splunk-security_content/security_content_automation/detection_ta_mapping.yml

abnormally_high_number_of_cloud_infrastructure_api_calls:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_juniper
  - Splunk_TA_ossec
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_nix
  - Splunk_TA_cyberark
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_rsa-securid
  - Splunk_TA_cisco-asa
  - Splunk_TA_aws-kinesis-firehose
  - Splunk_TA_infoblox
abnormally_high_number_of_cloud_security_group_api_calls:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_juniper
  - Splunk_TA_ossec
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_nix
  - Splunk_TA_cyberark
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_rsa-securid
  - Splunk_TA_cisco-asa
  - Splunk_TA_aws-kinesis-firehose
  - Splunk_TA_infoblox
account_discovery_with_net_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
active_setup_registry_autostart:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
add_defaultuser_and_password_in_registry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
add_or_set_windows_defender_exclusion:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
allow_file_and_printing_sharing_in_firewall:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
allow_network_discovery_in_firewall:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
allow_operation_with_consent_admin:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
anomalous_usage_of_7zip:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
any_powershell_downloadfile:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
any_powershell_downloadstring:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
attacker_tools_on_endpoint:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
attempt_to_add_certificate_to_untrusted_store:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
attempt_to_stop_security_service:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
attempted_credential_dump_from_registry_via_reg_exe:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
auto_admin_logon_registry_entry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
batch_file_write_to_system32:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
bcdedit_command_back_to_normal_mode_boot:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
bcdedit_failure_recovery_modification:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
bits_job_persistence:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
bitsadmin_download_file:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
certutil_download_with_urlcache_and_split_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
certutil_download_with_verifyctl_and_split_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
certutil_exe_certificate_extraction:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
certutil_with_decode_argument:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
change_default_file_association:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
change_to_safe_mode_with_network_config:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
check_elevated_cmd_using_whoami:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
clear_unallocated_sector_using_cipher_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
clop_common_exec_parameter:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
cloud_api_calls_from_previously_unseen_user_roles:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_aws-kinesis-firehose
  - Splunk_TA_infoblox
cloud_compute_instance_created_by_previously_unseen_user:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_aws-kinesis-firehose
cloud_compute_instance_created_in_previously_unused_region:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_aws-kinesis-firehose
cloud_instance_modified_with_previously_unseen_user:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_juniper
  - Splunk_TA_ossec
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_nix
  - Splunk_TA_cyberark
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_rsa-securid
  - Splunk_TA_aws-kinesis-firehose
cloud_provisioning_from_previously_unseen_city:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_juniper
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cyberark
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_rsa-securid
  - Splunk_TA_cisco-asa
  - Splunk_TA_aws-kinesis-firehose
  - Splunk_TA_infoblox
cloud_provisioning_from_previously_unseen_country:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_juniper
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cyberark
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_rsa-securid
  - Splunk_TA_cisco-asa
  - Splunk_TA_aws-kinesis-firehose
  - Splunk_TA_infoblox
cloud_provisioning_from_previously_unseen_ip_address:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_juniper
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cyberark
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_rsa-securid
  - Splunk_TA_aws-kinesis-firehose
cloud_provisioning_from_previously_unseen_region:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_aws-kinesis-firehose
  tas_with_cim_mapping:
  - Splunk_TA_juniper
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cyberark
  - Splunk_TA_salesforce
  - Splunk_TA_rsa_securid_cas
  - Splunk_TA_box
  - splunk_ta_o365
  - Splunk_TA_rsa-securid
  - Splunk_TA_cisco-asa
  - Splunk_TA_aws-kinesis-firehose
  - Splunk_TA_infoblox
cmd_echo_pipe___escalation:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
cmdline_tool_not_executed_in_cmd_shell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
conti_common_exec_parameter:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
control_loading_from_world_writable_directory:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
create_local_admin_accounts_using_net_exe:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
create_or_delete_windows_shares_using_net_exe:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
creation_of_shadow_copy:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
creation_of_shadow_copy_with_wmic_and_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
credential_dumping_via_copy_command_from_shadow_copy:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
credential_dumping_via_symlink_to_shadow_copy:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
curl_download_and_bash_execution:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
deleting_of_net_users:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
deleting_shadow_copies:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_azurehound_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_exchange_web_shell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
detect_html_help_spawn_child_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_html_help_url_in_command_line:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_html_help_using_infotech_storage_handlers:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_mshta_inline_hta_execution:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_mshta_url_in_command_line:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_path_interception_by_creation_of_program_exe:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_processes_used_for_system_network_configuration_discovery:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_psexec_with_accepteula_flag:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_rclone_command_line_usage:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_regasm_spawning_a_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
detect_regasm_with_no_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_regsvcs_spawning_a_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
