3, #T_8ad61_row18_col4, #T_8ad61_row18_col5, #T_8ad61_row19_col0, #T_8ad61_row19_col1, #T_8ad61_row19_col2, #T_8ad61_row19_col3, #T_8ad61_row19_col4, #T_8ad61_row19_col5, #T_8ad61_row20_col0, #T_8ad61_row20_col1, #T_8ad61_row20_col2, #T_8ad61_row20_col3, #T_8ad61_row20_col4, #T_8ad61_row20_col5, #T_8ad61_row21_col0, #T_8ad61_row21_col1, #T_8ad61_row21_col2, #T_8ad61_row21_col3, #T_8ad61_row21_col4, #T_8ad61_row21_col5, #T_8ad61_row22_col0, #T_8ad61_row22_col1, #T_8ad61_row22_col2, #T_8ad61_row22_col3, #T_8ad61_row22_col4, #T_8ad61_row22_col5 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_8ad61_row23_col0, #T_8ad61_row23_col1, #T_8ad61_row23_col2, #T_8ad61_row23_col3, #T_8ad61_row23_col4, #T_8ad61_row23_col5, #T_8ad61_row24_col0, #T_8ad61_row24_col1, #T_8ad61_row24_col2, #T_8ad61_row24_col3, #T_8ad61_row24_col4, #T_8ad61_row24_col5, #T_8ad61_row25_col0, #T_8ad61_row25_col1, #T_8ad61_row25_col2, #T_8ad61_row25_col3, #T_8ad61_row25_col4, #T_8ad61_row25_col5, #T_8ad61_row26_col0, #T_8ad61_row26_col1, #T_8ad61_row26_col2, #T_8ad61_row26_col3, #T_8ad61_row26_col4, #T_8ad61_row26_col5, #T_8ad61_row27_col0, #T_8ad61_row27_col1, #T_8ad61_row27_col2, #T_8ad61_row27_col3, #T_8ad61_row27_col4, #T_8ad61_row27_col5, #T_8ad61_row28_col0, #T_8ad61_row28_col1, #T_8ad61_row28_col2, #T_8ad61_row28_col3, #T_8ad61_row28_col4, #T_8ad61_row28_col5, #T_8ad61_row29_col0, #T_8ad61_row29_col1, #T_8ad61_row29_col2, #T_8ad61_row29_col3, #T_8ad61_row29_col4, #T_8ad61_row29_col5, #T_8ad61_row30_col0, #T_8ad61_row30_col1, #T_8ad61_row30_col2, #T_8ad61_row30_col3, #T_8ad61_row30_col4, #T_8ad61_row30_col5, #T_8ad61_row31_col0, #T_8ad61_row31_col1, #T_8ad61_row31_col2, #T_8ad61_row31_col3, #T_8ad61_row31_col4, #T_8ad61_row31_col5, #T_8ad61_row32_col0, #T_8ad61_row32_col1, #T_8ad61_row32_col2, #T_8ad61_row32_col3, #T_8ad61_row32_col4, #T_8ad61_row32_col5, #T_8ad61_row33_col0, #T_8ad61_row33_col1, #T_8ad61_row33_col2, #T_8ad61_row33_col3, #T_8ad61_row33_col4, #T_8ad61_row33_col5, #T_8ad61_row34_col0, #T_8ad61_row34_col1, #T_8ad61_row34_col2, #T_8ad61_row34_col3, #T_8ad61_row34_col4, #T_8ad61_row34_col5 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_8ad61_row35_col0, #T_8ad61_row35_col1, #T_8ad61_row35_col2, #T_8ad61_row35_col3, #T_8ad61_row35_col4, #T_8ad61_row35_col5, #T_8ad61_row36_col0, #T_8ad61_row36_col1, #T_8ad61_row36_col2, #T_8ad61_row36_col3, #T_8ad61_row36_col4, #T_8ad61_row36_col5, #T_8ad61_row37_col0, #T_8ad61_row37_col1, #T_8ad61_row37_col2, #T_8ad61_row37_col3, #T_8ad61_row37_col4, #T_8ad61_row37_col5, #T_8ad61_row38_col0, #T_8ad61_row38_col1, #T_8ad61_row38_col2, #T_8ad61_row38_col3, #T_8ad61_row38_col4, #T_8ad61_row38_col5, #T_8ad61_row39_col0, #T_8ad61_row39_col1, #T_8ad61_row39_col2, #T_8ad61_row39_col3, #T_8ad61_row39_col4, #T_8ad61_row39_col5, #T_8ad61_row40_col0, #T_8ad61_row40_col1, #T_8ad61_row40_col2, #T_8ad61_row40_col3, #T_8ad61_row40_col4, #T_8ad61_row40_col5, #T_8ad61_row41_col0, #T_8ad61_row41_col1, #T_8ad61_row41_col2, #T_8ad61_row41_col3, #T_8ad61_row41_col4, #T_8ad61_row41_col5, #T_8ad61_row42_col0, #T_8ad61_row42_col1, #T_8ad61_row42_col2, #T_8ad61_row42_col3, #T_8ad61_row42_col4, #T_8ad61_row42_col5, #T_8ad61_row43_col0, #T_8ad61_row43_col1, #T_8ad61_row43_col2, #T_8ad61_row43_col3, #T_8ad61_row43_col4, #T_8ad61_row43_col5, #T_8ad61_row44_col0, #T_8ad61_row44_col1, #T_8ad61_row44_col2, #T_8ad61_row44_col3, #T_8ad61_row44_col4, #T_8ad61_row44_col5, #T_8ad61_row45_col0, #T_8ad61_row45_col1, #T_8ad61_row45_col2, #T_8ad61_row45_col3, #T_8ad61_row45_col4, #T_8ad61_row45_col5, #T_8ad61_row46_col0, #T_8ad61_row46_col1, #T_8ad61_row46_col2, #T_8ad61_row46_col3, #T_8ad61_row46_col4, #T_8ad61_row46_col5, #T_8ad61_row47_col0, #T_8ad61_row47_col1, #T_8ad61_row47_col2, #T_8ad61_row47_col3, #T_8ad61_row47_col4, #T_8ad61_row47_col5, #T_8ad61_row48_col0, #T_8ad61_row48_col1, #T_8ad61_row48_col2, #T_8ad61_row48_col3, #T_8ad61_row48_col4, #T_8ad61_row48_col5, #T_8ad61_row49_col0, #T_8ad61_row49_col1, #T_8ad61_row49_col2, #T_8ad61_row49_col3, #T_8ad61_row49_col4, #T_8ad61_row49_col5, #T_8ad61_row50_col0, #T_8ad61_row50_col1, #T_8ad61_row50_col2, #T_8ad61_row50_col3, #T_8ad61_row50_col4, #T_8ad61_row50_col5, #T_8ad61_row51_col0, #T_8ad61_row51_col1, #T_8ad61_row51_col2, #T_8ad61_row51_col3, #T_8ad61_row51_col4, #T_8ad61_row51_col5, #T_8ad61_row52_col0, #T_8ad61_row52_col1, #T_8ad61_row52_col2, #T_8ad61_row52_col3, #T_8ad61_row52_col4, #T_8ad61_row52_col5, #T_8ad61_row53_col0, #T_8ad61_row53_col1, #T_8ad61_row53_col2, #T_8ad61_row53_col3, #T_8ad61_row53_col4, #T_8ad61_row53_col5, #T_8ad61_row54_col0, #T_8ad61_row54_col1, #T_8ad61_row54_col2, #T_8ad61_row54_col3, #T_8ad61_row54_col4, #T_8ad61_row54_col5, #T_8ad61_row55_col0, #T_8ad61_row55_col1, #T_8ad61_row55_col2, #T_8ad61_row55_col3, #T_8ad61_row55_col4, #T_8ad61_row55_col5, #T_8ad61_row56_col0, #T_8ad61_row56_col1, #T_8ad61_row56_col2, #T_8ad61_row56_col3, #T_8ad61_row56_col4, #T_8ad61_row56_col5, #T_8ad61_row57_col0, #T_8ad61_row57_col1, #T_8ad61_row57_col2, #T_8ad61_row57_col3, #T_8ad61_row57_col4, #T_8ad61_row57_col5, #T_8ad61_row58_col0, #T_8ad61_row58_col1, #T_8ad61_row58_col2, #T_8ad61_row58_col3, #T_8ad61_row58_col4, #T_8ad61_row58_col5, #T_8ad61_row59_col0, #T_8ad61_row59_col1, #T_8ad61_row59_col2, #T_8ad61_row59_col3, #T_8ad61_row59_col4, #T_8ad61_row59_col5, #T_8ad61_row60_col0, #T_8ad61_row60_col1, #T_8ad61_row60_col2, #T_8ad61_row60_col3, #T_8ad61_row60_col4, #T_8ad61_row60_col5, #T_8ad61_row61_col0, #T_8ad61_row61_col1, #T_8ad61_row61_col2, #T_8ad61_row61_col3, #T_8ad61_row61_col4, #T_8ad61_row61_col5, #T_8ad61_row62_col0, #T_8ad61_row62_col1, #T_8ad61_row62_col2, #T_8ad61_row62_col3, #T_8ad61_row62_col4, #T_8ad61_row62_col5, #T_8ad61_row63_col0, #T_8ad61_row63_col1, #T_8ad61_row63_col2, #T_8ad61_row63_col3, #T_8ad61_row63_col4, #T_8ad61_row63_col5, #T_8ad61_row64_col0, #T_8ad61_row64_col1, #T_8ad61_row64_col2, #T_8ad61_row64_col3, #T_8ad61_row64_col4, #T_8ad61_row64_col5, #T_8ad61_row65_col0, #T_8ad61_row65_col1, #T_8ad61_row65_col2, #T_8ad61_row65_col3, #T_8ad61_row65_col4, #T_8ad61_row65_col5, #T_8ad61_row66_col0, #T_8ad61_row66_col1, #T_8ad61_row66_col2, #T_8ad61_row66_col3, #T_8ad61_row66_col4, #T_8ad61_row66_col5, #T_8ad61_row67_col0, #T_8ad61_row67_col1, #T_8ad61_row67_col2, #T_8ad61_row67_col3, #T_8ad61_row67_col4, #T_8ad61_row67_col5, #T_8ad61_row68_col0, #T_8ad61_row68_col1, #T_8ad61_row68_col2, #T_8ad61_row68_col3, #T_8ad61_row68_col4, #T_8ad61_row68_col5, #T_8ad61_row69_col0, #T_8ad61_row69_col1, #T_8ad61_row69_col2, #T_8ad61_row69_col3, #T_8ad61_row69_col4, #T_8ad61_row69_col5, #T_8ad61_row70_col0, #T_8ad61_row70_col1, #T_8ad61_row70_col2, #T_8ad61_row70_col3, #T_8ad61_row70_col4, #T_8ad61_row70_col5, #T_8ad61_row71_col0, #T_8ad61_row71_col1, #T_8ad61_row71_col2, #T_8ad61_row71_col3, #T_8ad61_row71_col4, #T_8ad61_row71_col5, #T_8ad61_row72_col0, #T_8ad61_row72_col1, #T_8ad61_row72_col2, #T_8ad61_row72_col3, #T_8ad61_row72_col4, #T_8ad61_row72_col5, #T_8ad61_row73_col0, #T_8ad61_row73_col1, #T_8ad61_row73_col2, #T_8ad61_row73_col3, #T_8ad61_row73_col4, #T_8ad61_row73_col5 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_8ad61\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_8ad61_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_8ad61_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_8ad61_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_8ad61_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_8ad61_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_8ad61_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row0\" class=\"row_heading level0 row0\" >T1562.001</th>\n",
|
||
" <td id=\"T_8ad61_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row0_col5\" class=\"data row0 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row1\" class=\"row_heading level0 row1\" >T1036</th>\n",
|
||
" <td id=\"T_8ad61_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row1_col5\" class=\"data row1 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row2\" class=\"row_heading level0 row2\" >T1566</th>\n",
|
||
" <td id=\"T_8ad61_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row2_col5\" class=\"data row2 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row3\" class=\"row_heading level0 row3\" >T1566.001</th>\n",
|
||
" <td id=\"T_8ad61_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row3_col5\" class=\"data row3 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row4\" class=\"row_heading level0 row4\" >T1562</th>\n",
|
||
" <td id=\"T_8ad61_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row4_col5\" class=\"data row4 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row5\" class=\"row_heading level0 row5\" >T1543</th>\n",
|
||
" <td id=\"T_8ad61_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row5_col5\" class=\"data row5 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row6\" class=\"row_heading level0 row6\" >T1059</th>\n",
|
||
" <td id=\"T_8ad61_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row6_col5\" class=\"data row6 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row7\" class=\"row_heading level0 row7\" >T1053.005</th>\n",
|
||
" <td id=\"T_8ad61_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row7_col2\" class=\"data row7 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row7_col3\" class=\"data row7 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row7_col4\" class=\"data row7 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row7_col5\" class=\"data row7 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row8\" class=\"row_heading level0 row8\" >T1204.001</th>\n",
|
||
" <td id=\"T_8ad61_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row8_col5\" class=\"data row8 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row9\" class=\"row_heading level0 row9\" >T1204</th>\n",
|
||
" <td id=\"T_8ad61_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row9_col4\" class=\"data row9 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row9_col5\" class=\"data row9 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row10\" class=\"row_heading level0 row10\" >T1053</th>\n",
|
||
" <td id=\"T_8ad61_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row10_col2\" class=\"data row10 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row10_col5\" class=\"data row10 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row11\" class=\"row_heading level0 row11\" >T1218</th>\n",
|
||
" <td id=\"T_8ad61_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row11_col1\" class=\"data row11 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row11_col3\" class=\"data row11 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row11_col4\" class=\"data row11 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row11_col5\" class=\"data row11 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row12\" class=\"row_heading level0 row12\" >T1543.003</th>\n",
|
||
" <td id=\"T_8ad61_row12_col0\" class=\"data row12 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row12_col2\" class=\"data row12 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row12_col3\" class=\"data row12 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row12_col4\" class=\"data row12 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row12_col5\" class=\"data row12 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row13\" class=\"row_heading level0 row13\" >T1548.002</th>\n",
|
||
" <td id=\"T_8ad61_row13_col0\" class=\"data row13 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row13_col1\" class=\"data row13 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row13_col2\" class=\"data row13 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row13_col3\" class=\"data row13 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row13_col4\" class=\"data row13 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row13_col5\" class=\"data row13 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row14\" class=\"row_heading level0 row14\" >T1059.001</th>\n",
|
||
" <td id=\"T_8ad61_row14_col0\" class=\"data row14 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row14_col2\" class=\"data row14 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row14_col3\" class=\"data row14 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row14_col4\" class=\"data row14 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row14_col5\" class=\"data row14 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row15\" class=\"row_heading level0 row15\" >T1548</th>\n",
|
||
" <td id=\"T_8ad61_row15_col0\" class=\"data row15 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row15_col3\" class=\"data row15 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row15_col4\" class=\"data row15 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row15_col5\" class=\"data row15 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row16\" class=\"row_heading level0 row16\" >T1555</th>\n",
|
||
" <td id=\"T_8ad61_row16_col0\" class=\"data row16 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row16_col1\" class=\"data row16 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row16_col3\" class=\"data row16 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row16_col4\" class=\"data row16 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row16_col5\" class=\"data row16 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row17\" class=\"row_heading level0 row17\" >T1547.001</th>\n",
|
||
" <td id=\"T_8ad61_row17_col0\" class=\"data row17 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row17_col2\" class=\"data row17 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row17_col3\" class=\"data row17 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row17_col4\" class=\"data row17 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row17_col5\" class=\"data row17 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row18\" class=\"row_heading level0 row18\" >T1555.003</th>\n",
|
||
" <td id=\"T_8ad61_row18_col0\" class=\"data row18 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row18_col2\" class=\"data row18 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row18_col3\" class=\"data row18 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row18_col4\" class=\"data row18 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row18_col5\" class=\"data row18 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row19\" class=\"row_heading level0 row19\" >T1112</th>\n",
|
||
" <td id=\"T_8ad61_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row19_col2\" class=\"data row19 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row19_col3\" class=\"data row19 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row19_col4\" class=\"data row19 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row19_col5\" class=\"data row19 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row20\" class=\"row_heading level0 row20\" >T1071</th>\n",
|
||
" <td id=\"T_8ad61_row20_col0\" class=\"data row20 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row20_col2\" class=\"data row20 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row20_col3\" class=\"data row20 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row20_col4\" class=\"data row20 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row20_col5\" class=\"data row20 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row21\" class=\"row_heading level0 row21\" >T1547</th>\n",
|
||
" <td id=\"T_8ad61_row21_col0\" class=\"data row21 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row21_col2\" class=\"data row21 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row21_col3\" class=\"data row21 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row21_col4\" class=\"data row21 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row21_col5\" class=\"data row21 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row22\" class=\"row_heading level0 row22\" >T1055</th>\n",
|
||
" <td id=\"T_8ad61_row22_col0\" class=\"data row22 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row22_col1\" class=\"data row22 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row22_col2\" class=\"data row22 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row22_col3\" class=\"data row22 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row22_col4\" class=\"data row22 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row22_col5\" class=\"data row22 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row23\" class=\"row_heading level0 row23\" >T1049</th>\n",
|
||
" <td id=\"T_8ad61_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row23_col1\" class=\"data row23 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row23_col2\" class=\"data row23 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row23_col3\" class=\"data row23 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row23_col4\" class=\"data row23 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row23_col5\" class=\"data row23 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row24\" class=\"row_heading level0 row24\" >T1592</th>\n",
|
||
" <td id=\"T_8ad61_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row24_col1\" class=\"data row24 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row24_col2\" class=\"data row24 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row24_col3\" class=\"data row24 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row24_col4\" class=\"data row24 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row24_col5\" class=\"data row24 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row25\" class=\"row_heading level0 row25\" >T1021</th>\n",
|
||
" <td id=\"T_8ad61_row25_col0\" class=\"data row25 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row25_col1\" class=\"data row25 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row25_col2\" class=\"data row25 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row25_col3\" class=\"data row25 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row25_col4\" class=\"data row25 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row25_col5\" class=\"data row25 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row26\" class=\"row_heading level0 row26\" >T1027</th>\n",
|
||
" <td id=\"T_8ad61_row26_col0\" class=\"data row26 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row26_col1\" class=\"data row26 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row26_col2\" class=\"data row26 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row26_col3\" class=\"data row26 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row26_col4\" class=\"data row26 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row26_col5\" class=\"data row26 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row27\" class=\"row_heading level0 row27\" >T1055.001</th>\n",
|
||
" <td id=\"T_8ad61_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row27_col1\" class=\"data row27 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row27_col2\" class=\"data row27 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row27_col3\" class=\"data row27 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row27_col4\" class=\"data row27 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row27_col5\" class=\"data row27 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row28\" class=\"row_heading level0 row28\" >T1590</th>\n",
|
||
" <td id=\"T_8ad61_row28_col0\" class=\"data row28 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row28_col2\" class=\"data row28 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row28_col3\" class=\"data row28 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row28_col4\" class=\"data row28 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row28_col5\" class=\"data row28 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row29\" class=\"row_heading level0 row29\" >T1059.003</th>\n",
|
||
" <td id=\"T_8ad61_row29_col0\" class=\"data row29 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row29_col1\" class=\"data row29 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row29_col2\" class=\"data row29 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row29_col3\" class=\"data row29 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row29_col4\" class=\"data row29 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row29_col5\" class=\"data row29 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row30\" class=\"row_heading level0 row30\" >T1218.010</th>\n",
|
||
" <td id=\"T_8ad61_row30_col0\" class=\"data row30 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row30_col1\" class=\"data row30 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row30_col2\" class=\"data row30 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row30_col3\" class=\"data row30 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row30_col4\" class=\"data row30 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row30_col5\" class=\"data row30 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row31\" class=\"row_heading level0 row31\" >T1590.005</th>\n",
|
||
" <td id=\"T_8ad61_row31_col0\" class=\"data row31 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row31_col1\" class=\"data row31 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row31_col2\" class=\"data row31 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row31_col3\" class=\"data row31 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row31_col4\" class=\"data row31 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row31_col5\" class=\"data row31 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row32\" class=\"row_heading level0 row32\" >T1059.007</th>\n",
|
||
" <td id=\"T_8ad61_row32_col0\" class=\"data row32 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row32_col1\" class=\"data row32 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row32_col2\" class=\"data row32 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row32_col3\" class=\"data row32 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row32_col4\" class=\"data row32 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row32_col5\" class=\"data row32 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row33\" class=\"row_heading level0 row33\" >T1569</th>\n",
|
||
" <td id=\"T_8ad61_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row33_col1\" class=\"data row33 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row33_col2\" class=\"data row33 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row33_col3\" class=\"data row33 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row33_col4\" class=\"data row33 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row33_col5\" class=\"data row33 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row34\" class=\"row_heading level0 row34\" >T1569.002</th>\n",
|
||
" <td id=\"T_8ad61_row34_col0\" class=\"data row34 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row34_col2\" class=\"data row34 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row34_col3\" class=\"data row34 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row34_col4\" class=\"data row34 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row34_col5\" class=\"data row34 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row35\" class=\"row_heading level0 row35\" >T1087.002</th>\n",
|
||
" <td id=\"T_8ad61_row35_col0\" class=\"data row35 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row35_col1\" class=\"data row35 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row35_col2\" class=\"data row35 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row35_col3\" class=\"data row35 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row35_col4\" class=\"data row35 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row35_col5\" class=\"data row35 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row36\" class=\"row_heading level0 row36\" >T1087</th>\n",
|
||
" <td id=\"T_8ad61_row36_col0\" class=\"data row36 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row36_col1\" class=\"data row36 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row36_col2\" class=\"data row36 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row36_col3\" class=\"data row36 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row36_col4\" class=\"data row36 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row36_col5\" class=\"data row36 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row37\" class=\"row_heading level0 row37\" >T1218.011</th>\n",
|
||
" <td id=\"T_8ad61_row37_col0\" class=\"data row37 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row37_col1\" class=\"data row37 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row37_col2\" class=\"data row37 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row37_col3\" class=\"data row37 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row37_col4\" class=\"data row37 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row37_col5\" class=\"data row37 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row38\" class=\"row_heading level0 row38\" >T1218.001</th>\n",
|
||
