splunk-security_content/docs/mitre-map/detections.csv

1	Technique ID	Detection Available	Link	score
2	T1193	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	49
3	T1193	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
4	T1566.001	No	-	51
5	T1204.002	No	-	50
6	T1027	No	-	48
7	T1059.001	No	-	44
8	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	38
9	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	38
10	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	38
11	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	38
12	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	38
13	T1086	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	38
14	T1059.003	No	-	41
15	T1105	No	-	40
16	T1060	No	-	38
17	T1547.001	No	-	38
18	T1071.001	No	-	34
19	T1070.004	No	-	30
20	T1107	No	-	30
21	T1053.005	No	-	28
22	T1003.001	No	-	27
23	T1059.005	No	-	26
24	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	23
25	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	23
26	T1192	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	23
27	T1566.002	No	-	24
28	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	2
29	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	2
30	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	2
31	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	2
32	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	2
33	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	2
34	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	2
35	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	2
36	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	2
37	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	2
38	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	2
39	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	2
40	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	2
41	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	2
42	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	2
43	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	2
44	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
45	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	2
46	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	2
47	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	2
48	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
49	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	2
50	T1083	No	-	23
51	T1203	No	-	23
52	T1005	No	-	22
53	T1057	No	-	22
54	T1016	No	-	22
55	T1076	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	18
56	T1076	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	18
57	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	19
58	T1056.001	No	-	20
59	T1140	No	-	19
60	T1018	No	-	19
61	T1204.001	No	-	19
62	T1036.005	No	-	19
63	T1033	No	-	18
64	T1189	No	-	17
65	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	10
66	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	10
67	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	10
68	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	10
69	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	10
70	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	10
71	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	10
72	T1560.001	No	-	16
73	T1543.003	No	-	16
74	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	2
75	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
76	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
77	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
78	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
79	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	2
80	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	2
81	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	2
82	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	2
83	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	2
84	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
85	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	2
86	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
87	T1043	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	2
88	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	13
89	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	13
90	T1555.003	No	-	15
91	T1503	No	-	15
92	T1049	No	-	14
93	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	13
94	T1087.001	No	-	14
95	T1116	No	-	14
96	T1074.001	No	-	14
97	T1553.002	No	-	14
98	T1046	No	-	13
99	T1027.002	No	-	12
100	T1113	No	-	12
101	T1041	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	11
102	T1045	No	-	12
103	T1021.002	No	-	11
104	T1574.002	No	-	11
105	T1085	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	10
106	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	3
107	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	3
108	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	3
109	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
110	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	3
111	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	3
112	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	3
113	T1059	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	3
114	T1073	No	-	11
115	T1218.011	No	-	11
116	T1133	No	-	11
117	T1518.001	No	-	11
118	T1063	No	-	11
119	T1571	No	-	11
120	T1100	No	-	10
121	T1505.003	No	-	10
122	T1087.002	No	-	10
123	T1055	No	-	10
124	T1136.002	No	-	10
125	T1119	No	-	9
126	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	7
127	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	7
128	T1562.001	No	-	9
129	T1560	No	-	9
130	T1173	No	-	9
131	T1564.003	No	-	9
132	T1559.002	No	-	9
133	T1090.002	No	-	9
134	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	-3
135	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	-3
136	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	-3
137	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	-3
138	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	-3
139	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	-3
140	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	-3