detect_regsvcs_with_no_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_regsvr32_application_control_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_rundll32_application_control_bypass___advpack:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_rundll32_application_control_bypass___setupapi:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_rundll32_application_control_bypass___syssetup:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_rundll32_inline_hta_execution:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_sharphound_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
detect_sharphound_usage:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
detect_use_of_cmd_exe_to_launch_script_interpreters:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
disable_amsi_through_registry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disable_etw_through_registry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disable_logs_using_wevtutil:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
disable_registry_tool:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disable_schedule_task:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
disable_windows_app_hotkeys:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
disable_windows_behavior_monitoring:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disabling_cmd_application:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disabling_controlpanel:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disabling_firewall_with_netsh:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
disabling_folderoptions_windows_feature:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disabling_net_user_account:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
disabling_norun_windows_app:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disabling_remote_user_account_control:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disabling_systemrestore_in_registry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
disabling_task_manager:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
dns_exfiltration_using_nslookup_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
dns_query_length_with_high_standard_deviation:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_isc-bind
  - Splunk_TA_CrowdStrike_FDR
  - Splunk_TA_infoblox
domain_account_discovery_with_net_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
domain_account_discovery_with_wmic:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
domain_controller_discovery_with_nltest:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
dsquery_domain_discovery:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
dump_lsass_via_comsvcs_dll:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
dump_lsass_via_procdump:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
elevated_group_discovery_with_net:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
elevated_group_discovery_with_wmic:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
enable_rdp_in_other_port_number:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
eventvwr_uac_bypass:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
excel_spawning_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
excessive_attempt_to_disable_services:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
excessive_distinct_processes_from_windows_temp:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_windows
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_cyberark_epm
  - Splunk_TA_CrowdStrike_FDR
excessive_number_of_service_control_start_as_disabled:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
excessive_number_of_taskhost_processes:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_windows
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
excessive_service_stop_attempt:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
excessive_usage_of_cacls_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
excessive_usage_of_net_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
excessive_usage_of_taskkill:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
executables_or_script_creation_in_suspicious_path:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
execute_javascript_with_jscript_com_clsid:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
execution_of_file_with_multiple_extensions:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
extraction_of_registry_hives:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_squid
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cisco-wsa
  - Splunk_TA_mcafee-wg
  - Splunk_TA_haproxy
  - Splunk_TA_websense-cg
  - Splunk_TA_microsoft-iis
  - Splunk_TA_nginx
file_with_samsam_extension:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_cyberark
  - Splunk_TA_sophos
  - Splunk_TA_windows
  - splunk_ta_o365
  - Splunk_TA_CrowdStrike_FDR
firewall_allowed_program_enable:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
fodhelper_uac_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
fsutil_zeroing_file:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
get_aduserresultantpasswordpolicy_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
get_domainpolicy_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
get_domaintrust_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
get_domainuser_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
get_foresttrust_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
getdomaincomputer_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
getdomaingroup_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
getwmiobject_ds_computer_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
getwmiobject_ds_group_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
getwmiobject_ds_user_with_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
hide_user_account_from_sign_in_screen:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
hiding_files_and_directories_with_attrib_exe:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
icacls_deny_command:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
icacls_grant_command:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
impacket_lateral_movement_commandline_parameters:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
java_class_file_download_by_java_user_agent:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_squid
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cisco-wsa
  - Splunk_TA_mcafee-wg
  - Splunk_TA_haproxy
  - Splunk_TA_websense-cg
  - Splunk_TA_microsoft-iis
  - Splunk_TA_nginx
jscript_execution_using_cscript_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