" <td id=\"T_8ad61_row38_col0\" class=\"data row38 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row38_col1\" class=\"data row38 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row38_col2\" class=\"data row38 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row38_col3\" class=\"data row38 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row38_col4\" class=\"data row38 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row38_col5\" class=\"data row38 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row39\" class=\"row_heading level0 row39\" >T1021.002</th>\n",
|
||
" <td id=\"T_8ad61_row39_col0\" class=\"data row39 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row39_col1\" class=\"data row39 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row39_col2\" class=\"data row39 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row39_col3\" class=\"data row39 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row39_col4\" class=\"data row39 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row39_col5\" class=\"data row39 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row40\" class=\"row_heading level0 row40\" >T1564.001</th>\n",
|
||
" <td id=\"T_8ad61_row40_col0\" class=\"data row40 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row40_col1\" class=\"data row40 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row40_col2\" class=\"data row40 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row40_col3\" class=\"data row40 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row40_col4\" class=\"data row40 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row40_col5\" class=\"data row40 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row41\" class=\"row_heading level0 row41\" >T1482</th>\n",
|
||
" <td id=\"T_8ad61_row41_col0\" class=\"data row41 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row41_col1\" class=\"data row41 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row41_col2\" class=\"data row41 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row41_col3\" class=\"data row41 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row41_col4\" class=\"data row41 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row41_col5\" class=\"data row41 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row42\" class=\"row_heading level0 row42\" >T1564</th>\n",
|
||
" <td id=\"T_8ad61_row42_col0\" class=\"data row42 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row42_col1\" class=\"data row42 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row42_col2\" class=\"data row42 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row42_col3\" class=\"data row42 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row42_col4\" class=\"data row42 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row42_col5\" class=\"data row42 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row43\" class=\"row_heading level0 row43\" >T1559.001</th>\n",
|
||
" <td id=\"T_8ad61_row43_col0\" class=\"data row43 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row43_col1\" class=\"data row43 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row43_col2\" class=\"data row43 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row43_col3\" class=\"data row43 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row43_col4\" class=\"data row43 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row43_col5\" class=\"data row43 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row44\" class=\"row_heading level0 row44\" >T1566.002</th>\n",
|
||
" <td id=\"T_8ad61_row44_col0\" class=\"data row44 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row44_col1\" class=\"data row44 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row44_col2\" class=\"data row44 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row44_col3\" class=\"data row44 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row44_col4\" class=\"data row44 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row44_col5\" class=\"data row44 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row45\" class=\"row_heading level0 row45\" >T1222.001</th>\n",
|
||
" <td id=\"T_8ad61_row45_col0\" class=\"data row45 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row45_col1\" class=\"data row45 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row45_col2\" class=\"data row45 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row45_col3\" class=\"data row45 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row45_col4\" class=\"data row45 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row45_col5\" class=\"data row45 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row46\" class=\"row_heading level0 row46\" >T1134.004</th>\n",
|
||
" <td id=\"T_8ad61_row46_col0\" class=\"data row46 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row46_col1\" class=\"data row46 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row46_col2\" class=\"data row46 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row46_col3\" class=\"data row46 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row46_col4\" class=\"data row46 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row46_col5\" class=\"data row46 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row47\" class=\"row_heading level0 row47\" >T1134</th>\n",
|
||
" <td id=\"T_8ad61_row47_col0\" class=\"data row47 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row47_col1\" class=\"data row47 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row47_col2\" class=\"data row47 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row47_col3\" class=\"data row47 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row47_col4\" class=\"data row47 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row47_col5\" class=\"data row47 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row48\" class=\"row_heading level0 row48\" >T1574.001</th>\n",
|
||
" <td id=\"T_8ad61_row48_col0\" class=\"data row48 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row48_col1\" class=\"data row48 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row48_col2\" class=\"data row48 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row48_col3\" class=\"data row48 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row48_col4\" class=\"data row48 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row48_col5\" class=\"data row48 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row49\" class=\"row_heading level0 row49\" >T1069</th>\n",
|
||
" <td id=\"T_8ad61_row49_col0\" class=\"data row49 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row49_col1\" class=\"data row49 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row49_col2\" class=\"data row49 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row49_col3\" class=\"data row49 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row49_col4\" class=\"data row49 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row49_col5\" class=\"data row49 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row50\" class=\"row_heading level0 row50\" >T1069.001</th>\n",
|
||
" <td id=\"T_8ad61_row50_col0\" class=\"data row50 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row50_col1\" class=\"data row50 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row50_col2\" class=\"data row50 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row50_col3\" class=\"data row50 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row50_col4\" class=\"data row50 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row50_col5\" class=\"data row50 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row51\" class=\"row_heading level0 row51\" >T1059.005</th>\n",
|
||
" <td id=\"T_8ad61_row51_col0\" class=\"data row51 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row51_col1\" class=\"data row51 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row51_col2\" class=\"data row51 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row51_col3\" class=\"data row51 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row51_col4\" class=\"data row51 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row51_col5\" class=\"data row51 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row52\" class=\"row_heading level0 row52\" >T1021.001</th>\n",
|
||
" <td id=\"T_8ad61_row52_col0\" class=\"data row52 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row52_col1\" class=\"data row52 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row52_col2\" class=\"data row52 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row52_col3\" class=\"data row52 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row52_col4\" class=\"data row52 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row52_col5\" class=\"data row52 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row53\" class=\"row_heading level0 row53\" >T1531</th>\n",
|
||
" <td id=\"T_8ad61_row53_col0\" class=\"data row53 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row53_col1\" class=\"data row53 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row53_col2\" class=\"data row53 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row53_col3\" class=\"data row53 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row53_col4\" class=\"data row53 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row53_col5\" class=\"data row53 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row54\" class=\"row_heading level0 row54\" >T1036.003</th>\n",
|
||
" <td id=\"T_8ad61_row54_col0\" class=\"data row54 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row54_col1\" class=\"data row54 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row54_col2\" class=\"data row54 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row54_col3\" class=\"data row54 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row54_col4\" class=\"data row54 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row54_col5\" class=\"data row54 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row55\" class=\"row_heading level0 row55\" >T1489</th>\n",
|
||
" <td id=\"T_8ad61_row55_col0\" class=\"data row55 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row55_col2\" class=\"data row55 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row55_col3\" class=\"data row55 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row55_col4\" class=\"data row55 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row55_col5\" class=\"data row55 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row56\" class=\"row_heading level0 row56\" >T1222</th>\n",
|
||
" <td id=\"T_8ad61_row56_col0\" class=\"data row56 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row56_col2\" class=\"data row56 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row56_col3\" class=\"data row56 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row56_col4\" class=\"data row56 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row56_col5\" class=\"data row56 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row57\" class=\"row_heading level0 row57\" >T1562.004</th>\n",
|
||
" <td id=\"T_8ad61_row57_col0\" class=\"data row57 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row57_col1\" class=\"data row57 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row57_col2\" class=\"data row57 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row57_col3\" class=\"data row57 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row57_col4\" class=\"data row57 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row57_col5\" class=\"data row57 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row58\" class=\"row_heading level0 row58\" >T1047</th>\n",
|
||
" <td id=\"T_8ad61_row58_col0\" class=\"data row58 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row58_col1\" class=\"data row58 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row58_col2\" class=\"data row58 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row58_col3\" class=\"data row58 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row58_col4\" class=\"data row58 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row58_col5\" class=\"data row58 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row59\" class=\"row_heading level0 row59\" >T1574.002</th>\n",
|
||
" <td id=\"T_8ad61_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row59_col1\" class=\"data row59 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row59_col2\" class=\"data row59 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row59_col3\" class=\"data row59 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row59_col4\" class=\"data row59 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row59_col5\" class=\"data row59 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row60\" class=\"row_heading level0 row60\" >T1574</th>\n",
|
||
" <td id=\"T_8ad61_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row60_col1\" class=\"data row60 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row60_col2\" class=\"data row60 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row60_col3\" class=\"data row60 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row60_col4\" class=\"data row60 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row60_col5\" class=\"data row60 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row61\" class=\"row_heading level0 row61\" >T1113</th>\n",
|
||
" <td id=\"T_8ad61_row61_col0\" class=\"data row61 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row61_col1\" class=\"data row61 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row61_col2\" class=\"data row61 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row61_col3\" class=\"data row61 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row61_col4\" class=\"data row61 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row61_col5\" class=\"data row61 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row62\" class=\"row_heading level0 row62\" >T1016</th>\n",
|
||
" <td id=\"T_8ad61_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row62_col1\" class=\"data row62 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row62_col2\" class=\"data row62 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row62_col3\" class=\"data row62 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row62_col4\" class=\"data row62 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row62_col5\" class=\"data row62 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row63\" class=\"row_heading level0 row63\" >T1033</th>\n",
|
||
" <td id=\"T_8ad61_row63_col0\" class=\"data row63 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row63_col1\" class=\"data row63 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row63_col2\" class=\"data row63 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row63_col3\" class=\"data row63 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row63_col4\" class=\"data row63 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row63_col5\" class=\"data row63 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row64\" class=\"row_heading level0 row64\" >T1218.005</th>\n",
|
||
" <td id=\"T_8ad61_row64_col0\" class=\"data row64 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row64_col1\" class=\"data row64 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row64_col2\" class=\"data row64 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row64_col3\" class=\"data row64 col3\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row64_col4\" class=\"data row64 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row64_col5\" class=\"data row64 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row65\" class=\"row_heading level0 row65\" >T1014</th>\n",
|
||
" <td id=\"T_8ad61_row65_col0\" class=\"data row65 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row65_col1\" class=\"data row65 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row65_col2\" class=\"data row65 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row65_col3\" class=\"data row65 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row65_col4\" class=\"data row65 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row65_col5\" class=\"data row65 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row66\" class=\"row_heading level0 row66\" >T1068</th>\n",
|
||
" <td id=\"T_8ad61_row66_col0\" class=\"data row66 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row66_col1\" class=\"data row66 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row66_col2\" class=\"data row66 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row66_col3\" class=\"data row66 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row66_col4\" class=\"data row66 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row66_col5\" class=\"data row66 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row67\" class=\"row_heading level0 row67\" >T1219</th>\n",
|
||
" <td id=\"T_8ad61_row67_col0\" class=\"data row67 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row67_col1\" class=\"data row67 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row67_col2\" class=\"data row67 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row67_col3\" class=\"data row67 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row67_col4\" class=\"data row67 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row67_col5\" class=\"data row67 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row68\" class=\"row_heading level0 row68\" >T1055.002</th>\n",
|
||
" <td id=\"T_8ad61_row68_col0\" class=\"data row68 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row68_col1\" class=\"data row68 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row68_col2\" class=\"data row68 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row68_col3\" class=\"data row68 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row68_col4\" class=\"data row68 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row68_col5\" class=\"data row68 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row69\" class=\"row_heading level0 row69\" >T1136.001</th>\n",
|
||
" <td id=\"T_8ad61_row69_col0\" class=\"data row69 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row69_col1\" class=\"data row69 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row69_col2\" class=\"data row69 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row69_col3\" class=\"data row69 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row69_col4\" class=\"data row69 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row69_col5\" class=\"data row69 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row70\" class=\"row_heading level0 row70\" >T1136</th>\n",
|
||
" <td id=\"T_8ad61_row70_col0\" class=\"data row70 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row70_col1\" class=\"data row70 col1\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row70_col2\" class=\"data row70 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row70_col3\" class=\"data row70 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row70_col4\" class=\"data row70 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row70_col5\" class=\"data row70 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row71\" class=\"row_heading level0 row71\" >T1070</th>\n",
|
||
" <td id=\"T_8ad61_row71_col0\" class=\"data row71 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row71_col1\" class=\"data row71 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row71_col2\" class=\"data row71 col2\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row71_col3\" class=\"data row71 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row71_col4\" class=\"data row71 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row71_col5\" class=\"data row71 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row72\" class=\"row_heading level0 row72\" >T1071.003</th>\n",
|
||
" <td id=\"T_8ad61_row72_col0\" class=\"data row72 col0\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row72_col1\" class=\"data row72 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row72_col2\" class=\"data row72 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row72_col3\" class=\"data row72 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row72_col4\" class=\"data row72 col4\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row72_col5\" class=\"data row72 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_8ad61_level0_row73\" class=\"row_heading level0 row73\" >T1016.001</th>\n",
|
||
" <td id=\"T_8ad61_row73_col0\" class=\"data row73 col0\" >yes</td>\n",
|
||
" <td id=\"T_8ad61_row73_col1\" class=\"data row73 col1\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row73_col2\" class=\"data row73 col2\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row73_col3\" class=\"data row73 col3\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row73_col4\" class=\"data row73 col4\" >no</td>\n",
|
||
" <td id=\"T_8ad61_row73_col5\" class=\"data row73 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c1f3e80>"
|
||
]
|
||
},
|
||
"execution_count": 41,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"\n",
|
||
"new_table = yes_no_table(mitre_attack_tid_dict, story_name_list)\n",
|
||
"tdf = pd.DataFrame.from_dict(new_table, orient=\"index\")\n",
|
||
"tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n",
|
||
"tdf.style.apply(highlight_rows, axis=1) \n"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 42,
|
||
"id": "2f2a22c4-4204-4673-8130-9fa9a99cfa12",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(7, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_30260_row0_col0, #T_30260_row0_col1, #T_30260_row0_col2, #T_30260_row0_col3, #T_30260_row0_col4, #T_30260_row0_col5, #T_30260_row1_col0, #T_30260_row1_col1, #T_30260_row1_col2, #T_30260_row1_col3, #T_30260_row1_col4, #T_30260_row1_col5, #T_30260_row2_col0, #T_30260_row2_col1, #T_30260_row2_col2, #T_30260_row2_col3, #T_30260_row2_col4, #T_30260_row2_col5, #T_30260_row3_col0, #T_30260_row3_col1, #T_30260_row3_col2, #T_30260_row3_col3, #T_30260_row3_col4, #T_30260_row3_col5, #T_30260_row4_col0, #T_30260_row4_col1, #T_30260_row4_col2, #T_30260_row4_col3, #T_30260_row4_col4, #T_30260_row4_col5, #T_30260_row5_col0, #T_30260_row5_col1, #T_30260_row5_col2, #T_30260_row5_col3, #T_30260_row5_col4, #T_30260_row5_col5, #T_30260_row6_col0, #T_30260_row6_col1, #T_30260_row6_col2, #T_30260_row6_col3, #T_30260_row6_col4, #T_30260_row6_col5 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_30260\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_30260_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_30260_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_30260_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_30260_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_30260_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_30260_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_30260_level0_row0\" class=\"row_heading level0 row0\" >T1562.001</th>\n",
|
||
" <td id=\"T_30260_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_30260_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_30260_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_30260_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_30260_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_30260_row0_col5\" class=\"data row0 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_30260_level0_row1\" class=\"row_heading level0 row1\" >T1036</th>\n",
|
||
" <td id=\"T_30260_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_30260_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_30260_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_30260_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_30260_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_30260_row1_col5\" class=\"data row1 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_30260_level0_row2\" class=\"row_heading level0 row2\" >T1566</th>\n",
|
||
" <td id=\"T_30260_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_30260_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_30260_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_30260_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_30260_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_30260_row2_col5\" class=\"data row2 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_30260_level0_row3\" class=\"row_heading level0 row3\" >T1566.001</th>\n",
|
||
" <td id=\"T_30260_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_30260_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_30260_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_30260_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_30260_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_30260_row3_col5\" class=\"data row3 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_30260_level0_row4\" class=\"row_heading level0 row4\" >T1562</th>\n",
|
||