linux_account_manipulation_of_ssh_config_and_keys:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_add_files_in_known_crontab_directories:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_at_allow_config_file_creation:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_at_application_execution:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_change_file_owner_to_root:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_clipboard_data_copy:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_dd_file_overwrite:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_decode_base64_to_shell:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_deleting_critical_directory_using_rm_command:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_deletion_of_cron_jobs:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_deletion_of_init_daemon_script:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_deletion_of_services:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_deletion_of_ssl_certificate:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_disable_services:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_doas_conf_file_creation:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_doas_tool_execution:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_file_created_in_kernel_driver_directory:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_file_creation_in_init_boot_directory:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_file_creation_in_profile_directory:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_high_frequency_of_file_deletion_in_boot_folder:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_high_frequency_of_file_deletion_in_etc_folder:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_insert_kernel_module_using_insmod_utility:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_install_kernel_module_using_modprobe_utility:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_iptables_firewall_modification:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_java_spawning_shell:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_kernel_module_enumeration:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_nopasswd_entry_in_sudoers_file:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_obfuscated_files_or_information_base64_decode:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_pkexec_privilege_escalation:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_possible_access_or_modification_of_sshd_config_file:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_possible_access_to_credential_files:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_possible_access_to_sudoers_file:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_possible_append_command_to_at_allow_config_file:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_possible_append_command_to_profile_config_file:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_possible_ssh_key_file_creation:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_preload_hijack_library_calls:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_service_file_created_in_systemd_directory:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_service_restarted:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_service_started_or_enabled:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_setuid_using_chmod_utility:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_setuid_using_setcap_utility:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_shred_overwrite_command:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_ssh_authorized_keys_modification:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_ssh_remote_services_script_execute:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
linux_stop_services:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_sudoers_tmp_file_creation:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
linux_system_network_discovery:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
linux_visudo_utility_execution:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
log4shell_jndi_payload_injection_attempt:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_nginx
  tas_with_cim_mapping:
  - Splunk_TA_nginx
logon_script_event_trigger_execution:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
malicious_powershell_process___execution_policy_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
malicious_powershell_process_with_obfuscation_techniques:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
mimikatz_passtheticket_commandline_parameters:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
mmc_exe_lolbas_execution_process_spawn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
modify_acl_permission_to_files_or_folder:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
monitor_registry_keys_for_print_monitors:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
msbuild_suspicious_spawned_by_script_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
mshta_spawning_rundll32_or_regsvr32_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
msmpeng_application_dll_side_loading:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
net_profiler_uac_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
nishang_powershelltcponeline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
nltest_domain_trust_discovery:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
ntdsutil_export_ntds:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
office_application_spawn_regsvr32_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_application_spawn_rundll32_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_document_spawned_child_process_to_download:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_product_spawn_cmd_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_product_spawning_bitsadmin:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_product_spawning_certutil:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_product_spawning_mshta:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_product_spawning_rundll32_with_no_dll:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_product_spawning_wmic:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
office_spawning_control:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
overwriting_accessibility_binaries:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_ossec
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_cyberark
  - Splunk_TA_sophos
  - Splunk_TA_windows
  - splunk_ta_o365
  - Splunk_TA_CrowdStrike_FDR
permission_modification_using_takeown_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
ping_sleep_batch_command:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
possible_lateral_movement_powershell_spawn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
potentially_malicious_code_on_commandline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
powershell_disable_security_monitoring:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
powershell_start_bitstransfer:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
prevent_automatic_repair_mode_using_bcdedit:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
print_processor_registry_autostart:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
process_creating_lnk_file_in_suspicious_location:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
process_execution_via_wmi:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
process_kill_base_on_file_path:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
processes_launching_netsh:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
recursive_delete_of_directory_in_batch_cmd:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
reg_exe_manipulating_windows_services_registry_keys:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
registry_keys_for_creating_shim_databases:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
registry_keys_used_for_persistence:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
registry_keys_used_for_privilege_escalation:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
regsvr32_silent_and_install_param_dll_loading:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
regsvr32_with_known_silent_switch_cmdline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
remote_process_instantiation_via_dcom_and_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
remote_process_instantiation_via_winrm_and_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
remote_process_instantiation_via_winrm_and_winrs:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
remote_process_instantiation_via_wmi:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
remote_process_instantiation_via_wmi_and_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
remote_system_discovery_with_wmic:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
remote_wmi_command_attempt:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
resize_shadowstorage_volume:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
revil_common_exec_parameter:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
revil_registry_entry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
rubeus_command_line_parameters:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
rundll32_control_rundll_world_writable_directory:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
rundll32_lockworkstation:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
rundll32_shimcache_flush:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
rundll32_with_no_command_line_arguments_with_network:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
rundll_loading_dll_by_ordinal:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
ryuk_test_files_detected:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_cyberark
  - Splunk_TA_sophos
  - Splunk_TA_windows
  - splunk_ta_o365
  - Splunk_TA_CrowdStrike_FDR
ryuk_wake_on_lan_command:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
samsam_test_file_write:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_cyberark
  - Splunk_TA_sophos
  - Splunk_TA_windows
  - splunk_ta_o365
  - Splunk_TA_CrowdStrike_FDR
sc_exe_manipulating_windows_services:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
scheduled_task_creation_on_remote_endpoint_using_at:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
scheduled_task_deleted_or_created_via_cmd:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
scheduled_task_initiation_on_remote_endpoint:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
schtasks_run_task_on_demand:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
schtasks_scheduling_job_on_remote_system:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
schtasks_used_for_forcing_a_reboot:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
screensaver_event_trigger_execution:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
script_execution_via_wmi:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_cyberark_epm
  - Splunk_TA_CrowdStrike_FDR
sdclt_uac_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
sdelete_application_execution:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
secretdumps_offline_ntds_dumping_tool:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
serviceprincipalnames_discovery_with_setspn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
services_escalate_exe:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
services_exe_lolbas_execution_process_spawn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
set_default_powershell_execution_policy_to_unrestricted_or_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
shim_database_file_creation:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_ossec
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
shim_database_installation_with_suspicious_parameters:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
short_lived_windows_accounts:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_cyberark
  - Splunk_TA_microsoft-cloudservices
  - Splunk_TA_rsa-securid
  - Splunk_TA_aws-kinesis-firehose
silentcleanup_uac_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
single_letter_process_on_endpoint:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_cyberark_epm
  - Splunk_TA_CrowdStrike_FDR
slui_runas_elevated:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
slui_spawning_a_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
spoolsv_spawning_rundll32:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
spoolsv_writing_a_dll:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
spring4shell_payload_url_request:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_nginx
  tas_with_cim_mapping:
  - Splunk_TA_squid
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cisco-wsa
  - Splunk_TA_mcafee-wg
  - Splunk_TA_haproxy
  - Splunk_TA_websense-cg
  - Splunk_TA_microsoft-iis
  - Splunk_TA_nginx
suspicious_copy_on_system32:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_dllhost_no_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_gpupdate_no_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_icedid_rundll32_cmdline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_linux_discovery_commands:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
suspicious_microsoft_workflow_compiler_usage:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_msbuild_path:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_msbuild_spawn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_mshta_child_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
suspicious_mshta_spawn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_process_file_path:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
suspicious_reg_exe_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
suspicious_regsvr32_register_suspicious_path:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_rundll32_dllregisterserver:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_rundll32_plugininit:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_rundll32_startw:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_rundll32_with_no_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_scheduled_task_from_public_directory:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
suspicious_searchprotocolhost_no_command_line_arguments:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
suspicious_wevtutil_usage:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
suspicious_writes_to_windows_recycle_bin:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
svchost_exe_lolbas_execution_process_spawn:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
system_information_discovery_detection:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_cyberark_epm
  - Splunk_TA_CrowdStrike_FDR
system_processes_run_from_unexpected_locations:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_CrowdStrike_FDR
time_provider_persistence_registry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
unified_messaging_service_spawning_a_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
uninstall_app_using_msiexec:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
unload_sysmon_filter_driver:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
usn_journal_deletion:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
vbscript_execution_using_wscript_app:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
vmware_workspace_one_freemarker_server_side_template_injection:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_squid
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cisco-wsa
  - Splunk_TA_mcafee-wg
  - Splunk_TA_haproxy
  - Splunk_TA_websense-cg
  - Splunk_TA_microsoft-iis
  - Splunk_TA_nginx
w3wp_spawning_shell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
wbadmin_delete_system_backups:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_CrowdStrike_FDR
web_jsp_request_via_url:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_nginx
  tas_with_cim_mapping:
  - Splunk_TA_squid
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cisco-wsa
  - Splunk_TA_mcafee-wg
  - Splunk_TA_haproxy
  - Splunk_TA_websense-cg
  - Splunk_TA_microsoft-iis
  - Splunk_TA_nginx
web_spring_cloud_function_functionrouter:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_squid
  - Splunk_TA_citrix-netscaler