" <td id=\"T_30260_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_30260_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_30260_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_30260_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_30260_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_30260_row4_col5\" class=\"data row4 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_30260_level0_row5\" class=\"row_heading level0 row5\" >T1543</th>\n",
|
||
" <td id=\"T_30260_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_30260_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_30260_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
|
||
" <td id=\"T_30260_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
|
||
" <td id=\"T_30260_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
|
||
" <td id=\"T_30260_row5_col5\" class=\"data row5 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_30260_level0_row6\" class=\"row_heading level0 row6\" >T1059</th>\n",
|
||
" <td id=\"T_30260_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_30260_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_30260_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
|
||
" <td id=\"T_30260_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
|
||
" <td id=\"T_30260_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_30260_row6_col5\" class=\"data row6 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c220d60>"
|
||
]
|
||
},
|
||
"execution_count": 42,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 5]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 43,
|
||
"id": "e8d0e149-6e69-4a04-be98-51bac29a15af",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(5, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_d3547_row0_col0, #T_d3547_row0_col1, #T_d3547_row0_col2, #T_d3547_row0_col3, #T_d3547_row0_col4, #T_d3547_row0_col5, #T_d3547_row1_col0, #T_d3547_row1_col1, #T_d3547_row1_col2, #T_d3547_row1_col3, #T_d3547_row1_col4, #T_d3547_row1_col5, #T_d3547_row2_col0, #T_d3547_row2_col1, #T_d3547_row2_col2, #T_d3547_row2_col3, #T_d3547_row2_col4, #T_d3547_row2_col5, #T_d3547_row3_col0, #T_d3547_row3_col1, #T_d3547_row3_col2, #T_d3547_row3_col3, #T_d3547_row3_col4, #T_d3547_row3_col5, #T_d3547_row4_col0, #T_d3547_row4_col1, #T_d3547_row4_col2, #T_d3547_row4_col3, #T_d3547_row4_col4, #T_d3547_row4_col5 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_d3547\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_d3547_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_d3547_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_d3547_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_d3547_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_d3547_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_d3547_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_d3547_level0_row0\" class=\"row_heading level0 row0\" >T1053.005</th>\n",
|
||
" <td id=\"T_d3547_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_d3547_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row0_col5\" class=\"data row0 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_d3547_level0_row1\" class=\"row_heading level0 row1\" >T1204.001</th>\n",
|
||
" <td id=\"T_d3547_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_d3547_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row1_col5\" class=\"data row1 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_d3547_level0_row2\" class=\"row_heading level0 row2\" >T1204</th>\n",
|
||
" <td id=\"T_d3547_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row2_col3\" class=\"data row2 col3\" >no</td>\n",
|
||
" <td id=\"T_d3547_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row2_col5\" class=\"data row2 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_d3547_level0_row3\" class=\"row_heading level0 row3\" >T1053</th>\n",
|
||
" <td id=\"T_d3547_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_d3547_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row3_col5\" class=\"data row3 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_d3547_level0_row4\" class=\"row_heading level0 row4\" >T1218</th>\n",
|
||
" <td id=\"T_d3547_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row4_col1\" class=\"data row4 col1\" >no</td>\n",
|
||
" <td id=\"T_d3547_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_d3547_row4_col5\" class=\"data row4 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c21a940>"
|
||
]
|
||
},
|
||
"execution_count": 43,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 4]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 44,
|
||
"id": "9e5fa653-ce25-4616-8962-8350e858a6af",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(11, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_13364_row0_col0, #T_13364_row0_col1, #T_13364_row0_col2, #T_13364_row0_col3, #T_13364_row0_col4, #T_13364_row0_col5, #T_13364_row1_col0, #T_13364_row1_col1, #T_13364_row1_col2, #T_13364_row1_col3, #T_13364_row1_col4, #T_13364_row1_col5, #T_13364_row2_col0, #T_13364_row2_col1, #T_13364_row2_col2, #T_13364_row2_col3, #T_13364_row2_col4, #T_13364_row2_col5, #T_13364_row3_col0, #T_13364_row3_col1, #T_13364_row3_col2, #T_13364_row3_col3, #T_13364_row3_col4, #T_13364_row3_col5, #T_13364_row4_col0, #T_13364_row4_col1, #T_13364_row4_col2, #T_13364_row4_col3, #T_13364_row4_col4, #T_13364_row4_col5, #T_13364_row5_col0, #T_13364_row5_col1, #T_13364_row5_col2, #T_13364_row5_col3, #T_13364_row5_col4, #T_13364_row5_col5, #T_13364_row6_col0, #T_13364_row6_col1, #T_13364_row6_col2, #T_13364_row6_col3, #T_13364_row6_col4, #T_13364_row6_col5, #T_13364_row7_col0, #T_13364_row7_col1, #T_13364_row7_col2, #T_13364_row7_col3, #T_13364_row7_col4, #T_13364_row7_col5, #T_13364_row8_col0, #T_13364_row8_col1, #T_13364_row8_col2, #T_13364_row8_col3, #T_13364_row8_col4, #T_13364_row8_col5, #T_13364_row9_col0, #T_13364_row9_col1, #T_13364_row9_col2, #T_13364_row9_col3, #T_13364_row9_col4, #T_13364_row9_col5, #T_13364_row10_col0, #T_13364_row10_col1, #T_13364_row10_col2, #T_13364_row10_col3, #T_13364_row10_col4, #T_13364_row10_col5 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_13364\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_13364_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_13364_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_13364_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_13364_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_13364_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_13364_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row0\" class=\"row_heading level0 row0\" >T1543.003</th>\n",
|
||
" <td id=\"T_13364_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_13364_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_13364_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_13364_row0_col5\" class=\"data row0 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row1\" class=\"row_heading level0 row1\" >T1548.002</th>\n",
|
||
" <td id=\"T_13364_row1_col0\" class=\"data row1 col0\" >no</td>\n",
|
||
" <td id=\"T_13364_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_13364_row1_col5\" class=\"data row1 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row2\" class=\"row_heading level0 row2\" >T1059.001</th>\n",
|
||
" <td id=\"T_13364_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_13364_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_13364_row2_col3\" class=\"data row2 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_13364_row2_col5\" class=\"data row2 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row3\" class=\"row_heading level0 row3\" >T1548</th>\n",
|
||
" <td id=\"T_13364_row3_col0\" class=\"data row3 col0\" >no</td>\n",
|
||
" <td id=\"T_13364_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row3_col3\" class=\"data row3 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_13364_row3_col5\" class=\"data row3 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row4\" class=\"row_heading level0 row4\" >T1555</th>\n",
|
||
" <td id=\"T_13364_row4_col0\" class=\"data row4 col0\" >no</td>\n",
|
||
" <td id=\"T_13364_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row4_col3\" class=\"data row4 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_13364_row4_col5\" class=\"data row4 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row5\" class=\"row_heading level0 row5\" >T1547.001</th>\n",
|
||
" <td id=\"T_13364_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_13364_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row5_col3\" class=\"data row5 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_13364_row5_col5\" class=\"data row5 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row6\" class=\"row_heading level0 row6\" >T1555.003</th>\n",
|
||
" <td id=\"T_13364_row6_col0\" class=\"data row6 col0\" >no</td>\n",
|
||
" <td id=\"T_13364_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row6_col3\" class=\"data row6 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_13364_row6_col5\" class=\"data row6 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row7\" class=\"row_heading level0 row7\" >T1112</th>\n",
|
||
" <td id=\"T_13364_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
|
||
" <td id=\"T_13364_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_13364_row7_col5\" class=\"data row7 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row8\" class=\"row_heading level0 row8\" >T1071</th>\n",
|
||
" <td id=\"T_13364_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
|
||
" <td id=\"T_13364_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row8_col2\" class=\"data row8 col2\" >no</td>\n",
|
||
" <td id=\"T_13364_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
|
||
" <td id=\"T_13364_row8_col5\" class=\"data row8 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row9\" class=\"row_heading level0 row9\" >T1547</th>\n",
|
||
" <td id=\"T_13364_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_13364_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
|
||
" <td id=\"T_13364_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_13364_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_13364_row9_col5\" class=\"data row9 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_13364_level0_row10\" class=\"row_heading level0 row10\" >T1055</th>\n",
|
||
" <td id=\"T_13364_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
|
||
" <td id=\"T_13364_row10_col1\" class=\"data row10 col1\" >no</td>\n",
|
||
" <td id=\"T_13364_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
|
||
" <td id=\"T_13364_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
|
||
" <td id=\"T_13364_row10_col4\" class=\"data row10 col4\" >no</td>\n",
|
||
" <td id=\"T_13364_row10_col5\" class=\"data row10 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c220880>"
|
||
]
|
||
},
|
||
"execution_count": 44,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 3]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 45,
|
||
"id": "56b64501-cc50-4d5b-849b-2a0f917de6d0",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(12, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_7058b_row0_col0, #T_7058b_row0_col1, #T_7058b_row0_col2, #T_7058b_row0_col3, #T_7058b_row0_col4, #T_7058b_row0_col5, #T_7058b_row1_col0, #T_7058b_row1_col1, #T_7058b_row1_col2, #T_7058b_row1_col3, #T_7058b_row1_col4, #T_7058b_row1_col5, #T_7058b_row2_col0, #T_7058b_row2_col1, #T_7058b_row2_col2, #T_7058b_row2_col3, #T_7058b_row2_col4, #T_7058b_row2_col5, #T_7058b_row3_col0, #T_7058b_row3_col1, #T_7058b_row3_col2, #T_7058b_row3_col3, #T_7058b_row3_col4, #T_7058b_row3_col5, #T_7058b_row4_col0, #T_7058b_row4_col1, #T_7058b_row4_col2, #T_7058b_row4_col3, #T_7058b_row4_col4, #T_7058b_row4_col5, #T_7058b_row5_col0, #T_7058b_row5_col1, #T_7058b_row5_col2, #T_7058b_row5_col3, #T_7058b_row5_col4, #T_7058b_row5_col5, #T_7058b_row6_col0, #T_7058b_row6_col1, #T_7058b_row6_col2, #T_7058b_row6_col3, #T_7058b_row6_col4, #T_7058b_row6_col5, #T_7058b_row7_col0, #T_7058b_row7_col1, #T_7058b_row7_col2, #T_7058b_row7_col3, #T_7058b_row7_col4, #T_7058b_row7_col5, #T_7058b_row8_col0, #T_7058b_row8_col1, #T_7058b_row8_col2, #T_7058b_row8_col3, #T_7058b_row8_col4, #T_7058b_row8_col5, #T_7058b_row9_col0, #T_7058b_row9_col1, #T_7058b_row9_col2, #T_7058b_row9_col3, #T_7058b_row9_col4, #T_7058b_row9_col5, #T_7058b_row10_col0, #T_7058b_row10_col1, #T_7058b_row10_col2, #T_7058b_row10_col3, #T_7058b_row10_col4, #T_7058b_row10_col5, #T_7058b_row11_col0, #T_7058b_row11_col1, #T_7058b_row11_col2, #T_7058b_row11_col3, #T_7058b_row11_col4, #T_7058b_row11_col5 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_7058b\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_7058b_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_7058b_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_7058b_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_7058b_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_7058b_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_7058b_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row0\" class=\"row_heading level0 row0\" >T1049</th>\n",
|
||
" <td id=\"T_7058b_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row0_col4\" class=\"data row0 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row0_col5\" class=\"data row0 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row1\" class=\"row_heading level0 row1\" >T1592</th>\n",
|
||
" <td id=\"T_7058b_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row1_col1\" class=\"data row1 col1\" >no</td>\n",
|
||
" <td id=\"T_7058b_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row1_col4\" class=\"data row1 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row1_col5\" class=\"data row1 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row2\" class=\"row_heading level0 row2\" >T1021</th>\n",
|
||
" <td id=\"T_7058b_row2_col0\" class=\"data row2 col0\" >no</td>\n",
|
||
" <td id=\"T_7058b_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row2_col4\" class=\"data row2 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row2_col5\" class=\"data row2 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row3\" class=\"row_heading level0 row3\" >T1027</th>\n",
|
||
" <td id=\"T_7058b_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row3_col1\" class=\"data row3 col1\" >no</td>\n",
|
||
" <td id=\"T_7058b_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row3_col4\" class=\"data row3 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row3_col5\" class=\"data row3 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row4\" class=\"row_heading level0 row4\" >T1055.001</th>\n",
|
||
" <td id=\"T_7058b_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row4_col1\" class=\"data row4 col1\" >no</td>\n",
|
||
" <td id=\"T_7058b_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row4_col3\" class=\"data row4 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row4_col4\" class=\"data row4 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row4_col5\" class=\"data row4 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row5\" class=\"row_heading level0 row5\" >T1590</th>\n",
|
||
" <td id=\"T_7058b_row5_col0\" class=\"data row5 col0\" >no</td>\n",
|
||
" <td id=\"T_7058b_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row5_col2\" class=\"data row5 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row5_col5\" class=\"data row5 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row6\" class=\"row_heading level0 row6\" >T1059.003</th>\n",
|
||
" <td id=\"T_7058b_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row6_col2\" class=\"data row6 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row6_col3\" class=\"data row6 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row6_col4\" class=\"data row6 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row6_col5\" class=\"data row6 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row7\" class=\"row_heading level0 row7\" >T1218.010</th>\n",
|
||
" <td id=\"T_7058b_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row7_col1\" class=\"data row7 col1\" >no</td>\n",
|
||
" <td id=\"T_7058b_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row7_col5\" class=\"data row7 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row8\" class=\"row_heading level0 row8\" >T1590.005</th>\n",
|
||
" <td id=\"T_7058b_row8_col0\" class=\"data row8 col0\" >no</td>\n",
|
||
" <td id=\"T_7058b_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row8_col2\" class=\"data row8 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row8_col3\" class=\"data row8 col3\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row8_col4\" class=\"data row8 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row8_col5\" class=\"data row8 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row9\" class=\"row_heading level0 row9\" >T1059.007</th>\n",
|
||
" <td id=\"T_7058b_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row9_col1\" class=\"data row9 col1\" >no</td>\n",
|
||
" <td id=\"T_7058b_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row9_col5\" class=\"data row9 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row10\" class=\"row_heading level0 row10\" >T1569</th>\n",
|
||
" <td id=\"T_7058b_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row10_col2\" class=\"data row10 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row10_col3\" class=\"data row10 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row10_col4\" class=\"data row10 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row10_col5\" class=\"data row10 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_7058b_level0_row11\" class=\"row_heading level0 row11\" >T1569.002</th>\n",
|
||
" <td id=\"T_7058b_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row11_col1\" class=\"data row11 col1\" >yes</td>\n",
|
||
" <td id=\"T_7058b_row11_col2\" class=\"data row11 col2\" >no</td>\n",
|
||
" <td id=\"T_7058b_row11_col3\" class=\"data row11 col3\" >no</td>\n",
|
||
" <td id=\"T_7058b_row11_col4\" class=\"data row11 col4\" >no</td>\n",
|
||
" <td id=\"T_7058b_row11_col5\" class=\"data row11 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12bfedd90>"
|
||
]
|
||
},
|
||
"execution_count": 45,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 2]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 46,
|
||
"id": "3f9a2ef2-1f38-40a7-98fa-e7e0b92a24da",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(39, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_cacfb_row0_col0, #T_cacfb_row0_col1, #T_cacfb_row0_col2, #T_cacfb_row0_col3, #T_cacfb_row0_col4, #T_cacfb_row0_col5, #T_cacfb_row1_col0, #T_cacfb_row1_col1, #T_cacfb_row1_col2, #T_cacfb_row1_col3, #T_cacfb_row1_col4, #T_cacfb_row1_col5, #T_cacfb_row2_col0, #T_cacfb_row2_col1, #T_cacfb_row2_col2, #T_cacfb_row2_col3, #T_cacfb_row2_col4, #T_cacfb_row2_col5, #T_cacfb_row3_col0, #T_cacfb_row3_col1, #T_cacfb_row3_col2, #T_cacfb_row3_col3, #T_cacfb_row3_col4, #T_cacfb_row3_col5, #T_cacfb_row4_col0, #T_cacfb_row4_col1, #T_cacfb_row4_col2, #T_cacfb_row4_col3, #T_cacfb_row4_col4, #T_cacfb_row4_col5, #T_cacfb_row5_col0, #T_cacfb_row5_col1, #T_cacfb_row5_col2, #T_cacfb_row5_col3, #T_cacfb_row5_col4, #T_cacfb_row5_col5, #T_cacfb_row6_col0, #T_cacfb_row6_col1, #T_cacfb_row6_col2, #T_cacfb_row6_col3, #T_cacfb_row6_col4, #T_cacfb_row6_col5, #T_cacfb_row7_col0, #T_cacfb_row7_col1, #T_cacfb_row7_col2, #T_cacfb_row7_col3, #T_cacfb_row7_col4, #T_cacfb_row7_col5, #T_cacfb_row8_col0, #T_cacfb_row8_col1, #T_cacfb_row8_col2, #T_cacfb_row8_col3, #T_cacfb_row8_col4, #T_cacfb_row8_col5, #T_cacfb_row9_col0, #T_cacfb_row9_col1, #T_cacfb_row9_col2, #T_cacfb_row9_col3, #T_cacfb_row9_col4, #T_cacfb_row9_col5, #T_cacfb_row10_col0, #T_cacfb_row10_col1, #T_cacfb_row10_col2, #T_cacfb_row10_col3, #T_cacfb_row10_col4, #T_cacfb_row10_col5, #T_cacfb_row11_col0, #T_cacfb_row11_col1, #T_cacfb_row11_col2, #T_cacfb_row11_col3, #T_cacfb_row11_col4, #T_cacfb_row11_col5, #T_cacfb_row12_col0, #T_cacfb_row12_col1, #T_cacfb_row12_col2, #T_cacfb_row12_col3, #T_cacfb_row12_col4, #T_cacfb_row12_col5, #T_cacfb_row13_col0, #T_cacfb_row13_col1, #T_cacfb_row13_col2, #T_cacfb_row13_col3, #T_cacfb_row13_col4, #T_cacfb_row13_col5, #T_cacfb_row14_col0, #T_cacfb_row14_col1, #T_cacfb_row14_col2, #T_cacfb_row14_col3, #T_cacfb_row14_col4, #T_cacfb_row14_col5, #T_cacfb_row15_col0, #T_cacfb_row15_col1, #T_cacfb_row15_col2, #T_cacfb_row15_col3, #T_cacfb_row15_col4, #T_cacfb_row15_col5, #T_cacfb_row16_col0, #T_cacfb_row16_col1, #T_cacfb_row16_col2, #T_cacfb_row16_col3, #T_cacfb_row16_col4, #T_cacfb_row16_col5, #T_cacfb_row17_col0, #T_cacfb_row17_col1, #T_cacfb_row17_col2, #T_cacfb_row17_col3, #T_cacfb_row17_col4, #T_cacfb_row17_col5, #T_cacfb_row18_col0, #T_cacfb_row18_col1, #T_cacfb_row18_col2, #T_cacfb_row18_col3, #T_cacfb_row18_col4, #T_cacfb_row18_col5, #T_cacfb_row19_col0, #T_cacfb_row19_col1, #T_cacfb_row19_col2, #T_cacfb_row19_col3, #T_cacfb_row19_col4, #T_cacfb_row19_col5, #T_cacfb_row20_col0, #T_cacfb_row20_col1, #T_cacfb_row20_col2, #T_cacfb_row20_col3, #T_cacfb_row20_col4, #T_cacfb_row20_col5, #T_cacfb_row21_col0, #T_cacfb_row21_col1, #T_cacfb_row21_col2, #T_cacfb_row21_col3, #T_cacfb_row21_col4, #T_cacfb_row21_col5, #T_cacfb_row22_col0, #T_cacfb_row22_col1, #T_cacfb_row22_col2, #T_cacfb_row22_col3, #T_cacfb_row22_col4, #T_cacfb_row22_col5, #T_cacfb_row23_col0, #T_cacfb_row23_col1, #T_cacfb_row23_col2, #T_cacfb_row23_col3, #T_cacfb_row23_col4, #T_cacfb_row23_col5, #T_cacfb_row24_col0, #T_cacfb_row24_col1, #T_cacfb_row24_col2, #T_cacfb_row24_col3, #T_cacfb_row24_col4, #T_cacfb_row24_col5, #T_cacfb_row25_col0, #T_cacfb_row25_col1, #T_cacfb_row25_col2, #T_cacfb_row25_col3, #T_cacfb_row25_col4, #T_cacfb_row25_col5, #T_cacfb_row26_col0, #T_cacfb_row26_col1, #T_cacfb_row26_col2, #T_cacfb_row26_col3, #T_cacfb_row26_col4, #T_cacfb_row26_col5, #T_cacfb_row27_col0, #T_cacfb_row27_col1, #T_cacfb_row27_col2, #T_cacfb_row27_col3, #T_cacfb_row27_col4, #T_cacfb_row27_col5, #T_cacfb_row28_col0, #T_cacfb_row28_col1, #T_cacfb_row28_col2, #T_cacfb_row28_col3, #T_cacfb_row28_col4, #T_cacfb_row28_col5, #T_cacfb_row29_col0, #T_cacfb_row29_col1, #T_cacfb_row29_col2, #T_cacfb_row29_col3, #T_cacfb_row29_col4, #T_cacfb_row29_col5, #T_cacfb_row30_col0, #T_cacfb_row30_col1, #T_cacfb_row30_col2, #T_cacfb_row30_col3, #T_cacfb_row30_col4, #T_cacfb_row30_col5, #T_cacfb_row31_col0, #T_cacfb_row31_col1, #T_cacfb_row31_col2, #T_cacfb_row31_col3, #T_cacfb_row31_col4, #T_cacfb_row31_col5, #T_cacfb_row32_col0, #T_cacfb_row32_col1, #T_cacfb_row32_col2, #T_cacfb_row32_col3, #T_cacfb_row32_col4, #T_cacfb_row32_col5, #T_cacfb_row33_col0, #T_cacfb_row33_col1, #T_cacfb_row33_col2, #T_cacfb_row33_col3, #T_cacfb_row33_col4, #T_cacfb_row33_col5, #T_cacfb_row34_col0, #T_cacfb_row34_col1, #T_cacfb_row34_col2, #T_cacfb_row34_col3, #T_cacfb_row34_col4, #T_cacfb_row34_col5, #T_cacfb_row35_col0, #T_cacfb_row35_col1, #T_cacfb_row35_col2, #T_cacfb_row35_col3, #T_cacfb_row35_col4, #T_cacfb_row35_col5, #T_cacfb_row36_col0, #T_cacfb_row36_col1, #T_cacfb_row36_col2, #T_cacfb_row36_col3, #T_cacfb_row36_col4, #T_cacfb_row36_col5, #T_cacfb_row37_col0, #T_cacfb_row37_col1, #T_cacfb_row37_col2, #T_cacfb_row37_col3, #T_cacfb_row37_col4, #T_cacfb_row37_col5, #T_cacfb_row38_col0, #T_cacfb_row38_col1, #T_cacfb_row38_col2, #T_cacfb_row38_col3, #T_cacfb_row38_col4, #T_cacfb_row38_col5 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_cacfb\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_cacfb_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_cacfb_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_cacfb_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_cacfb_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_cacfb_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_cacfb_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row0\" class=\"row_heading level0 row0\" >T1087.002</th>\n",
|
||
" <td id=\"T_cacfb_row0_col0\" class=\"data row0 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row0_col1\" class=\"data row0 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row0_col4\" class=\"data row0 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row0_col5\" class=\"data row0 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row1\" class=\"row_heading level0 row1\" >T1087</th>\n",
|
||
" <td id=\"T_cacfb_row1_col0\" class=\"data row1 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row1_col1\" class=\"data row1 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row1_col2\" class=\"data row1 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row1_col4\" class=\"data row1 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row1_col5\" class=\"data row1 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row2\" class=\"row_heading level0 row2\" >T1218.011</th>\n",
|
||
" <td id=\"T_cacfb_row2_col0\" class=\"data row2 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row2_col1\" class=\"data row2 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row2_col4\" class=\"data row2 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row2_col5\" class=\"data row2 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row3\" class=\"row_heading level0 row3\" >T1218.001</th>\n",
|
||
" <td id=\"T_cacfb_row3_col0\" class=\"data row3 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row3_col1\" class=\"data row3 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row3_col3\" class=\"data row3 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row3_col5\" class=\"data row3 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row4\" class=\"row_heading level0 row4\" >T1021.002</th>\n",
|
||
" <td id=\"T_cacfb_row4_col0\" class=\"data row4 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row4_col1\" class=\"data row4 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row4_col2\" class=\"data row4 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row4_col4\" class=\"data row4 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row4_col5\" class=\"data row4 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row5\" class=\"row_heading level0 row5\" >T1564.001</th>\n",
|
||
" <td id=\"T_cacfb_row5_col0\" class=\"data row5 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row5_col2\" class=\"data row5 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row5_col3\" class=\"data row5 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row5_col5\" class=\"data row5 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row6\" class=\"row_heading level0 row6\" >T1482</th>\n",
|
||
" <td id=\"T_cacfb_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row6_col1\" class=\"data row6 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row6_col2\" class=\"data row6 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row6_col3\" class=\"data row6 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row6_col4\" class=\"data row6 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row6_col5\" class=\"data row6 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row7\" class=\"row_heading level0 row7\" >T1564</th>\n",
|
||
" <td id=\"T_cacfb_row7_col0\" class=\"data row7 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row7_col2\" class=\"data row7 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row7_col5\" class=\"data row7 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row8\" class=\"row_heading level0 row8\" >T1559.001</th>\n",
|
||
" <td id=\"T_cacfb_row8_col0\" class=\"data row8 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row8_col1\" class=\"data row8 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row8_col4\" class=\"data row8 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row8_col5\" class=\"data row8 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row9\" class=\"row_heading level0 row9\" >T1566.002</th>\n",
|
||
" <td id=\"T_cacfb_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row9_col1\" class=\"data row9 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row9_col2\" class=\"data row9 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row9_col5\" class=\"data row9 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row10\" class=\"row_heading level0 row10\" >T1222.001</th>\n",
|
||
" <td id=\"T_cacfb_row10_col0\" class=\"data row10 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row10_col2\" class=\"data row10 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row10_col3\" class=\"data row10 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row10_col4\" class=\"data row10 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row10_col5\" class=\"data row10 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row11\" class=\"row_heading level0 row11\" >T1134.004</th>\n",
|
||
" <td id=\"T_cacfb_row11_col0\" class=\"data row11 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row11_col1\" class=\"data row11 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row11_col3\" class=\"data row11 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row11_col4\" class=\"data row11 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row11_col5\" class=\"data row11 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row12\" class=\"row_heading level0 row12\" >T1134</th>\n",
|
||
" <td id=\"T_cacfb_row12_col0\" class=\"data row12 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row12_col1\" class=\"data row12 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row12_col2\" class=\"data row12 col2\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row12_col3\" class=\"data row12 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row12_col4\" class=\"data row12 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row12_col5\" class=\"data row12 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row13\" class=\"row_heading level0 row13\" >T1574.001</th>\n",
|
||
" <td id=\"T_cacfb_row13_col0\" class=\"data row13 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row13_col1\" class=\"data row13 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row13_col2\" class=\"data row13 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row13_col3\" class=\"data row13 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row13_col4\" class=\"data row13 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row13_col5\" class=\"data row13 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row14\" class=\"row_heading level0 row14\" >T1069</th>\n",
|
||
" <td id=\"T_cacfb_row14_col0\" class=\"data row14 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row14_col2\" class=\"data row14 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row14_col3\" class=\"data row14 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row14_col4\" class=\"data row14 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row14_col5\" class=\"data row14 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row15\" class=\"row_heading level0 row15\" >T1069.001</th>\n",
|
||
" <td id=\"T_cacfb_row15_col0\" class=\"data row15 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row15_col2\" class=\"data row15 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row15_col3\" class=\"data row15 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row15_col4\" class=\"data row15 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row15_col5\" class=\"data row15 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row16\" class=\"row_heading level0 row16\" >T1059.005</th>\n",
|
||
" <td id=\"T_cacfb_row16_col0\" class=\"data row16 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row16_col1\" class=\"data row16 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row16_col3\" class=\"data row16 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row16_col4\" class=\"data row16 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row16_col5\" class=\"data row16 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row17\" class=\"row_heading level0 row17\" >T1021.001</th>\n",
|
||
" <td id=\"T_cacfb_row17_col0\" class=\"data row17 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row17_col2\" class=\"data row17 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row17_col3\" class=\"data row17 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row17_col4\" class=\"data row17 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row17_col5\" class=\"data row17 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row18\" class=\"row_heading level0 row18\" >T1531</th>\n",
|
||
" <td id=\"T_cacfb_row18_col0\" class=\"data row18 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row18_col2\" class=\"data row18 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row18_col3\" class=\"data row18 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row18_col4\" class=\"data row18 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row18_col5\" class=\"data row18 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row19\" class=\"row_heading level0 row19\" >T1036.003</th>\n",
|
||
" <td id=\"T_cacfb_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row19_col1\" class=\"data row19 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row19_col2\" class=\"data row19 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row19_col3\" class=\"data row19 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row19_col4\" class=\"data row19 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row19_col5\" class=\"data row19 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row20\" class=\"row_heading level0 row20\" >T1489</th>\n",
|
||
" <td id=\"T_cacfb_row20_col0\" class=\"data row20 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row20_col2\" class=\"data row20 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row20_col3\" class=\"data row20 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row20_col4\" class=\"data row20 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row20_col5\" class=\"data row20 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row21\" class=\"row_heading level0 row21\" >T1222</th>\n",
|
||
" <td id=\"T_cacfb_row21_col0\" class=\"data row21 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row21_col2\" class=\"data row21 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row21_col3\" class=\"data row21 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row21_col4\" class=\"data row21 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row21_col5\" class=\"data row21 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row22\" class=\"row_heading level0 row22\" >T1562.004</th>\n",
|
||
" <td id=\"T_cacfb_row22_col0\" class=\"data row22 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row22_col2\" class=\"data row22 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row22_col3\" class=\"data row22 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row22_col4\" class=\"data row22 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row22_col5\" class=\"data row22 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row23\" class=\"row_heading level0 row23\" >T1047</th>\n",
|
||
" <td id=\"T_cacfb_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row23_col1\" class=\"data row23 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row23_col2\" class=\"data row23 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row23_col3\" class=\"data row23 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row23_col4\" class=\"data row23 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row23_col5\" class=\"data row23 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row24\" class=\"row_heading level0 row24\" >T1574.002</th>\n",
|
||
" <td id=\"T_cacfb_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row24_col1\" class=\"data row24 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row24_col2\" class=\"data row24 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row24_col3\" class=\"data row24 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row24_col4\" class=\"data row24 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row24_col5\" class=\"data row24 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row25\" class=\"row_heading level0 row25\" >T1574</th>\n",
|
||
" <td id=\"T_cacfb_row25_col0\" class=\"data row25 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row25_col1\" class=\"data row25 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row25_col2\" class=\"data row25 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row25_col3\" class=\"data row25 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row25_col4\" class=\"data row25 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row25_col5\" class=\"data row25 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row26\" class=\"row_heading level0 row26\" >T1113</th>\n",
|
||
" <td id=\"T_cacfb_row26_col0\" class=\"data row26 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row26_col1\" class=\"data row26 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row26_col2\" class=\"data row26 col2\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row26_col3\" class=\"data row26 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row26_col4\" class=\"data row26 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row26_col5\" class=\"data row26 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row27\" class=\"row_heading level0 row27\" >T1016</th>\n",
|
||
" <td id=\"T_cacfb_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row27_col1\" class=\"data row27 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row27_col2\" class=\"data row27 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row27_col3\" class=\"data row27 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row27_col4\" class=\"data row27 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row27_col5\" class=\"data row27 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row28\" class=\"row_heading level0 row28\" >T1033</th>\n",
|
||
" <td id=\"T_cacfb_row28_col0\" class=\"data row28 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row28_col1\" class=\"data row28 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row28_col2\" class=\"data row28 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row28_col3\" class=\"data row28 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row28_col4\" class=\"data row28 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row28_col5\" class=\"data row28 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row29\" class=\"row_heading level0 row29\" >T1218.005</th>\n",
|
||
" <td id=\"T_cacfb_row29_col0\" class=\"data row29 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row29_col1\" class=\"data row29 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row29_col2\" class=\"data row29 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row29_col3\" class=\"data row29 col3\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row29_col4\" class=\"data row29 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row29_col5\" class=\"data row29 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row30\" class=\"row_heading level0 row30\" >T1014</th>\n",
|
||
" <td id=\"T_cacfb_row30_col0\" class=\"data row30 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row30_col1\" class=\"data row30 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row30_col2\" class=\"data row30 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row30_col3\" class=\"data row30 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row30_col4\" class=\"data row30 col4\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row30_col5\" class=\"data row30 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row31\" class=\"row_heading level0 row31\" >T1068</th>\n",
|
||
" <td id=\"T_cacfb_row31_col0\" class=\"data row31 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row31_col1\" class=\"data row31 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row31_col2\" class=\"data row31 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row31_col3\" class=\"data row31 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row31_col5\" class=\"data row31 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row32\" class=\"row_heading level0 row32\" >T1219</th>\n",
|
||
" <td id=\"T_cacfb_row32_col0\" class=\"data row32 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row32_col1\" class=\"data row32 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row32_col2\" class=\"data row32 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row32_col3\" class=\"data row32 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row32_col4\" class=\"data row32 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row32_col5\" class=\"data row32 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row33\" class=\"row_heading level0 row33\" >T1055.002</th>\n",
|
||
" <td id=\"T_cacfb_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row33_col1\" class=\"data row33 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row33_col2\" class=\"data row33 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row33_col3\" class=\"data row33 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row33_col4\" class=\"data row33 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row33_col5\" class=\"data row33 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row34\" class=\"row_heading level0 row34\" >T1136.001</th>\n",
|
||
" <td id=\"T_cacfb_row34_col0\" class=\"data row34 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row34_col2\" class=\"data row34 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row34_col3\" class=\"data row34 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row34_col4\" class=\"data row34 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row34_col5\" class=\"data row34 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row35\" class=\"row_heading level0 row35\" >T1136</th>\n",
|
||
" <td id=\"T_cacfb_row35_col0\" class=\"data row35 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row35_col1\" class=\"data row35 col1\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row35_col2\" class=\"data row35 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row35_col3\" class=\"data row35 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row35_col4\" class=\"data row35 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row35_col5\" class=\"data row35 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row36\" class=\"row_heading level0 row36\" >T1070</th>\n",
|
||
" <td id=\"T_cacfb_row36_col0\" class=\"data row36 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row36_col1\" class=\"data row36 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row36_col2\" class=\"data row36 col2\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row36_col3\" class=\"data row36 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row36_col4\" class=\"data row36 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row36_col5\" class=\"data row36 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row37\" class=\"row_heading level0 row37\" >T1071.003</th>\n",
|
||
" <td id=\"T_cacfb_row37_col0\" class=\"data row37 col0\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row37_col1\" class=\"data row37 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row37_col2\" class=\"data row37 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row37_col3\" class=\"data row37 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row37_col4\" class=\"data row37 col4\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row37_col5\" class=\"data row37 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_cacfb_level0_row38\" class=\"row_heading level0 row38\" >T1016.001</th>\n",
|
||
" <td id=\"T_cacfb_row38_col0\" class=\"data row38 col0\" >yes</td>\n",
|
||
" <td id=\"T_cacfb_row38_col1\" class=\"data row38 col1\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row38_col2\" class=\"data row38 col2\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row38_col3\" class=\"data row38 col3\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row38_col4\" class=\"data row38 col4\" >no</td>\n",
|
||
" <td id=\"T_cacfb_row38_col5\" class=\"data row38 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c220f40>"
|
||
]
|
||
},
|
||
"execution_count": 46,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 1]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"id": "030119bf-4cef-4270-ba19-d9c9b2ea17f0",
|
||
"metadata": {},
|
||
"source": [
|
||
"### truth table mitre attack id 0technique vs analytic story(malware family)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 47,
|
||
"id": "e6ccea82-34f5-49d5-b43d-82d29313e0ee",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(74, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_a833d_row0_col0, #T_a833d_row0_col1, #T_a833d_row0_col2, #T_a833d_row0_col3, #T_a833d_row0_col4, #T_a833d_row0_col5, #T_a833d_row1_col0, #T_a833d_row1_col1, #T_a833d_row1_col2, #T_a833d_row1_col3, #T_a833d_row1_col4, #T_a833d_row1_col5, #T_a833d_row2_col0, #T_a833d_row2_col1, #T_a833d_row2_col2, #T_a833d_row2_col3, #T_a833d_row2_col4, #T_a833d_row2_col5, #T_a833d_row3_col0, #T_a833d_row3_col1, #T_a833d_row3_col2, #T_a833d_row3_col3, #T_a833d_row3_col4, #T_a833d_row3_col5, #T_a833d_row4_col0, #T_a833d_row4_col1, #T_a833d_row4_col2, #T_a833d_row4_col3, #T_a833d_row4_col4, #T_a833d_row4_col5, #T_a833d_row5_col0, #T_a833d_row5_col1, #T_a833d_row5_col2, #T_a833d_row5_col3, #T_a833d_row5_col4, #T_a833d_row5_col5, #T_a833d_row6_col0, #T_a833d_row6_col1, #T_a833d_row6_col2, #T_a833d_row6_col3, #T_a833d_row6_col4, #T_a833d_row6_col5 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"#T_a833d_row7_col0, #T_a833d_row7_col1, #T_a833d_row7_col2, #T_a833d_row7_col3, #T_a833d_row7_col4, #T_a833d_row7_col5, #T_a833d_row8_col0, #T_a833d_row8_col1, #T_a833d_row8_col2, #T_a833d_row8_col3, #T_a833d_row8_col4, #T_a833d_row8_col5, #T_a833d_row9_col0, #T_a833d_row9_col1, #T_a833d_row9_col2, #T_a833d_row9_col3, #T_a833d_row9_col4, #T_a833d_row9_col5, #T_a833d_row10_col0, #T_a833d_row10_col1, #T_a833d_row10_col2, #T_a833d_row10_col3, #T_a833d_row10_col4, #T_a833d_row10_col5, #T_a833d_row11_col0, #T_a833d_row11_col1, #T_a833d_row11_col2, #T_a833d_row11_col3, #T_a833d_row11_col4, #T_a833d_row11_col5 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"#T_a833d_row12_col0, #T_a833d_row12_col1, #T_a833d_row12_col2, #T_a833d_row12_col3, #T_a833d_row12_col4, #T_a833d_row12_col5, #T_a833d_row13_col0, #T_a833d_row13_col1, #T_a833d_row13_col2, #T_a833d_row13_col3, #T_a833d_row13_col4, #T_a833d_row13_col5, #T_a833d_row14_col0, #T_a833d_row14_col1, #T_a833d_row14_col2, #T_a833d_row14_col3, #T_a833d_row14_col4, #T_a833d_row14_col5, #T_a833d_row15_col0, #T_a833d_row15_col1, #T_a833d_row15_col2, #T_a833d_row15_col3, #T_a833d_row15_col4, #T_a833d_row15_col5, #T_a833d_row16_col0, #T_a833d_row16_col1, #T_a833d_row16_col2, #T_a833d_row16_col3, #T_a833d_row16_col4, #T_a833d_row16_col5, #T_a833d_row17_col0, #T_a833d_row17_col1, #T_a833d_row17_col2, #T_a833d_row17_col3, #T_a833d_row17_col4, #T_a833d_row17_col5, #T_a833d_row18_col0, #T_a833d_row18_col1, #T_a833d_row18_col2, #T_a833d_row18_col3, #T_a833d_row18_col4, #T_a833d_row18_col5, #T_a833d_row19_col0, #T_a833d_row19_col1, #T_a833d_row19_col2, #T_a833d_row19_col3, #T_a833d_row19_col4, #T_a833d_row19_col5, #T_a833d_row20_col0, #T_a833d_row20_col1, #T_a833d_row20_col2, #T_a833d_row20_col3, #T_a833d_row20_col4, #T_a833d_row20_col5, #T_a833d_row21_col0, #T_a833d_row21_col1, #T_a833d_row21_col2, #T_a833d_row21_col3, #T_a833d_row21_col4, #T_a833d_row21_col5, #T_a833d_row22_col0, #T_a833d_row22_col1, #T_a833d_row22_col2, #T_a833d_row22_col3, #T_a833d_row22_col4, #T_a833d_row22_col5 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"#T_a833d_row23_col0, #T_a833d_row23_col1, #T_a833d_row23_col2, #T_a833d_row23_col3, #T_a833d_row23_col4, #T_a833d_row23_col5, #T_a833d_row24_col0, #T_a833d_row24_col1, #T_a833d_row24_col2, #T_a833d_row24_col3, #T_a833d_row24_col4, #T_a833d_row24_col5, #T_a833d_row25_col0, #T_a833d_row25_col1, #T_a833d_row25_col2, #T_a833d_row25_col3, #T_a833d_row25_col4, #T_a833d_row25_col5, #T_a833d_row26_col0, #T_a833d_row26_col1, #T_a833d_row26_col2, #T_a833d_row26_col3, #T_a833d_row26_col4, #T_a833d_row26_col5, #T_a833d_row27_col0, #T_a833d_row27_col1, #T_a833d_row27_col2, #T_a833d_row27_col3, #T_a833d_row27_col4, #T_a833d_row27_col5, #T_a833d_row28_col0, #T_a833d_row28_col1, #T_a833d_row28_col2, #T_a833d_row28_col3, #T_a833d_row28_col4, #T_a833d_row28_col5, #T_a833d_row29_col0, #T_a833d_row29_col1, #T_a833d_row29_col2, #T_a833d_row29_col3, #T_a833d_row29_col4, #T_a833d_row29_col5, #T_a833d_row30_col0, #T_a833d_row30_col1, #T_a833d_row30_col2, #T_a833d_row30_col3, #T_a833d_row30_col4, #T_a833d_row30_col5, #T_a833d_row31_col0, #T_a833d_row31_col1, #T_a833d_row31_col2, #T_a833d_row31_col3, #T_a833d_row31_col4, #T_a833d_row31_col5, #T_a833d_row32_col0, #T_a833d_row32_col1, #T_a833d_row32_col2, #T_a833d_row32_col3, #T_a833d_row32_col4, #T_a833d_row32_col5, #T_a833d_row33_col0, #T_a833d_row33_col1, #T_a833d_row33_col2, #T_a833d_row33_col3, #T_a833d_row33_col4, #T_a833d_row33_col5, #T_a833d_row34_col0, #T_a833d_row34_col1, #T_a833d_row34_col2, #T_a833d_row34_col3, #T_a833d_row34_col4, #T_a833d_row34_col5 