  - Splunk_TA_cisco-wsa
  - Splunk_TA_mcafee-wg
  - Splunk_TA_haproxy
  - Splunk_TA_websense-cg
  - Splunk_TA_microsoft-iis
  - Splunk_TA_nginx
wermgr_process_spawned_cmd_or_powershell_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
wget_download_and_bash_execution:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
windows_adfind_exe:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
windows_binary_proxy_execution_mavinject_dll_injection:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_command_and_scripting_interpreter_path_traversal_exec:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_command_shell_dcrat_forkbomb_payload:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_curl_download_to_suspicious_path:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_curl_upload_to_remote_destination:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_deleted_registry_by_a_non_critical_process_file_path:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_disable_change_password_through_registry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_disable_lock_workstation_feature_through_registry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_disable_logoff_button_through_registry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_disable_memory_crash_dump:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_disable_shutdown_button_through_registry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_disable_windows_group_policy_features_through_registry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_disableantispyware_reg:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_dism_remove_defender:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_dotnet_binary_in_non_standard_path:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_execute_arbitrary_commands_with_msdt:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_file_without_extension_in_critical_folder:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_hide_notification_features_through_registry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_impair_defense_delete_win_defender_profile_registry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_impair_defense_deny_security_software_with_applocker:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_impair_defenses_disable_win_defender_auto_logging:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_indirect_command_execution_via_forfiles:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
windows_indirect_command_execution_via_pcalua:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
windows_installutil_credential_theft:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_installutil_in_non_standard_path:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_installutil_uninstall_option:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_installutil_url_in_command_line:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_modify_registry_disable_toast_notifications:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_modify_registry_disable_win_defender_raw_write_notif:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_modify_registry_disable_windows_security_center_notif:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_modify_registry_disabling_wer_settings:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_modify_registry_disallow_windows_app:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_modify_registry_regedit_silent_reg_import:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_modify_registry_suppress_win_defender_notif:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_modify_show_compress_color_and_info_tip_registry:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_mof_event_triggered_execution_via_wmi:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_msiexec_dllregisterserver:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_msiexec_remote_download:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_msiexec_spawn_discovery_command:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_msiexec_unregister_dllregisterserver:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_nirsoft_advancedrun:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_odbcconf_load_dll:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_odbcconf_load_response_file:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_office_product_spawning_msdt:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_process_with_namedpipe_commandline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_processes_killed_by_industroyer2_malware:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_raccine_scheduled_task_deletion:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_rasautou_dll_execution:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_registry_certificate_added:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_registry_delete_task_sd:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_registry_modification_for_safe_mode_persistence:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
windows_remote_access_software_rms_registry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_remote_assistance_spawning_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_remote_service_rdpwinst_tool_execution:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_remote_services_allow_rdp_in_firewall:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
windows_remote_services_allow_remote_assistance:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_remote_services_rdp_enable:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_schtasks_create_run_as_system:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_security_account_manager_stopped:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_nix
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
  - Splunk_TA_cyberark_epm
  - Splunk_TA_CrowdStrike_FDR
windows_service_create_kernel_mode_driver:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_service_creation_on_remote_endpoint:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_service_creation_using_registry_entry:
  cim_version: 5.0.1
  tas_with_cim_mapping:
  - Splunk_TA_bit9-carbonblack
windows_service_initiation_on_remote_endpoint:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_service_stop_by_deletion:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows
windows_system_logoff_commandline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_system_reboot_commandline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_system_shutdown_commandline:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_system_time_discovery_w32tm_delay:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
windows_valid_account_with_never_expires_password:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
winhlp32_spawning_a_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
winword_spawning_cmd:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
winword_spawning_powershell:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
wmic_xsl_execution_via_url:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
wmiprsve_exe_lolbas_execution_process_spawn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
wscript_or_cscript_suspicious_child_process:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
wsmprovhost_exe_lolbas_execution_process_spawn:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
wsreset_uac_bypass:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
xsl_script_execution_with_wmic:
  cim_version: 5.0.1
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  tas_with_cim_mapping:
  - Splunk_TA_microsoft_sysmon
  - Splunk_TA_bit9-carbonblack
  - Splunk_TA_windows