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"#T_a833d_row35_col0, #T_a833d_row35_col1, #T_a833d_row35_col2, #T_a833d_row35_col3, #T_a833d_row35_col4, #T_a833d_row35_col5, #T_a833d_row36_col0, #T_a833d_row36_col1, #T_a833d_row36_col2, #T_a833d_row36_col3, #T_a833d_row36_col4, #T_a833d_row36_col5, #T_a833d_row37_col0, #T_a833d_row37_col1, #T_a833d_row37_col2, #T_a833d_row37_col3, #T_a833d_row37_col4, #T_a833d_row37_col5, #T_a833d_row38_col0, #T_a833d_row38_col1, #T_a833d_row38_col2, #T_a833d_row38_col3, #T_a833d_row38_col4, #T_a833d_row38_col5, #T_a833d_row39_col0, #T_a833d_row39_col1, #T_a833d_row39_col2, #T_a833d_row39_col3, #T_a833d_row39_col4, #T_a833d_row39_col5, #T_a833d_row40_col0, #T_a833d_row40_col1, #T_a833d_row40_col2, #T_a833d_row40_col3, #T_a833d_row40_col4, #T_a833d_row40_col5, #T_a833d_row41_col0, #T_a833d_row41_col1, #T_a833d_row41_col2, #T_a833d_row41_col3, #T_a833d_row41_col4, #T_a833d_row41_col5, #T_a833d_row42_col0, #T_a833d_row42_col1, #T_a833d_row42_col2, #T_a833d_row42_col3, #T_a833d_row42_col4, #T_a833d_row42_col5, #T_a833d_row43_col0, #T_a833d_row43_col1, #T_a833d_row43_col2, #T_a833d_row43_col3, #T_a833d_row43_col4, #T_a833d_row43_col5, #T_a833d_row44_col0, #T_a833d_row44_col1, #T_a833d_row44_col2, #T_a833d_row44_col3, #T_a833d_row44_col4, #T_a833d_row44_col5, #T_a833d_row45_col0, #T_a833d_row45_col1, #T_a833d_row45_col2, #T_a833d_row45_col3, #T_a833d_row45_col4, #T_a833d_row45_col5, #T_a833d_row46_col0, #T_a833d_row46_col1, #T_a833d_row46_col2, #T_a833d_row46_col3, #T_a833d_row46_col4, #T_a833d_row46_col5, #T_a833d_row47_col0, #T_a833d_row47_col1, #T_a833d_row47_col2, #T_a833d_row47_col3, #T_a833d_row47_col4, #T_a833d_row47_col5, #T_a833d_row48_col0, #T_a833d_row48_col1, #T_a833d_row48_col2, #T_a833d_row48_col3, #T_a833d_row48_col4, #T_a833d_row48_col5, #T_a833d_row49_col0, #T_a833d_row49_col1, #T_a833d_row49_col2, #T_a833d_row49_col3, #T_a833d_row49_col4, #T_a833d_row49_col5, #T_a833d_row50_col0, #T_a833d_row50_col1, #T_a833d_row50_col2, #T_a833d_row50_col3, #T_a833d_row50_col4, #T_a833d_row50_col5, #T_a833d_row51_col0, #T_a833d_row51_col1, #T_a833d_row51_col2, #T_a833d_row51_col3, #T_a833d_row51_col4, #T_a833d_row51_col5, #T_a833d_row52_col0, #T_a833d_row52_col1, #T_a833d_row52_col2, #T_a833d_row52_col3, #T_a833d_row52_col4, #T_a833d_row52_col5, #T_a833d_row53_col0, #T_a833d_row53_col1, #T_a833d_row53_col2, #T_a833d_row53_col3, #T_a833d_row53_col4, #T_a833d_row53_col5, #T_a833d_row54_col0, #T_a833d_row54_col1, #T_a833d_row54_col2, #T_a833d_row54_col3, #T_a833d_row54_col4, #T_a833d_row54_col5, #T_a833d_row55_col0, #T_a833d_row55_col1, #T_a833d_row55_col2, #T_a833d_row55_col3, #T_a833d_row55_col4, #T_a833d_row55_col5, #T_a833d_row56_col0, #T_a833d_row56_col1, #T_a833d_row56_col2, #T_a833d_row56_col3, #T_a833d_row56_col4, #T_a833d_row56_col5, #T_a833d_row57_col0, #T_a833d_row57_col1, #T_a833d_row57_col2, #T_a833d_row57_col3, #T_a833d_row57_col4, #T_a833d_row57_col5, #T_a833d_row58_col0, #T_a833d_row58_col1, #T_a833d_row58_col2, #T_a833d_row58_col3, #T_a833d_row58_col4, #T_a833d_row58_col5, #T_a833d_row59_col0, #T_a833d_row59_col1, #T_a833d_row59_col2, #T_a833d_row59_col3, #T_a833d_row59_col4, #T_a833d_row59_col5, #T_a833d_row60_col0, #T_a833d_row60_col1, #T_a833d_row60_col2, #T_a833d_row60_col3, #T_a833d_row60_col4, #T_a833d_row60_col5, #T_a833d_row61_col0, #T_a833d_row61_col1, #T_a833d_row61_col2, #T_a833d_row61_col3, #T_a833d_row61_col4, #T_a833d_row61_col5, #T_a833d_row62_col0, #T_a833d_row62_col1, #T_a833d_row62_col2, #T_a833d_row62_col3, #T_a833d_row62_col4, #T_a833d_row62_col5, #T_a833d_row63_col0, #T_a833d_row63_col1, #T_a833d_row63_col2, #T_a833d_row63_col3, #T_a833d_row63_col4, #T_a833d_row63_col5, #T_a833d_row64_col0, #T_a833d_row64_col1, #T_a833d_row64_col2, #T_a833d_row64_col3, #T_a833d_row64_col4, #T_a833d_row64_col5, #T_a833d_row65_col0, #T_a833d_row65_col1, #T_a833d_row65_col2, #T_a833d_row65_col3, #T_a833d_row65_col4, #T_a833d_row65_col5, #T_a833d_row66_col0, #T_a833d_row66_col1, #T_a833d_row66_col2, #T_a833d_row66_col3, #T_a833d_row66_col4, #T_a833d_row66_col5, #T_a833d_row67_col0, #T_a833d_row67_col1, #T_a833d_row67_col2, #T_a833d_row67_col3, #T_a833d_row67_col4, #T_a833d_row67_col5, #T_a833d_row68_col0, #T_a833d_row68_col1, #T_a833d_row68_col2, #T_a833d_row68_col3, #T_a833d_row68_col4, #T_a833d_row68_col5, #T_a833d_row69_col0, #T_a833d_row69_col1, #T_a833d_row69_col2, #T_a833d_row69_col3, #T_a833d_row69_col4, #T_a833d_row69_col5, #T_a833d_row70_col0, #T_a833d_row70_col1, #T_a833d_row70_col2, #T_a833d_row70_col3, #T_a833d_row70_col4, #T_a833d_row70_col5, #T_a833d_row71_col0, #T_a833d_row71_col1, #T_a833d_row71_col2, #T_a833d_row71_col3, #T_a833d_row71_col4, #T_a833d_row71_col5, #T_a833d_row72_col0, #T_a833d_row72_col1, #T_a833d_row72_col2, #T_a833d_row72_col3, #T_a833d_row72_col4, #T_a833d_row72_col5, #T_a833d_row73_col0, #T_a833d_row73_col1, #T_a833d_row73_col2, #T_a833d_row73_col3, #T_a833d_row73_col4, #T_a833d_row73_col5 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_a833d\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_a833d_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_a833d_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_a833d_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_a833d_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_a833d_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_a833d_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row0\" class=\"row_heading level0 row0\" >T1562.001-Disable_or_Modify_Tools</th>\n",
|
||
" <td id=\"T_a833d_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row0_col5\" class=\"data row0 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row1\" class=\"row_heading level0 row1\" >T1036-Masquerading <sub>(7)</sub></th>\n",
|
||
" <td id=\"T_a833d_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row1_col5\" class=\"data row1 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row2\" class=\"row_heading level0 row2\" >T1566-Phishing <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_a833d_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row2_col5\" class=\"data row2 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row3\" class=\"row_heading level0 row3\" >T1566.001-Spearphishing_Attachment</th>\n",
|
||
" <td id=\"T_a833d_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row3_col5\" class=\"data row3 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row4\" class=\"row_heading level0 row4\" >T1562-Impair_Defenses <sub>(9)</sub></th>\n",
|
||
" <td id=\"T_a833d_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row4_col5\" class=\"data row4 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row5\" class=\"row_heading level0 row5\" >T1543-Create_or_Modify_System_Process <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_a833d_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row5_col5\" class=\"data row5 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row6\" class=\"row_heading level0 row6\" >T1059-Command_and_Scripting_Interpreter <sub>(8)</sub></th>\n",
|
||
" <td id=\"T_a833d_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row6_col5\" class=\"data row6 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row7\" class=\"row_heading level0 row7\" >T1053.005-Scheduled_Task</th>\n",
|
||
" <td id=\"T_a833d_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row7_col2\" class=\"data row7 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row7_col3\" class=\"data row7 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row7_col4\" class=\"data row7 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row7_col5\" class=\"data row7 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row8\" class=\"row_heading level0 row8\" >T1204.001-Malicious_Link</th>\n",
|
||
" <td id=\"T_a833d_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row8_col5\" class=\"data row8 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row9\" class=\"row_heading level0 row9\" >T1204-User_Execution <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_a833d_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row9_col4\" class=\"data row9 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row9_col5\" class=\"data row9 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row10\" class=\"row_heading level0 row10\" >T1053-Scheduled_Task/Job <sub>(5)</sub></th>\n",
|
||
" <td id=\"T_a833d_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row10_col2\" class=\"data row10 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row10_col4\" class=\"data row10 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row10_col5\" class=\"data row10 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row11\" class=\"row_heading level0 row11\" >T1218-System_Binary_Proxy_Execution <sub>(13)</sub></th>\n",
|
||
" <td id=\"T_a833d_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row11_col1\" class=\"data row11 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row11_col3\" class=\"data row11 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row11_col4\" class=\"data row11 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row11_col5\" class=\"data row11 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row12\" class=\"row_heading level0 row12\" >T1543.003-Windows_Service</th>\n",
|
||
" <td id=\"T_a833d_row12_col0\" class=\"data row12 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row12_col1\" class=\"data row12 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row12_col2\" class=\"data row12 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row12_col3\" class=\"data row12 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row12_col4\" class=\"data row12 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row12_col5\" class=\"data row12 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row13\" class=\"row_heading level0 row13\" >T1548.002-Bypass_User_Account_Control</th>\n",
|
||
" <td id=\"T_a833d_row13_col0\" class=\"data row13 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row13_col1\" class=\"data row13 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row13_col2\" class=\"data row13 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row13_col3\" class=\"data row13 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row13_col4\" class=\"data row13 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row13_col5\" class=\"data row13 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row14\" class=\"row_heading level0 row14\" >T1059.001-PowerShell</th>\n",
|
||
" <td id=\"T_a833d_row14_col0\" class=\"data row14 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row14_col2\" class=\"data row14 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row14_col3\" class=\"data row14 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row14_col4\" class=\"data row14 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row14_col5\" class=\"data row14 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row15\" class=\"row_heading level0 row15\" >T1548-Abuse_Elevation_Control_Mechanism <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_a833d_row15_col0\" class=\"data row15 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row15_col2\" class=\"data row15 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row15_col3\" class=\"data row15 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row15_col4\" class=\"data row15 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row15_col5\" class=\"data row15 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row16\" class=\"row_heading level0 row16\" >T1555-Credentials_from_Password_Stores <sub>(5)</sub></th>\n",
|
||
" <td id=\"T_a833d_row16_col0\" class=\"data row16 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row16_col1\" class=\"data row16 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row16_col3\" class=\"data row16 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row16_col4\" class=\"data row16 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row16_col5\" class=\"data row16 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row17\" class=\"row_heading level0 row17\" >T1547.001-Registry_Run_Keys_/_Startup_Folder</th>\n",
|
||
" <td id=\"T_a833d_row17_col0\" class=\"data row17 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row17_col2\" class=\"data row17 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row17_col3\" class=\"data row17 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row17_col4\" class=\"data row17 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row17_col5\" class=\"data row17 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row18\" class=\"row_heading level0 row18\" >T1555.003-Credentials_from_Web_Browsers</th>\n",
|
||
" <td id=\"T_a833d_row18_col0\" class=\"data row18 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row18_col2\" class=\"data row18 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row18_col3\" class=\"data row18 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row18_col4\" class=\"data row18 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row18_col5\" class=\"data row18 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row19\" class=\"row_heading level0 row19\" >T1112-Modify_Registry</th>\n",
|
||
" <td id=\"T_a833d_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row19_col1\" class=\"data row19 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row19_col2\" class=\"data row19 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row19_col3\" class=\"data row19 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row19_col4\" class=\"data row19 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row19_col5\" class=\"data row19 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row20\" class=\"row_heading level0 row20\" >T1071-Application_Layer_Protocol <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_a833d_row20_col0\" class=\"data row20 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row20_col2\" class=\"data row20 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row20_col3\" class=\"data row20 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row20_col4\" class=\"data row20 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row20_col5\" class=\"data row20 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row21\" class=\"row_heading level0 row21\" >T1547-Boot_or_Logon_Autostart_Execution <sub>(14)</sub></th>\n",
|
||
" <td id=\"T_a833d_row21_col0\" class=\"data row21 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row21_col2\" class=\"data row21 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row21_col3\" class=\"data row21 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row21_col4\" class=\"data row21 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row21_col5\" class=\"data row21 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row22\" class=\"row_heading level0 row22\" >T1055-Process_Injection <sub>(12)</sub></th>\n",
|
||
" <td id=\"T_a833d_row22_col0\" class=\"data row22 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row22_col1\" class=\"data row22 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row22_col2\" class=\"data row22 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row22_col3\" class=\"data row22 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row22_col4\" class=\"data row22 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row22_col5\" class=\"data row22 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row23\" class=\"row_heading level0 row23\" >T1049-System_Network_Connections_Discovery</th>\n",
|
||
" <td id=\"T_a833d_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row23_col1\" class=\"data row23 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row23_col2\" class=\"data row23 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row23_col3\" class=\"data row23 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row23_col4\" class=\"data row23 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row23_col5\" class=\"data row23 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row24\" class=\"row_heading level0 row24\" >T1592-Gather_Victim_Host_Information <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_a833d_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row24_col1\" class=\"data row24 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row24_col2\" class=\"data row24 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row24_col3\" class=\"data row24 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row24_col4\" class=\"data row24 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row24_col5\" class=\"data row24 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row25\" class=\"row_heading level0 row25\" >T1021-Remote_Services <sub>(6)</sub></th>\n",
|
||
" <td id=\"T_a833d_row25_col0\" class=\"data row25 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row25_col1\" class=\"data row25 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row25_col2\" class=\"data row25 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row25_col3\" class=\"data row25 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row25_col4\" class=\"data row25 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row25_col5\" class=\"data row25 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row26\" class=\"row_heading level0 row26\" >T1027-Obfuscated_Files_or_Information <sub>(9)</sub></th>\n",
|
||
" <td id=\"T_a833d_row26_col0\" class=\"data row26 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row26_col1\" class=\"data row26 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row26_col2\" class=\"data row26 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row26_col3\" class=\"data row26 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row26_col4\" class=\"data row26 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row26_col5\" class=\"data row26 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row27\" class=\"row_heading level0 row27\" >T1055.001-Dynamic-link_Library_Injection</th>\n",
|
||
" <td id=\"T_a833d_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row27_col1\" class=\"data row27 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row27_col2\" class=\"data row27 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row27_col3\" class=\"data row27 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row27_col4\" class=\"data row27 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row27_col5\" class=\"data row27 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row28\" class=\"row_heading level0 row28\" >T1590-Gather_Victim_Network_Information <sub>(6)</sub></th>\n",
|
||
" <td id=\"T_a833d_row28_col0\" class=\"data row28 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row28_col1\" class=\"data row28 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row28_col2\" class=\"data row28 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row28_col3\" class=\"data row28 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row28_col4\" class=\"data row28 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row28_col5\" class=\"data row28 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row29\" class=\"row_heading level0 row29\" >T1059.003-Windows_Command_Shell</th>\n",
|
||
" <td id=\"T_a833d_row29_col0\" class=\"data row29 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row29_col1\" class=\"data row29 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row29_col2\" class=\"data row29 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row29_col3\" class=\"data row29 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row29_col4\" class=\"data row29 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row29_col5\" class=\"data row29 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row30\" class=\"row_heading level0 row30\" >T1218.010-Regsvr32</th>\n",
|
||
" <td id=\"T_a833d_row30_col0\" class=\"data row30 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row30_col1\" class=\"data row30 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row30_col2\" class=\"data row30 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row30_col3\" class=\"data row30 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row30_col4\" class=\"data row30 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row30_col5\" class=\"data row30 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row31\" class=\"row_heading level0 row31\" >T1590.005-IP_Addresses</th>\n",
|
||
" <td id=\"T_a833d_row31_col0\" class=\"data row31 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row31_col1\" class=\"data row31 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row31_col2\" class=\"data row31 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row31_col3\" class=\"data row31 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row31_col4\" class=\"data row31 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row31_col5\" class=\"data row31 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row32\" class=\"row_heading level0 row32\" >T1059.007-JavaScript</th>\n",
|
||
" <td id=\"T_a833d_row32_col0\" class=\"data row32 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row32_col1\" class=\"data row32 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row32_col2\" class=\"data row32 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row32_col3\" class=\"data row32 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row32_col4\" class=\"data row32 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row32_col5\" class=\"data row32 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row33\" class=\"row_heading level0 row33\" >T1569-System_Services <sub>(2)</sub></th>\n",
|
||
" <td id=\"T_a833d_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row33_col1\" class=\"data row33 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row33_col2\" class=\"data row33 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row33_col3\" class=\"data row33 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row33_col4\" class=\"data row33 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row33_col5\" class=\"data row33 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row34\" class=\"row_heading level0 row34\" >T1569.002-Service_Execution</th>\n",
|
||
" <td id=\"T_a833d_row34_col0\" class=\"data row34 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row34_col2\" class=\"data row34 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row34_col3\" class=\"data row34 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row34_col4\" class=\"data row34 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row34_col5\" class=\"data row34 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row35\" class=\"row_heading level0 row35\" >T1087.002-Domain_Account</th>\n",
|
||
" <td id=\"T_a833d_row35_col0\" class=\"data row35 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row35_col1\" class=\"data row35 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row35_col2\" class=\"data row35 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row35_col3\" class=\"data row35 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row35_col4\" class=\"data row35 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row35_col5\" class=\"data row35 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row36\" class=\"row_heading level0 row36\" >T1087-Account_Discovery <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_a833d_row36_col0\" class=\"data row36 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row36_col1\" class=\"data row36 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row36_col2\" class=\"data row36 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row36_col3\" class=\"data row36 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row36_col4\" class=\"data row36 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row36_col5\" class=\"data row36 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row37\" class=\"row_heading level0 row37\" >T1218.011-Rundll32</th>\n",
|
||
" <td id=\"T_a833d_row37_col0\" class=\"data row37 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row37_col1\" class=\"data row37 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row37_col2\" class=\"data row37 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row37_col3\" class=\"data row37 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row37_col4\" class=\"data row37 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row37_col5\" class=\"data row37 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row38\" class=\"row_heading level0 row38\" >T1218.001-Compiled_HTML_File</th>\n",
|
||
" <td id=\"T_a833d_row38_col0\" class=\"data row38 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row38_col1\" class=\"data row38 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row38_col2\" class=\"data row38 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row38_col3\" class=\"data row38 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row38_col4\" class=\"data row38 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row38_col5\" class=\"data row38 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row39\" class=\"row_heading level0 row39\" >T1021.002-SMB/Windows_Admin_Shares</th>\n",
|
||
" <td id=\"T_a833d_row39_col0\" class=\"data row39 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row39_col1\" class=\"data row39 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row39_col2\" class=\"data row39 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row39_col3\" class=\"data row39 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row39_col4\" class=\"data row39 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row39_col5\" class=\"data row39 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row40\" class=\"row_heading level0 row40\" >T1564.001-Hidden_Files_and_Directories</th>\n",
|
||
" <td id=\"T_a833d_row40_col0\" class=\"data row40 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row40_col1\" class=\"data row40 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row40_col2\" class=\"data row40 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row40_col3\" class=\"data row40 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row40_col4\" class=\"data row40 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row40_col5\" class=\"data row40 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row41\" class=\"row_heading level0 row41\" >T1482-Domain_Trust_Discovery</th>\n",
|
||
" <td id=\"T_a833d_row41_col0\" class=\"data row41 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row41_col1\" class=\"data row41 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row41_col2\" class=\"data row41 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row41_col3\" class=\"data row41 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row41_col4\" class=\"data row41 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row41_col5\" class=\"data row41 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row42\" class=\"row_heading level0 row42\" >T1564-Hide_Artifacts <sub>(10)</sub></th>\n",
|
||
" <td id=\"T_a833d_row42_col0\" class=\"data row42 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row42_col1\" class=\"data row42 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row42_col2\" class=\"data row42 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row42_col3\" class=\"data row42 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row42_col4\" class=\"data row42 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row42_col5\" class=\"data row42 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row43\" class=\"row_heading level0 row43\" >T1559.001-Component_Object_Model</th>\n",
|
||
" <td id=\"T_a833d_row43_col0\" class=\"data row43 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row43_col1\" class=\"data row43 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row43_col2\" class=\"data row43 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row43_col3\" class=\"data row43 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row43_col4\" class=\"data row43 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row43_col5\" class=\"data row43 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row44\" class=\"row_heading level0 row44\" >T1566.002-Spearphishing_Link</th>\n",
|
||
" <td id=\"T_a833d_row44_col0\" class=\"data row44 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row44_col1\" class=\"data row44 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row44_col2\" class=\"data row44 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row44_col3\" class=\"data row44 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row44_col4\" class=\"data row44 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row44_col5\" class=\"data row44 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row45\" class=\"row_heading level0 row45\" >T1222.001-Windows_File_and_Directory_Permissions_Modification</th>\n",
|
||
" <td id=\"T_a833d_row45_col0\" class=\"data row45 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row45_col1\" class=\"data row45 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row45_col2\" class=\"data row45 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row45_col3\" class=\"data row45 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row45_col4\" class=\"data row45 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row45_col5\" class=\"data row45 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row46\" class=\"row_heading level0 row46\" >T1134.004-Parent_PID_Spoofing</th>\n",
|
||
" <td id=\"T_a833d_row46_col0\" class=\"data row46 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row46_col1\" class=\"data row46 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row46_col2\" class=\"data row46 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row46_col3\" class=\"data row46 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row46_col4\" class=\"data row46 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row46_col5\" class=\"data row46 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row47\" class=\"row_heading level0 row47\" >T1134-Access_Token_Manipulation <sub>(5)</sub></th>\n",
|
||
" <td id=\"T_a833d_row47_col0\" class=\"data row47 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row47_col1\" class=\"data row47 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row47_col2\" class=\"data row47 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row47_col3\" class=\"data row47 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row47_col4\" class=\"data row47 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row47_col5\" class=\"data row47 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row48\" class=\"row_heading level0 row48\" >T1574.001-DLL_Search_Order_Hijacking</th>\n",
|
||
" <td id=\"T_a833d_row48_col0\" class=\"data row48 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row48_col1\" class=\"data row48 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row48_col2\" class=\"data row48 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row48_col3\" class=\"data row48 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row48_col4\" class=\"data row48 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row48_col5\" class=\"data row48 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row49\" class=\"row_heading level0 row49\" >T1069-Permission_Groups_Discovery <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_a833d_row49_col0\" class=\"data row49 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row49_col1\" class=\"data row49 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row49_col2\" class=\"data row49 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row49_col3\" class=\"data row49 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row49_col4\" class=\"data row49 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row49_col5\" class=\"data row49 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row50\" class=\"row_heading level0 row50\" >T1069.001-Local_Groups</th>\n",
|
||
" <td id=\"T_a833d_row50_col0\" class=\"data row50 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row50_col1\" class=\"data row50 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row50_col2\" class=\"data row50 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row50_col3\" class=\"data row50 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row50_col4\" class=\"data row50 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row50_col5\" class=\"data row50 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row51\" class=\"row_heading level0 row51\" >T1059.005-Visual_Basic</th>\n",
|
||
" <td id=\"T_a833d_row51_col0\" class=\"data row51 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row51_col1\" class=\"data row51 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row51_col2\" class=\"data row51 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row51_col3\" class=\"data row51 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row51_col4\" class=\"data row51 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row51_col5\" class=\"data row51 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row52\" class=\"row_heading level0 row52\" >T1021.001-Remote_Desktop_Protocol</th>\n",
|
||
" <td id=\"T_a833d_row52_col0\" class=\"data row52 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row52_col1\" class=\"data row52 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row52_col2\" class=\"data row52 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row52_col3\" class=\"data row52 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row52_col4\" class=\"data row52 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row52_col5\" class=\"data row52 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row53\" class=\"row_heading level0 row53\" >T1531-Account_Access_Removal</th>\n",
|
||
" <td id=\"T_a833d_row53_col0\" class=\"data row53 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row53_col1\" class=\"data row53 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row53_col2\" class=\"data row53 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row53_col3\" class=\"data row53 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row53_col4\" class=\"data row53 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row53_col5\" class=\"data row53 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row54\" class=\"row_heading level0 row54\" >T1036.003-Rename_System_Utilities</th>\n",
|
||
" <td id=\"T_a833d_row54_col0\" class=\"data row54 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row54_col1\" class=\"data row54 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row54_col2\" class=\"data row54 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row54_col3\" class=\"data row54 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row54_col4\" class=\"data row54 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row54_col5\" class=\"data row54 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row55\" class=\"row_heading level0 row55\" >T1489-Service_Stop</th>\n",
|
||
" <td id=\"T_a833d_row55_col0\" class=\"data row55 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row55_col1\" class=\"data row55 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row55_col2\" class=\"data row55 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row55_col3\" class=\"data row55 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row55_col4\" class=\"data row55 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row55_col5\" class=\"data row55 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row56\" class=\"row_heading level0 row56\" >T1222-File_and_Directory_Permissions_Modification <sub>(2)</sub></th>\n",
|
||
" <td id=\"T_a833d_row56_col0\" class=\"data row56 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row56_col1\" class=\"data row56 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row56_col2\" class=\"data row56 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row56_col3\" class=\"data row56 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row56_col4\" class=\"data row56 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row56_col5\" class=\"data row56 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row57\" class=\"row_heading level0 row57\" >T1562.004-Disable_or_Modify_System_Firewall</th>\n",
|
||
" <td id=\"T_a833d_row57_col0\" class=\"data row57 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row57_col1\" class=\"data row57 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row57_col2\" class=\"data row57 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row57_col3\" class=\"data row57 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row57_col4\" class=\"data row57 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row57_col5\" class=\"data row57 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row58\" class=\"row_heading level0 row58\" >T1047-Windows_Management_Instrumentation</th>\n",
|
||
" <td id=\"T_a833d_row58_col0\" class=\"data row58 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row58_col1\" class=\"data row58 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row58_col2\" class=\"data row58 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row58_col3\" class=\"data row58 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row58_col4\" class=\"data row58 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row58_col5\" class=\"data row58 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row59\" class=\"row_heading level0 row59\" >T1574.002-DLL_Side-Loading</th>\n",
|
||
" <td id=\"T_a833d_row59_col0\" class=\"data row59 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row59_col1\" class=\"data row59 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row59_col2\" class=\"data row59 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row59_col3\" class=\"data row59 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row59_col4\" class=\"data row59 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row59_col5\" class=\"data row59 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row60\" class=\"row_heading level0 row60\" >T1574-Hijack_Execution_Flow <sub>(12)</sub></th>\n",
|
||
" <td id=\"T_a833d_row60_col0\" class=\"data row60 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row60_col1\" class=\"data row60 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row60_col2\" class=\"data row60 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row60_col3\" class=\"data row60 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row60_col4\" class=\"data row60 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row60_col5\" class=\"data row60 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row61\" class=\"row_heading level0 row61\" >T1113-Screen_Capture</th>\n",
|
||
" <td id=\"T_a833d_row61_col0\" class=\"data row61 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row61_col1\" class=\"data row61 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row61_col2\" class=\"data row61 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row61_col3\" class=\"data row61 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row61_col4\" class=\"data row61 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row61_col5\" class=\"data row61 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row62\" class=\"row_heading level0 row62\" >T1016-System_Network_Configuration_Discovery <sub>(1)</sub></th>\n",
|
||
" <td id=\"T_a833d_row62_col0\" class=\"data row62 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row62_col1\" class=\"data row62 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row62_col2\" class=\"data row62 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row62_col3\" class=\"data row62 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row62_col4\" class=\"data row62 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row62_col5\" class=\"data row62 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row63\" class=\"row_heading level0 row63\" >T1033-System_Owner/User_Discovery</th>\n",
|
||
" <td id=\"T_a833d_row63_col0\" class=\"data row63 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row63_col1\" class=\"data row63 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row63_col2\" class=\"data row63 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row63_col3\" class=\"data row63 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row63_col4\" class=\"data row63 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row63_col5\" class=\"data row63 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row64\" class=\"row_heading level0 row64\" >T1218.005-Mshta</th>\n",
|
||
" <td id=\"T_a833d_row64_col0\" class=\"data row64 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row64_col1\" class=\"data row64 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row64_col2\" class=\"data row64 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row64_col3\" class=\"data row64 col3\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row64_col4\" class=\"data row64 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row64_col5\" class=\"data row64 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row65\" class=\"row_heading level0 row65\" >T1014-Rootkit</th>\n",
|
||
" <td id=\"T_a833d_row65_col0\" class=\"data row65 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row65_col1\" class=\"data row65 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row65_col2\" class=\"data row65 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row65_col3\" class=\"data row65 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row65_col4\" class=\"data row65 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row65_col5\" class=\"data row65 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row66\" class=\"row_heading level0 row66\" >T1068-Exploitation_for_Privilege_Escalation</th>\n",
|
||
" <td id=\"T_a833d_row66_col0\" class=\"data row66 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row66_col1\" class=\"data row66 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row66_col2\" class=\"data row66 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row66_col3\" class=\"data row66 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row66_col4\" class=\"data row66 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row66_col5\" class=\"data row66 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row67\" class=\"row_heading level0 row67\" >T1219-Remote_Access_Software</th>\n",
|
||
" <td id=\"T_a833d_row67_col0\" class=\"data row67 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row67_col1\" class=\"data row67 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row67_col2\" class=\"data row67 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row67_col3\" class=\"data row67 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row67_col4\" class=\"data row67 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row67_col5\" class=\"data row67 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row68\" class=\"row_heading level0 row68\" >T1055.002-Portable_Executable_Injection</th>\n",
|
||
" <td id=\"T_a833d_row68_col0\" class=\"data row68 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row68_col1\" class=\"data row68 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row68_col2\" class=\"data row68 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row68_col3\" class=\"data row68 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row68_col4\" class=\"data row68 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row68_col5\" class=\"data row68 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row69\" class=\"row_heading level0 row69\" >T1136.001-Local_Account</th>\n",
|
||
" <td id=\"T_a833d_row69_col0\" class=\"data row69 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row69_col1\" class=\"data row69 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row69_col2\" class=\"data row69 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row69_col3\" class=\"data row69 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row69_col4\" class=\"data row69 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row69_col5\" class=\"data row69 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row70\" class=\"row_heading level0 row70\" >T1136-Create_Account <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_a833d_row70_col0\" class=\"data row70 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row70_col1\" class=\"data row70 col1\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row70_col2\" class=\"data row70 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row70_col3\" class=\"data row70 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row70_col4\" class=\"data row70 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row70_col5\" class=\"data row70 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row71\" class=\"row_heading level0 row71\" >T1070-Indicator_Removal <sub>(9)</sub></th>\n",
|
||
" <td id=\"T_a833d_row71_col0\" class=\"data row71 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row71_col1\" class=\"data row71 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row71_col2\" class=\"data row71 col2\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row71_col3\" class=\"data row71 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row71_col4\" class=\"data row71 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row71_col5\" class=\"data row71 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row72\" class=\"row_heading level0 row72\" >T1071.003-Mail_Protocols</th>\n",
|
||
" <td id=\"T_a833d_row72_col0\" class=\"data row72 col0\" >no</td>\n",
|
||
" <td id=\"T_a833d_row72_col1\" class=\"data row72 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row72_col2\" class=\"data row72 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row72_col3\" class=\"data row72 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row72_col4\" class=\"data row72 col4\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row72_col5\" class=\"data row72 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_a833d_level0_row73\" class=\"row_heading level0 row73\" >T1016.001-Internet_Connection_Discovery</th>\n",
|
||
" <td id=\"T_a833d_row73_col0\" class=\"data row73 col0\" >yes</td>\n",
|
||
" <td id=\"T_a833d_row73_col1\" class=\"data row73 col1\" >no</td>\n",
|
||
" <td id=\"T_a833d_row73_col2\" class=\"data row73 col2\" >no</td>\n",
|
||
" <td id=\"T_a833d_row73_col3\" class=\"data row73 col3\" >no</td>\n",
|
||
" <td id=\"T_a833d_row73_col4\" class=\"data row73 col4\" >no</td>\n",
|
||
" <td id=\"T_a833d_row73_col5\" class=\"data row73 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c2527f0>"
|
||
]
|
||
},
|
||
"execution_count": 47,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"\n",
|
||
"\n",
|
||
"new_table = yes_no_table(mitre_attack_tid_name_dict, story_name_list)\n",
|
||
"tdf = pd.DataFrame.from_dict(new_table, orient=\"index\")\n",
|
||
"tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n",
|
||
"print(tdf.shape)\n",
|
||
"tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n",
|
||
"tdf.style.apply(highlight_rows, axis=1) "
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 48,
|
||
"id": "3f48e979-531c-466c-a299-1282cff990df",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(7, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_f136c_row0_col0, #T_f136c_row0_col1, #T_f136c_row0_col2, #T_f136c_row0_col3, #T_f136c_row0_col4, #T_f136c_row0_col5, #T_f136c_row1_col0, #T_f136c_row1_col1, #T_f136c_row1_col2, #T_f136c_row1_col3, #T_f136c_row1_col4, #T_f136c_row1_col5, #T_f136c_row2_col0, #T_f136c_row2_col1, #T_f136c_row2_col2, #T_f136c_row2_col3, #T_f136c_row2_col4, #T_f136c_row2_col5, #T_f136c_row3_col0, #T_f136c_row3_col1, #T_f136c_row3_col2, #T_f136c_row3_col3, #T_f136c_row3_col4, #T_f136c_row3_col5, #T_f136c_row4_col0, #T_f136c_row4_col1, #T_f136c_row4_col2, #T_f136c_row4_col3, #T_f136c_row4_col4, #T_f136c_row4_col5, #T_f136c_row5_col0, #T_f136c_row5_col1, #T_f136c_row5_col2, #T_f136c_row5_col3, #T_f136c_row5_col4, #T_f136c_row5_col5, #T_f136c_row6_col0, #T_f136c_row6_col1, #T_f136c_row6_col2, #T_f136c_row6_col3, #T_f136c_row6_col4, #T_f136c_row6_col5 {\n",
|
||
" background-color: yellow;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_f136c\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_f136c_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_f136c_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_f136c_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_f136c_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_f136c_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_f136c_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_f136c_level0_row0\" class=\"row_heading level0 row0\" >T1562.001-Disable_or_Modify_Tools</th>\n",
|
||
" <td id=\"T_f136c_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row0_col2\" class=\"data row0 col2\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row0_col5\" class=\"data row0 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_f136c_level0_row1\" class=\"row_heading level0 row1\" >T1036-Masquerading <sub>(7)</sub></th>\n",
|
||
" <td id=\"T_f136c_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row1_col5\" class=\"data row1 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_f136c_level0_row2\" class=\"row_heading level0 row2\" >T1566-Phishing <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_f136c_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row2_col5\" class=\"data row2 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_f136c_level0_row3\" class=\"row_heading level0 row3\" >T1566.001-Spearphishing_Attachment</th>\n",
|
||
" <td id=\"T_f136c_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row3_col5\" class=\"data row3 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_f136c_level0_row4\" class=\"row_heading level0 row4\" >T1562-Impair_Defenses <sub>(9)</sub></th>\n",
|
||
" <td id=\"T_f136c_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row4_col5\" class=\"data row4 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_f136c_level0_row5\" class=\"row_heading level0 row5\" >T1543-Create_or_Modify_System_Process <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_f136c_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row5_col4\" class=\"data row5 col4\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row5_col5\" class=\"data row5 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_f136c_level0_row6\" class=\"row_heading level0 row6\" >T1059-Command_and_Scripting_Interpreter <sub>(8)</sub></th>\n",
|
||
" <td id=\"T_f136c_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row6_col3\" class=\"data row6 col3\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_f136c_row6_col5\" class=\"data row6 col5\" >5</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c221ca0>"
|
||
]
|
||
},
|
||
"execution_count": 48,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 5]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 49,
|
||
"id": "21f3b96f-b020-49ee-97a9-579196ba6a99",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(5, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_5ffcc_row0_col0, #T_5ffcc_row0_col1, #T_5ffcc_row0_col2, #T_5ffcc_row0_col3, #T_5ffcc_row0_col4, #T_5ffcc_row0_col5, #T_5ffcc_row1_col0, #T_5ffcc_row1_col1, #T_5ffcc_row1_col2, #T_5ffcc_row1_col3, #T_5ffcc_row1_col4, #T_5ffcc_row1_col5, #T_5ffcc_row2_col0, #T_5ffcc_row2_col1, #T_5ffcc_row2_col2, #T_5ffcc_row2_col3, #T_5ffcc_row2_col4, #T_5ffcc_row2_col5, #T_5ffcc_row3_col0, #T_5ffcc_row3_col1, #T_5ffcc_row3_col2, #T_5ffcc_row3_col3, #T_5ffcc_row3_col4, #T_5ffcc_row3_col5, #T_5ffcc_row4_col0, #T_5ffcc_row4_col1, #T_5ffcc_row4_col2, #T_5ffcc_row4_col3, #T_5ffcc_row4_col4, #T_5ffcc_row4_col5 {\n",
|
||
" background-color: orange;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_5ffcc\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_5ffcc_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_5ffcc_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_5ffcc_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_5ffcc_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_5ffcc_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_5ffcc_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5ffcc_level0_row0\" class=\"row_heading level0 row0\" >T1053.005-Scheduled_Task</th>\n",
|
||
" <td id=\"T_5ffcc_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_5ffcc_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row0_col5\" class=\"data row0 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5ffcc_level0_row1\" class=\"row_heading level0 row1\" >T1204.001-Malicious_Link</th>\n",
|
||
" <td id=\"T_5ffcc_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_5ffcc_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row1_col5\" class=\"data row1 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5ffcc_level0_row2\" class=\"row_heading level0 row2\" >T1204-User_Execution <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_5ffcc_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row2_col2\" class=\"data row2 col2\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row2_col3\" class=\"data row2 col3\" >no</td>\n",
|
||
" <td id=\"T_5ffcc_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row2_col5\" class=\"data row2 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5ffcc_level0_row3\" class=\"row_heading level0 row3\" >T1053-Scheduled_Task/Job <sub>(5)</sub></th>\n",
|
||
" <td id=\"T_5ffcc_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_5ffcc_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row3_col5\" class=\"data row3 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_5ffcc_level0_row4\" class=\"row_heading level0 row4\" >T1218-System_Binary_Proxy_Execution <sub>(13)</sub></th>\n",
|
||
" <td id=\"T_5ffcc_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row4_col1\" class=\"data row4 col1\" >no</td>\n",
|
||
" <td id=\"T_5ffcc_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_5ffcc_row4_col5\" class=\"data row4 col5\" >4</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c25b400>"
|
||
]
|
||
},
|
||
"execution_count": 49,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 4]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 50,
|
||
"id": "22b8ad1c-1a53-41ba-bdff-6d5ed29f8ad5",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(11, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_99af6_row0_col0, #T_99af6_row0_col1, #T_99af6_row0_col2, #T_99af6_row0_col3, #T_99af6_row0_col4, #T_99af6_row0_col5, #T_99af6_row1_col0, #T_99af6_row1_col1, #T_99af6_row1_col2, #T_99af6_row1_col3, #T_99af6_row1_col4, #T_99af6_row1_col5, #T_99af6_row2_col0, #T_99af6_row2_col1, #T_99af6_row2_col2, #T_99af6_row2_col3, #T_99af6_row2_col4, #T_99af6_row2_col5, #T_99af6_row3_col0, #T_99af6_row3_col1, #T_99af6_row3_col2, #T_99af6_row3_col3, #T_99af6_row3_col4, #T_99af6_row3_col5, #T_99af6_row4_col0, #T_99af6_row4_col1, #T_99af6_row4_col2, #T_99af6_row4_col3, #T_99af6_row4_col4, #T_99af6_row4_col5, #T_99af6_row5_col0, #T_99af6_row5_col1, #T_99af6_row5_col2, #T_99af6_row5_col3, #T_99af6_row5_col4, #T_99af6_row5_col5, #T_99af6_row6_col0, #T_99af6_row6_col1, #T_99af6_row6_col2, #T_99af6_row6_col3, #T_99af6_row6_col4, #T_99af6_row6_col5, #T_99af6_row7_col0, #T_99af6_row7_col1, #T_99af6_row7_col2, #T_99af6_row7_col3, #T_99af6_row7_col4, #T_99af6_row7_col5, #T_99af6_row8_col0, #T_99af6_row8_col1, #T_99af6_row8_col2, #T_99af6_row8_col3, #T_99af6_row8_col4, #T_99af6_row8_col5, #T_99af6_row9_col0, #T_99af6_row9_col1, #T_99af6_row9_col2, #T_99af6_row9_col3, #T_99af6_row9_col4, #T_99af6_row9_col5, #T_99af6_row10_col0, #T_99af6_row10_col1, #T_99af6_row10_col2, #T_99af6_row10_col3, #T_99af6_row10_col4, #T_99af6_row10_col5 {\n",
|
||
" background-color: lightgreen;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_99af6\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_99af6_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_99af6_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_99af6_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_99af6_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_99af6_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_99af6_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row0\" class=\"row_heading level0 row0\" >T1543.003-Windows_Service</th>\n",
|
||
" <td id=\"T_99af6_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_99af6_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row0_col4\" class=\"data row0 col4\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row0_col5\" class=\"data row0 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row1\" class=\"row_heading level0 row1\" >T1548.002-Bypass_User_Account_Control</th>\n",
|
||
" <td id=\"T_99af6_row1_col0\" class=\"data row1 col0\" >no</td>\n",
|
||
" <td id=\"T_99af6_row1_col1\" class=\"data row1 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row1_col4\" class=\"data row1 col4\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row1_col5\" class=\"data row1 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row2\" class=\"row_heading level0 row2\" >T1059.001-PowerShell</th>\n",
|
||
" <td id=\"T_99af6_row2_col0\" class=\"data row2 col0\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_99af6_row2_col3\" class=\"data row2 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row2_col4\" class=\"data row2 col4\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row2_col5\" class=\"data row2 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row3\" class=\"row_heading level0 row3\" >T1548-Abuse_Elevation_Control_Mechanism <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_99af6_row3_col0\" class=\"data row3 col0\" >no</td>\n",
|
||
" <td id=\"T_99af6_row3_col1\" class=\"data row3 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row3_col2\" class=\"data row3 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row3_col3\" class=\"data row3 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row3_col5\" class=\"data row3 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row4\" class=\"row_heading level0 row4\" >T1555-Credentials_from_Password_Stores <sub>(5)</sub></th>\n",
|
||
" <td id=\"T_99af6_row4_col0\" class=\"data row4 col0\" >no</td>\n",
|
||
" <td id=\"T_99af6_row4_col1\" class=\"data row4 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row4_col3\" class=\"data row4 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row4_col4\" class=\"data row4 col4\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row4_col5\" class=\"data row4 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row5\" class=\"row_heading level0 row5\" >T1547.001-Registry_Run_Keys_/_Startup_Folder</th>\n",
|
||
" <td id=\"T_99af6_row5_col0\" class=\"data row5 col0\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row5_col2\" class=\"data row5 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row5_col3\" class=\"data row5 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_99af6_row5_col5\" class=\"data row5 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row6\" class=\"row_heading level0 row6\" >T1555.003-Credentials_from_Web_Browsers</th>\n",
|
||
" <td id=\"T_99af6_row6_col0\" class=\"data row6 col0\" >no</td>\n",
|
||
" <td id=\"T_99af6_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row6_col2\" class=\"data row6 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row6_col3\" class=\"data row6 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row6_col4\" class=\"data row6 col4\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row6_col5\" class=\"data row6 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row7\" class=\"row_heading level0 row7\" >T1112-Modify_Registry</th>\n",
|
||
" <td id=\"T_99af6_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_99af6_row7_col5\" class=\"data row7 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row8\" class=\"row_heading level0 row8\" >T1071-Application_Layer_Protocol <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_99af6_row8_col0\" class=\"data row8 col0\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row8_col2\" class=\"data row8 col2\" >no</td>\n",
|
||
" <td id=\"T_99af6_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row8_col4\" class=\"data row8 col4\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row8_col5\" class=\"data row8 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row9\" class=\"row_heading level0 row9\" >T1547-Boot_or_Logon_Autostart_Execution <sub>(14)</sub></th>\n",
|
||
" <td id=\"T_99af6_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row9_col1\" class=\"data row9 col1\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_99af6_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_99af6_row9_col5\" class=\"data row9 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_99af6_level0_row10\" class=\"row_heading level0 row10\" >T1055-Process_Injection <sub>(12)</sub></th>\n",
|
||
" <td id=\"T_99af6_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row10_col1\" class=\"data row10 col1\" >no</td>\n",
|
||
" <td id=\"T_99af6_row10_col2\" class=\"data row10 col2\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row10_col3\" class=\"data row10 col3\" >yes</td>\n",
|
||
" <td id=\"T_99af6_row10_col4\" class=\"data row10 col4\" >no</td>\n",
|
||
" <td id=\"T_99af6_row10_col5\" class=\"data row10 col5\" >3</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c25bee0>"
|
||
]
|
||
},
|
||
"execution_count": 50,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 3]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 51,
|
||
"id": "fb52fd1f-f949-4caf-a0e3-e0a40ebffb85",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(12, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_6d5e4_row0_col0, #T_6d5e4_row0_col1, #T_6d5e4_row0_col2, #T_6d5e4_row0_col3, #T_6d5e4_row0_col4, #T_6d5e4_row0_col5, #T_6d5e4_row1_col0, #T_6d5e4_row1_col1, #T_6d5e4_row1_col2, #T_6d5e4_row1_col3, #T_6d5e4_row1_col4, #T_6d5e4_row1_col5, #T_6d5e4_row2_col0, #T_6d5e4_row2_col1, #T_6d5e4_row2_col2, #T_6d5e4_row2_col3, #T_6d5e4_row2_col4, #T_6d5e4_row2_col5, #T_6d5e4_row3_col0, #T_6d5e4_row3_col1, #T_6d5e4_row3_col2, #T_6d5e4_row3_col3, #T_6d5e4_row3_col4, #T_6d5e4_row3_col5, #T_6d5e4_row4_col0, #T_6d5e4_row4_col1, #T_6d5e4_row4_col2, #T_6d5e4_row4_col3, #T_6d5e4_row4_col4, #T_6d5e4_row4_col5, #T_6d5e4_row5_col0, #T_6d5e4_row5_col1, #T_6d5e4_row5_col2, #T_6d5e4_row5_col3, #T_6d5e4_row5_col4, #T_6d5e4_row5_col5, #T_6d5e4_row6_col0, #T_6d5e4_row6_col1, #T_6d5e4_row6_col2, #T_6d5e4_row6_col3, #T_6d5e4_row6_col4, #T_6d5e4_row6_col5, #T_6d5e4_row7_col0, #T_6d5e4_row7_col1, #T_6d5e4_row7_col2, #T_6d5e4_row7_col3, #T_6d5e4_row7_col4, #T_6d5e4_row7_col5, #T_6d5e4_row8_col0, #T_6d5e4_row8_col1, #T_6d5e4_row8_col2, #T_6d5e4_row8_col3, #T_6d5e4_row8_col4, #T_6d5e4_row8_col5, #T_6d5e4_row9_col0, #T_6d5e4_row9_col1, #T_6d5e4_row9_col2, #T_6d5e4_row9_col3, #T_6d5e4_row9_col4, #T_6d5e4_row9_col5, #T_6d5e4_row10_col0, #T_6d5e4_row10_col1, #T_6d5e4_row10_col2, #T_6d5e4_row10_col3, #T_6d5e4_row10_col4, #T_6d5e4_row10_col5, #T_6d5e4_row11_col0, #T_6d5e4_row11_col1, #T_6d5e4_row11_col2, #T_6d5e4_row11_col3, #T_6d5e4_row11_col4, #T_6d5e4_row11_col5 {\n",
|
||
" background-color: lightblue;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_6d5e4\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_6d5e4_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_6d5e4_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_6d5e4_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_6d5e4_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_6d5e4_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_6d5e4_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row0\" class=\"row_heading level0 row0\" >T1049-System_Network_Connections_Discovery</th>\n",
|
||
" <td id=\"T_6d5e4_row0_col0\" class=\"data row0 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row0_col1\" class=\"data row0 col1\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row0_col3\" class=\"data row0 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row0_col4\" class=\"data row0 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row0_col5\" class=\"data row0 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row1\" class=\"row_heading level0 row1\" >T1592-Gather_Victim_Host_Information <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_6d5e4_row1_col0\" class=\"data row1 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row1_col1\" class=\"data row1 col1\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row1_col2\" class=\"data row1 col2\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row1_col3\" class=\"data row1 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row1_col4\" class=\"data row1 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row1_col5\" class=\"data row1 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row2\" class=\"row_heading level0 row2\" >T1021-Remote_Services <sub>(6)</sub></th>\n",
|
||
" <td id=\"T_6d5e4_row2_col0\" class=\"data row2 col0\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row2_col1\" class=\"data row2 col1\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row2_col4\" class=\"data row2 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row2_col5\" class=\"data row2 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row3\" class=\"row_heading level0 row3\" >T1027-Obfuscated_Files_or_Information <sub>(9)</sub></th>\n",
|
||
" <td id=\"T_6d5e4_row3_col0\" class=\"data row3 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row3_col1\" class=\"data row3 col1\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row3_col3\" class=\"data row3 col3\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row3_col4\" class=\"data row3 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row3_col5\" class=\"data row3 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row4\" class=\"row_heading level0 row4\" >T1055.001-Dynamic-link_Library_Injection</th>\n",
|
||
" <td id=\"T_6d5e4_row4_col0\" class=\"data row4 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row4_col1\" class=\"data row4 col1\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row4_col2\" class=\"data row4 col2\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row4_col3\" class=\"data row4 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row4_col4\" class=\"data row4 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row4_col5\" class=\"data row4 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row5\" class=\"row_heading level0 row5\" >T1590-Gather_Victim_Network_Information <sub>(6)</sub></th>\n",
|
||
" <td id=\"T_6d5e4_row5_col0\" class=\"data row5 col0\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row5_col2\" class=\"data row5 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row5_col3\" class=\"data row5 col3\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row5_col5\" class=\"data row5 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row6\" class=\"row_heading level0 row6\" >T1059.003-Windows_Command_Shell</th>\n",
|
||
" <td id=\"T_6d5e4_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row6_col1\" class=\"data row6 col1\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row6_col2\" class=\"data row6 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row6_col3\" class=\"data row6 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row6_col4\" class=\"data row6 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row6_col5\" class=\"data row6 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row7\" class=\"row_heading level0 row7\" >T1218.010-Regsvr32</th>\n",
|
||
" <td id=\"T_6d5e4_row7_col0\" class=\"data row7 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row7_col1\" class=\"data row7 col1\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row7_col2\" class=\"data row7 col2\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row7_col5\" class=\"data row7 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row8\" class=\"row_heading level0 row8\" >T1590.005-IP_Addresses</th>\n",
|
||
" <td id=\"T_6d5e4_row8_col0\" class=\"data row8 col0\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row8_col1\" class=\"data row8 col1\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row8_col2\" class=\"data row8 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row8_col3\" class=\"data row8 col3\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row8_col4\" class=\"data row8 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row8_col5\" class=\"data row8 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row9\" class=\"row_heading level0 row9\" >T1059.007-JavaScript</th>\n",
|
||
" <td id=\"T_6d5e4_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row9_col1\" class=\"data row9 col1\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row9_col2\" class=\"data row9 col2\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row9_col5\" class=\"data row9 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row10\" class=\"row_heading level0 row10\" >T1569-System_Services <sub>(2)</sub></th>\n",
|
||
" <td id=\"T_6d5e4_row10_col0\" class=\"data row10 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row10_col2\" class=\"data row10 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row10_col3\" class=\"data row10 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row10_col4\" class=\"data row10 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row10_col5\" class=\"data row10 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_6d5e4_level0_row11\" class=\"row_heading level0 row11\" >T1569.002-Service_Execution</th>\n",
|
||
" <td id=\"T_6d5e4_row11_col0\" class=\"data row11 col0\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row11_col1\" class=\"data row11 col1\" >yes</td>\n",
|
||
" <td id=\"T_6d5e4_row11_col2\" class=\"data row11 col2\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row11_col3\" class=\"data row11 col3\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row11_col4\" class=\"data row11 col4\" >no</td>\n",
|
||
" <td id=\"T_6d5e4_row11_col5\" class=\"data row11 col5\" >2</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c25b280>"
|
||
]
|
||
},
|
||
"execution_count": 51,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 2]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 52,
|
||
"id": "5533fb9c-36af-4ea1-addc-0f447f3e62dc",
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"name": "stdout",
|
||
"output_type": "stream",
|
||
"text": [
|
||
"(39, 6)\n"
|
||
]
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">\n",
|
||
"#T_67af1_row0_col0, #T_67af1_row0_col1, #T_67af1_row0_col2, #T_67af1_row0_col3, #T_67af1_row0_col4, #T_67af1_row0_col5, #T_67af1_row1_col0, #T_67af1_row1_col1, #T_67af1_row1_col2, #T_67af1_row1_col3, #T_67af1_row1_col4, #T_67af1_row1_col5, #T_67af1_row2_col0, #T_67af1_row2_col1, #T_67af1_row2_col2, #T_67af1_row2_col3, #T_67af1_row2_col4, #T_67af1_row2_col5, #T_67af1_row3_col0, #T_67af1_row3_col1, #T_67af1_row3_col2, #T_67af1_row3_col3, #T_67af1_row3_col4, #T_67af1_row3_col5, #T_67af1_row4_col0, #T_67af1_row4_col1, #T_67af1_row4_col2, #T_67af1_row4_col3, #T_67af1_row4_col4, #T_67af1_row4_col5, #T_67af1_row5_col0, #T_67af1_row5_col1, #T_67af1_row5_col2, #T_67af1_row5_col3, #T_67af1_row5_col4, #T_67af1_row5_col5, #T_67af1_row6_col0, #T_67af1_row6_col1, #T_67af1_row6_col2, #T_67af1_row6_col3, #T_67af1_row6_col4, #T_67af1_row6_col5, #T_67af1_row7_col0, #T_67af1_row7_col1, #T_67af1_row7_col2, #T_67af1_row7_col3, #T_67af1_row7_col4, #T_67af1_row7_col5, #T_67af1_row8_col0, #T_67af1_row8_col1, #T_67af1_row8_col2, #T_67af1_row8_col3, #T_67af1_row8_col4, #T_67af1_row8_col5, #T_67af1_row9_col0, #T_67af1_row9_col1, #T_67af1_row9_col2, #T_67af1_row9_col3, #T_67af1_row9_col4, #T_67af1_row9_col5, #T_67af1_row10_col0, #T_67af1_row10_col1, #T_67af1_row10_col2, #T_67af1_row10_col3, #T_67af1_row10_col4, #T_67af1_row10_col5, #T_67af1_row11_col0, #T_67af1_row11_col1, #T_67af1_row11_col2, #T_67af1_row11_col3, #T_67af1_row11_col4, #T_67af1_row11_col5, #T_67af1_row12_col0, #T_67af1_row12_col1, #T_67af1_row12_col2, #T_67af1_row12_col3, #T_67af1_row12_col4, #T_67af1_row12_col5, #T_67af1_row13_col0, #T_67af1_row13_col1, #T_67af1_row13_col2, #T_67af1_row13_col3, #T_67af1_row13_col4, #T_67af1_row13_col5, #T_67af1_row14_col0, #T_67af1_row14_col1, #T_67af1_row14_col2, #T_67af1_row14_col3, #T_67af1_row14_col4, #T_67af1_row14_col5, #T_67af1_row15_col0, #T_67af1_row15_col1, #T_67af1_row15_col2, #T_67af1_row15_col3, #T_67af1_row15_col4, #T_67af1_row15_col5, #T_67af1_row16_col0, #T_67af1_row16_col1, #T_67af1_row16_col2, #T_67af1_row16_col3, #T_67af1_row16_col4, #T_67af1_row16_col5, #T_67af1_row17_col0, #T_67af1_row17_col1, #T_67af1_row17_col2, #T_67af1_row17_col3, #T_67af1_row17_col4, #T_67af1_row17_col5, #T_67af1_row18_col0, #T_67af1_row18_col1, #T_67af1_row18_col2, #T_67af1_row18_col3, #T_67af1_row18_col4, #T_67af1_row18_col5, #T_67af1_row19_col0, #T_67af1_row19_col1, #T_67af1_row19_col2, #T_67af1_row19_col3, #T_67af1_row19_col4, #T_67af1_row19_col5, #T_67af1_row20_col0, #T_67af1_row20_col1, #T_67af1_row20_col2, #T_67af1_row20_col3, #T_67af1_row20_col4, #T_67af1_row20_col5, #T_67af1_row21_col0, #T_67af1_row21_col1, #T_67af1_row21_col2, #T_67af1_row21_col3, #T_67af1_row21_col4, #T_67af1_row21_col5, #T_67af1_row22_col0, #T_67af1_row22_col1, #T_67af1_row22_col2, #T_67af1_row22_col3, #T_67af1_row22_col4, #T_67af1_row22_col5, #T_67af1_row23_col0, #T_67af1_row23_col1, #T_67af1_row23_col2, #T_67af1_row23_col3, #T_67af1_row23_col4, #T_67af1_row23_col5, #T_67af1_row24_col0, #T_67af1_row24_col1, #T_67af1_row24_col2, #T_67af1_row24_col3, #T_67af1_row24_col4, #T_67af1_row24_col5, #T_67af1_row25_col0, #T_67af1_row25_col1, #T_67af1_row25_col2, #T_67af1_row25_col3, #T_67af1_row25_col4, #T_67af1_row25_col5, #T_67af1_row26_col0, #T_67af1_row26_col1, #T_67af1_row26_col2, #T_67af1_row26_col3, #T_67af1_row26_col4, #T_67af1_row26_col5, #T_67af1_row27_col0, #T_67af1_row27_col1, #T_67af1_row27_col2, #T_67af1_row27_col3, #T_67af1_row27_col4, #T_67af1_row27_col5, #T_67af1_row28_col0, #T_67af1_row28_col1, #T_67af1_row28_col2, #T_67af1_row28_col3, #T_67af1_row28_col4, #T_67af1_row28_col5, #T_67af1_row29_col0, #T_67af1_row29_col1, #T_67af1_row29_col2, #T_67af1_row29_col3, #T_67af1_row29_col4, #T_67af1_row29_col5, #T_67af1_row30_col0, #T_67af1_row30_col1, #T_67af1_row30_col2, #T_67af1_row30_col3, #T_67af1_row30_col4, #T_67af1_row30_col5, #T_67af1_row31_col0, #T_67af1_row31_col1, #T_67af1_row31_col2, #T_67af1_row31_col3, #T_67af1_row31_col4, #T_67af1_row31_col5, #T_67af1_row32_col0, #T_67af1_row32_col1, #T_67af1_row32_col2, #T_67af1_row32_col3, #T_67af1_row32_col4, #T_67af1_row32_col5, #T_67af1_row33_col0, #T_67af1_row33_col1, #T_67af1_row33_col2, #T_67af1_row33_col3, #T_67af1_row33_col4, #T_67af1_row33_col5, #T_67af1_row34_col0, #T_67af1_row34_col1, #T_67af1_row34_col2, #T_67af1_row34_col3, #T_67af1_row34_col4, #T_67af1_row34_col5, #T_67af1_row35_col0, #T_67af1_row35_col1, #T_67af1_row35_col2, #T_67af1_row35_col3, #T_67af1_row35_col4, #T_67af1_row35_col5, #T_67af1_row36_col0, #T_67af1_row36_col1, #T_67af1_row36_col2, #T_67af1_row36_col3, #T_67af1_row36_col4, #T_67af1_row36_col5, #T_67af1_row37_col0, #T_67af1_row37_col1, #T_67af1_row37_col2, #T_67af1_row37_col3, #T_67af1_row37_col4, #T_67af1_row37_col5, #T_67af1_row38_col0, #T_67af1_row38_col1, #T_67af1_row38_col2, #T_67af1_row38_col3, #T_67af1_row38_col4, #T_67af1_row38_col5 {\n",
|
||
" background-color: lightgray;\n",
|
||
"}\n",
|
||
"</style>\n",
|
||
"<table id=\"T_67af1\">\n",
|
||
" <thead>\n",
|
||
" <tr>\n",
|
||
" <th class=\"blank level0\" > </th>\n",
|
||
" <th id=\"T_67af1_level0_col0\" class=\"col_heading level0 col0\" >Qakbot</th>\n",
|
||
" <th id=\"T_67af1_level0_col1\" class=\"col_heading level0 col1\" >Azorult</th>\n",
|
||
" <th id=\"T_67af1_level0_col2\" class=\"col_heading level0 col2\" >Remcos</th>\n",
|
||
" <th id=\"T_67af1_level0_col3\" class=\"col_heading level0 col3\" >Trickbot</th>\n",
|
||
" <th id=\"T_67af1_level0_col4\" class=\"col_heading level0 col4\" >AgentTesla</th>\n",
|
||
" <th id=\"T_67af1_level0_col5\" class=\"col_heading level0 col5\" >total_coverage</th>\n",
|
||
" </tr>\n",
|
||
" </thead>\n",
|
||
" <tbody>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row0\" class=\"row_heading level0 row0\" >T1087.002-Domain_Account</th>\n",
|
||
" <td id=\"T_67af1_row0_col0\" class=\"data row0 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row0_col1\" class=\"data row0 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row0_col2\" class=\"data row0 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row0_col3\" class=\"data row0 col3\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row0_col4\" class=\"data row0 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row0_col5\" class=\"data row0 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row1\" class=\"row_heading level0 row1\" >T1087-Account_Discovery <sub>(4)</sub></th>\n",
|
||
" <td id=\"T_67af1_row1_col0\" class=\"data row1 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row1_col1\" class=\"data row1 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row1_col2\" class=\"data row1 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row1_col3\" class=\"data row1 col3\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row1_col4\" class=\"data row1 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row1_col5\" class=\"data row1 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row2\" class=\"row_heading level0 row2\" >T1218.011-Rundll32</th>\n",
|
||
" <td id=\"T_67af1_row2_col0\" class=\"data row2 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row2_col1\" class=\"data row2 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row2_col2\" class=\"data row2 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row2_col3\" class=\"data row2 col3\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row2_col4\" class=\"data row2 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row2_col5\" class=\"data row2 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row3\" class=\"row_heading level0 row3\" >T1218.001-Compiled_HTML_File</th>\n",
|
||
" <td id=\"T_67af1_row3_col0\" class=\"data row3 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row3_col1\" class=\"data row3 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row3_col2\" class=\"data row3 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row3_col3\" class=\"data row3 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row3_col4\" class=\"data row3 col4\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row3_col5\" class=\"data row3 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row4\" class=\"row_heading level0 row4\" >T1021.002-SMB/Windows_Admin_Shares</th>\n",
|
||
" <td id=\"T_67af1_row4_col0\" class=\"data row4 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row4_col1\" class=\"data row4 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row4_col2\" class=\"data row4 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row4_col3\" class=\"data row4 col3\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row4_col4\" class=\"data row4 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row4_col5\" class=\"data row4 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row5\" class=\"row_heading level0 row5\" >T1564.001-Hidden_Files_and_Directories</th>\n",
|
||
" <td id=\"T_67af1_row5_col0\" class=\"data row5 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row5_col1\" class=\"data row5 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row5_col2\" class=\"data row5 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row5_col3\" class=\"data row5 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row5_col4\" class=\"data row5 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row5_col5\" class=\"data row5 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row6\" class=\"row_heading level0 row6\" >T1482-Domain_Trust_Discovery</th>\n",
|
||
" <td id=\"T_67af1_row6_col0\" class=\"data row6 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row6_col1\" class=\"data row6 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row6_col2\" class=\"data row6 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row6_col3\" class=\"data row6 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row6_col4\" class=\"data row6 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row6_col5\" class=\"data row6 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row7\" class=\"row_heading level0 row7\" >T1564-Hide_Artifacts <sub>(10)</sub></th>\n",
|
||
" <td id=\"T_67af1_row7_col0\" class=\"data row7 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row7_col1\" class=\"data row7 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row7_col2\" class=\"data row7 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row7_col3\" class=\"data row7 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row7_col4\" class=\"data row7 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row7_col5\" class=\"data row7 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row8\" class=\"row_heading level0 row8\" >T1559.001-Component_Object_Model</th>\n",
|
||
" <td id=\"T_67af1_row8_col0\" class=\"data row8 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row8_col1\" class=\"data row8 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row8_col2\" class=\"data row8 col2\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row8_col3\" class=\"data row8 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row8_col4\" class=\"data row8 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row8_col5\" class=\"data row8 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row9\" class=\"row_heading level0 row9\" >T1566.002-Spearphishing_Link</th>\n",
|
||
" <td id=\"T_67af1_row9_col0\" class=\"data row9 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row9_col1\" class=\"data row9 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row9_col2\" class=\"data row9 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row9_col3\" class=\"data row9 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row9_col4\" class=\"data row9 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row9_col5\" class=\"data row9 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row10\" class=\"row_heading level0 row10\" >T1222.001-Windows_File_and_Directory_Permissions_Modification</th>\n",
|
||
" <td id=\"T_67af1_row10_col0\" class=\"data row10 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row10_col1\" class=\"data row10 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row10_col2\" class=\"data row10 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row10_col3\" class=\"data row10 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row10_col4\" class=\"data row10 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row10_col5\" class=\"data row10 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row11\" class=\"row_heading level0 row11\" >T1134.004-Parent_PID_Spoofing</th>\n",
|
||
" <td id=\"T_67af1_row11_col0\" class=\"data row11 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row11_col1\" class=\"data row11 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row11_col2\" class=\"data row11 col2\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row11_col3\" class=\"data row11 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row11_col4\" class=\"data row11 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row11_col5\" class=\"data row11 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row12\" class=\"row_heading level0 row12\" >T1134-Access_Token_Manipulation <sub>(5)</sub></th>\n",
|
||
" <td id=\"T_67af1_row12_col0\" class=\"data row12 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row12_col1\" class=\"data row12 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row12_col2\" class=\"data row12 col2\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row12_col3\" class=\"data row12 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row12_col4\" class=\"data row12 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row12_col5\" class=\"data row12 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row13\" class=\"row_heading level0 row13\" >T1574.001-DLL_Search_Order_Hijacking</th>\n",
|
||
" <td id=\"T_67af1_row13_col0\" class=\"data row13 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row13_col1\" class=\"data row13 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row13_col2\" class=\"data row13 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row13_col3\" class=\"data row13 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row13_col4\" class=\"data row13 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row13_col5\" class=\"data row13 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row14\" class=\"row_heading level0 row14\" >T1069-Permission_Groups_Discovery <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_67af1_row14_col0\" class=\"data row14 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row14_col1\" class=\"data row14 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row14_col2\" class=\"data row14 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row14_col3\" class=\"data row14 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row14_col4\" class=\"data row14 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row14_col5\" class=\"data row14 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row15\" class=\"row_heading level0 row15\" >T1069.001-Local_Groups</th>\n",
|
||
" <td id=\"T_67af1_row15_col0\" class=\"data row15 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row15_col1\" class=\"data row15 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row15_col2\" class=\"data row15 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row15_col3\" class=\"data row15 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row15_col4\" class=\"data row15 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row15_col5\" class=\"data row15 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row16\" class=\"row_heading level0 row16\" >T1059.005-Visual_Basic</th>\n",
|
||
" <td id=\"T_67af1_row16_col0\" class=\"data row16 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row16_col1\" class=\"data row16 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row16_col2\" class=\"data row16 col2\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row16_col3\" class=\"data row16 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row16_col4\" class=\"data row16 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row16_col5\" class=\"data row16 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row17\" class=\"row_heading level0 row17\" >T1021.001-Remote_Desktop_Protocol</th>\n",
|
||
" <td id=\"T_67af1_row17_col0\" class=\"data row17 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row17_col1\" class=\"data row17 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row17_col2\" class=\"data row17 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row17_col3\" class=\"data row17 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row17_col4\" class=\"data row17 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row17_col5\" class=\"data row17 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row18\" class=\"row_heading level0 row18\" >T1531-Account_Access_Removal</th>\n",
|
||
" <td id=\"T_67af1_row18_col0\" class=\"data row18 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row18_col1\" class=\"data row18 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row18_col2\" class=\"data row18 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row18_col3\" class=\"data row18 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row18_col4\" class=\"data row18 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row18_col5\" class=\"data row18 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row19\" class=\"row_heading level0 row19\" >T1036.003-Rename_System_Utilities</th>\n",
|
||
" <td id=\"T_67af1_row19_col0\" class=\"data row19 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row19_col1\" class=\"data row19 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row19_col2\" class=\"data row19 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row19_col3\" class=\"data row19 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row19_col4\" class=\"data row19 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row19_col5\" class=\"data row19 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row20\" class=\"row_heading level0 row20\" >T1489-Service_Stop</th>\n",
|
||
" <td id=\"T_67af1_row20_col0\" class=\"data row20 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row20_col1\" class=\"data row20 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row20_col2\" class=\"data row20 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row20_col3\" class=\"data row20 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row20_col4\" class=\"data row20 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row20_col5\" class=\"data row20 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row21\" class=\"row_heading level0 row21\" >T1222-File_and_Directory_Permissions_Modification <sub>(2)</sub></th>\n",
|
||
" <td id=\"T_67af1_row21_col0\" class=\"data row21 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row21_col1\" class=\"data row21 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row21_col2\" class=\"data row21 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row21_col3\" class=\"data row21 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row21_col4\" class=\"data row21 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row21_col5\" class=\"data row21 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row22\" class=\"row_heading level0 row22\" >T1562.004-Disable_or_Modify_System_Firewall</th>\n",
|
||
" <td id=\"T_67af1_row22_col0\" class=\"data row22 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row22_col1\" class=\"data row22 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row22_col2\" class=\"data row22 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row22_col3\" class=\"data row22 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row22_col4\" class=\"data row22 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row22_col5\" class=\"data row22 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row23\" class=\"row_heading level0 row23\" >T1047-Windows_Management_Instrumentation</th>\n",
|
||
" <td id=\"T_67af1_row23_col0\" class=\"data row23 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row23_col1\" class=\"data row23 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row23_col2\" class=\"data row23 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row23_col3\" class=\"data row23 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row23_col4\" class=\"data row23 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row23_col5\" class=\"data row23 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row24\" class=\"row_heading level0 row24\" >T1574.002-DLL_Side-Loading</th>\n",
|
||
" <td id=\"T_67af1_row24_col0\" class=\"data row24 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row24_col1\" class=\"data row24 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row24_col2\" class=\"data row24 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row24_col3\" class=\"data row24 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row24_col4\" class=\"data row24 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row24_col5\" class=\"data row24 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row25\" class=\"row_heading level0 row25\" >T1574-Hijack_Execution_Flow <sub>(12)</sub></th>\n",
|
||
" <td id=\"T_67af1_row25_col0\" class=\"data row25 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row25_col1\" class=\"data row25 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row25_col2\" class=\"data row25 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row25_col3\" class=\"data row25 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row25_col4\" class=\"data row25 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row25_col5\" class=\"data row25 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row26\" class=\"row_heading level0 row26\" >T1113-Screen_Capture</th>\n",
|
||
" <td id=\"T_67af1_row26_col0\" class=\"data row26 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row26_col1\" class=\"data row26 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row26_col2\" class=\"data row26 col2\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row26_col3\" class=\"data row26 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row26_col4\" class=\"data row26 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row26_col5\" class=\"data row26 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row27\" class=\"row_heading level0 row27\" >T1016-System_Network_Configuration_Discovery <sub>(1)</sub></th>\n",
|
||
" <td id=\"T_67af1_row27_col0\" class=\"data row27 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row27_col1\" class=\"data row27 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row27_col2\" class=\"data row27 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row27_col3\" class=\"data row27 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row27_col4\" class=\"data row27 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row27_col5\" class=\"data row27 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row28\" class=\"row_heading level0 row28\" >T1033-System_Owner/User_Discovery</th>\n",
|
||
" <td id=\"T_67af1_row28_col0\" class=\"data row28 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row28_col1\" class=\"data row28 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row28_col2\" class=\"data row28 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row28_col3\" class=\"data row28 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row28_col4\" class=\"data row28 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row28_col5\" class=\"data row28 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row29\" class=\"row_heading level0 row29\" >T1218.005-Mshta</th>\n",
|
||
" <td id=\"T_67af1_row29_col0\" class=\"data row29 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row29_col1\" class=\"data row29 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row29_col2\" class=\"data row29 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row29_col3\" class=\"data row29 col3\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row29_col4\" class=\"data row29 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row29_col5\" class=\"data row29 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row30\" class=\"row_heading level0 row30\" >T1014-Rootkit</th>\n",
|
||
" <td id=\"T_67af1_row30_col0\" class=\"data row30 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row30_col1\" class=\"data row30 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row30_col2\" class=\"data row30 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row30_col3\" class=\"data row30 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row30_col4\" class=\"data row30 col4\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row30_col5\" class=\"data row30 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row31\" class=\"row_heading level0 row31\" >T1068-Exploitation_for_Privilege_Escalation</th>\n",
|
||
" <td id=\"T_67af1_row31_col0\" class=\"data row31 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row31_col1\" class=\"data row31 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row31_col2\" class=\"data row31 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row31_col3\" class=\"data row31 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row31_col4\" class=\"data row31 col4\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row31_col5\" class=\"data row31 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row32\" class=\"row_heading level0 row32\" >T1219-Remote_Access_Software</th>\n",
|
||
" <td id=\"T_67af1_row32_col0\" class=\"data row32 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row32_col1\" class=\"data row32 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row32_col2\" class=\"data row32 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row32_col3\" class=\"data row32 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row32_col4\" class=\"data row32 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row32_col5\" class=\"data row32 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row33\" class=\"row_heading level0 row33\" >T1055.002-Portable_Executable_Injection</th>\n",
|
||
" <td id=\"T_67af1_row33_col0\" class=\"data row33 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row33_col1\" class=\"data row33 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row33_col2\" class=\"data row33 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row33_col3\" class=\"data row33 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row33_col4\" class=\"data row33 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row33_col5\" class=\"data row33 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row34\" class=\"row_heading level0 row34\" >T1136.001-Local_Account</th>\n",
|
||
" <td id=\"T_67af1_row34_col0\" class=\"data row34 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row34_col1\" class=\"data row34 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row34_col2\" class=\"data row34 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row34_col3\" class=\"data row34 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row34_col4\" class=\"data row34 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row34_col5\" class=\"data row34 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row35\" class=\"row_heading level0 row35\" >T1136-Create_Account <sub>(3)</sub></th>\n",
|
||
" <td id=\"T_67af1_row35_col0\" class=\"data row35 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row35_col1\" class=\"data row35 col1\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row35_col2\" class=\"data row35 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row35_col3\" class=\"data row35 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row35_col4\" class=\"data row35 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row35_col5\" class=\"data row35 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row36\" class=\"row_heading level0 row36\" >T1070-Indicator_Removal <sub>(9)</sub></th>\n",
|
||
" <td id=\"T_67af1_row36_col0\" class=\"data row36 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row36_col1\" class=\"data row36 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row36_col2\" class=\"data row36 col2\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row36_col3\" class=\"data row36 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row36_col4\" class=\"data row36 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row36_col5\" class=\"data row36 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row37\" class=\"row_heading level0 row37\" >T1071.003-Mail_Protocols</th>\n",
|
||
" <td id=\"T_67af1_row37_col0\" class=\"data row37 col0\" >no</td>\n",
|
||
" <td id=\"T_67af1_row37_col1\" class=\"data row37 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row37_col2\" class=\"data row37 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row37_col3\" class=\"data row37 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row37_col4\" class=\"data row37 col4\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row37_col5\" class=\"data row37 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" <tr>\n",
|
||
" <th id=\"T_67af1_level0_row38\" class=\"row_heading level0 row38\" >T1016.001-Internet_Connection_Discovery</th>\n",
|
||
" <td id=\"T_67af1_row38_col0\" class=\"data row38 col0\" >yes</td>\n",
|
||
" <td id=\"T_67af1_row38_col1\" class=\"data row38 col1\" >no</td>\n",
|
||
" <td id=\"T_67af1_row38_col2\" class=\"data row38 col2\" >no</td>\n",
|
||
" <td id=\"T_67af1_row38_col3\" class=\"data row38 col3\" >no</td>\n",
|
||
" <td id=\"T_67af1_row38_col4\" class=\"data row38 col4\" >no</td>\n",
|
||
" <td id=\"T_67af1_row38_col5\" class=\"data row38 col5\" >1</td>\n",
|
||
" </tr>\n",
|
||
" </tbody>\n",
|
||
"</table>\n"
|
||
],
|
||
"text/plain": [
|
||
"<pandas.io.formats.style.Styler at 0x12c2807f0>"
|
||
]
|
||
},
|
||
"execution_count": 52,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"rslt_df = tdf[tdf['total_coverage'] == 1]\n",
|
||
"print(rslt_df.shape)\n",
|
||
"rslt_df.style.apply(highlight_rows, axis=1)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": null,
|
||
"id": "62821d46-d7a2-4964-9401-47189fb4b510",
|
||
"metadata": {},
|
||
"outputs": [],
|
||
"source": []
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": null,
|
||
"id": "848faf4c-1939-4b32-ab7d-9821d5bf2ed0",
|
||
"metadata": {},
|
||
"outputs": [],
|
||
"source": []
|
||
}
|
||
],
|
||
"metadata": {
|
||
"kernelspec": {
|
||
"display_name": "Python 3 (ipykernel)",
|
||
"language": "python",
|
||
"name": "python3"
|
||
},
|
||
"language_info": {
|
||
"codemirror_mode": {
|
||
"name": "ipython",
|
||
"version": 3
|
||
},
|
||
"file_extension": ".py",
|
||
"mimetype": "text/x-python",
|
||
"name": "python",
|
||
"nbconvert_exporter": "python",
|
||
"pygments_lexer": "ipython3",
|
||
"version": "3.9.15"
|
||
}
|
||
},
|
||
"nbformat": 4,
|
||
"nbformat_minor": 5
|
||
}
|