141	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	-3
142	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	-3
143	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	-3
144	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	-3
145	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	-3
146	T1143	No	-	9
147	T1218.010	No	-	8
148	T1548.002	No	-	8
149	T1065	No	-	8
150	T1219	No	-	8
151	T1190	No	-	8
152	T1071.004	No	-	8
153	T1035	No	-	8
154	T1569.002	No	-	8
155	T1135	No	-	8
156	T1117	No	-	8
157	T1132.001	No	-	8
158	T1003.004	No	-	8
159	T1102.002	No	-	8
160	T1552.001	No	-	7
161	T1547.009	No	-	7
162	T1023	No	-	7
163	T1021.004	No	-	7
164	T1221	No	-	7
165	T1070.001	No	-	7
166	T1555	No	-	7
167	T1027.005	No	-	7
168	T1106	No	-	7
169	T1012	No	-	7
170	T1007	No	-	7
171	T1573.001	No	-	7
172	T1066	No	-	7
173	T1059.007	No	-	7
174	T1069.002	No	-	7
175	T1114.002	No	-	6
176	T1048.003	No	-	6
177	T1009	No	-	6
178	T1036.004	No	-	6
179	T1003.002	No	-	6
180	T1027.001	No	-	6
181	T1158	No	-	5
182	T1059.006	No	-	5
183	T1120	No	-	5
184	T1102.001	No	-	5
185	T1546.003	No	-	5
186	T1223	No	-	5
187	T1015	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	2
188	T1015	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	2
189	T1015	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	2
190	T1573.002	No	-	5
191	T1562.004	No	-	5
192	T1099	No	-	5
193	T1218.005	No	-	5
194	T1170	No	-	5
195	T1074.002	No	-	5
196	T1040	No	-	5
197	T1546.008	No	-	5
198	T1075	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	4
199	T1001.002	No	-	5
200	T1564.001	No	-	5
201	T1090	No	-	5
202	T1566.003	No	-	5
203	T1070.006	No	-	5
204	T1027.003	No	-	5
205	T1218.001	No	-	5
206	T1055.001	No	-	5
207	T1194	No	-	5
208	T1084	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	2
209	T1084	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	2
210	T1084	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	2
211	T1550.002	No	-	5
212	T1110	No	-	5
213	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	4
214	T1078.003	No	-	4
215	T1036.002	No	-	4
216	T1560.003	No	-	4
217	T1094	No	-	4
218	T1025	No	-	4
219	T1038	No	-	4
220	T1561.002	No	-	4
221	T1496	No	-	4
222	T1124	No	-	4
223	T1093	No	-	4
224	T1003.005	No	-	4
225	T1071.002	No	-	4
226	T1574.001	No	-	4
227	T1014	No	-	4
228	T1487	No	-	4
229	T1055.012	No	-	4
230	T1570	No	-	4
231	T1102	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	3
232	T1036.003	No	-	4
233	T1020	No	-	3
234	T1572	No	-	3
235	T1518	No	-	3
236	T1053.002	No	-	3
237	T1104	No	-	3
238	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	2
239	T1542.003	No	-	3
240	T1069.001	No	-	3
241	T1486	No	-	3
242	T1500	No	-	3
243	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	2
244	T1071	No	-	3
245	T1090.003	No	-	3
246	T1098	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	2
247	T1078.002	No	-	3
248	T1091	No	-	3
249	T1550.003	No	-	3
250	T1097	No	-	3
251	T1110.003	No	-	3
252	T1071.003	No	-	3
253	T1485	No	-	3
254	T1027.004	No	-	3
255	T1008	No	-	3
256	T1067	No	-	3
257	T1039	No	-	3
258	T1197	No	-	3
259	T1110.002	No	-	3
260	T1529	No	-	3
261	T1188	No	-	3
262	T1003.003	No	-	2
263	T1201	No	-	2
264	T1564.005	No	-	2
265	T1199	No	-	2
266	T1069	No	-	2
267	T1542.002	No	-	2
268	T1090.001	No	-	2
269	T1547.004	No	-	2
270	T1218.003	No	-	2
271	T1059.004	No	-	2
272	T1559.001	No	-	2
273	T1567.002	No	-	2
274	T1125	No	-	2
275	T1004	No	-	2
276	T1115	No	-	2
277	T1565.001	No	-	2
278	T1080	No	-	2
279	T1218.007	No	-	2
280	T1213.002	No	-	2
281	T1195.002	No	-	2
282	T1210	No	-	2
283	T1087.003	No	-	2
284	T1055.002	No	-	2
285	T1222.002	No	-	2
286	T1492	No	-	2
287	T1032	No	-	2
288	T1176	No	-	2
289	T1187	No	-	2
290	T1109	No	-	2
291	T1137	No	-	2
292	T1134.002	No	-	2
293	T1480.001	No	-	2
294	T1037.001	No	-	2
295	T1191	No	-	2
296	T1560.002	No	-	2
297	T1114.001	No	-	2
298	T1568.001	No	-	1
299	T1213	No	-	1
300	T1037	No	-	1
301	T1146	No	-	1
302	T1504	No	-	1
303	T1134	No	-	1
304	T1546.011	No	-	1
305	T1036.001	No	-	1
306	T1546.009	No	-	1
307	T1501	No	-	1
308	T1552.004	No	-	1
309	T1183	No	-	1
310	T1200	No	-	1
311	T1552.006	No	-	1
312	T1211	No	-	1
313	T1070.005	No	-	1
314	T1052.001	No	-	1
315	T1056.004	No	-	1
316	T1001.003	No	-	1
317	T1001.001	No	-	1
318	T1497.001	No	-	1
319	T1552.002	No	-	1
320	T1102.003	No	-	1
321	T1218.008	No	-	1
322	T1042	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	-2
323	T1042	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	-2
324	T1042	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	-2
325	T1216.001	No	-	1
326	T1126	No	-	1
327	T1098.002	No	-	1
328	T1137.002	No	-	1
329	T1172	No	-	1
330	T1182	No	-	1
331	T1527	No	-	1
332	T1220	No	-	1
333	T1074	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	-1
334	T1074	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	-1
335	T1092	No	-	1
336	T1137.006	No	-	1
337	T1562.002	No	-	1
338	T1561.001	No	-	1
339	T1565.002	No	-	1
340	T1053.003	No	-	1
341	T1489	No	-	1
342	T1558.001	No	-	1
343	T1214	No	-	1
344	T1556.002	No	-	1
345	T1186	No	-	1
346	T1543.002	No	-	1
347	T1028	No	-	1
348	T1010	No	-	1
349	T1565.003	No	-	1
350	T1090.004	No	-	1
351	T1137.001	No	-	1
352	T1070.003	No	-	1
353	T1482	No	-	1
354	T1123	No	-	1
355	T1021.005	No	-	1
356	T1574.006	No	-	1
357	T1534	No	-	1
358	T1494	No	-	1
359	T1491.001	No	-	1
360	T1056.002	No	-	1
361	T1568.003	No	-	1
362	T1528	No	-	1
363	T1145	No	-	1
364	T1493	No	-	1
365	T1546.001	No	-	1
366	T1550.001	No	-	1
367	T1001	No	-	1
368	T1568.002	No	-	1
369	T1070.002	No	-	1
370	T1574.012	No	-	1
371	T1564.004	No	-	1
372	T1055.013	No	-	1
373	T1546.012	No	-	1
374	T1573	No	-	1
375	T1127.001	No	-	1
376	T1195	No	-	1
377	T1122	No	-	1
378	T1488	No	-	1
379	T1096	No	-	1
380	T1546.015	No	-	1
381	T1174	No	-	1
382	T1134.001	No	-	1
383	T1030	No	-	1
384	T1137.004	No	-	1
385	T1483	No	-	1
386	T1497.002	No	-	1
387	T1138	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	-2
388	T1138	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	-2
389	T1138	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	-2
390	T1546.013	No	-	1
391	T1026	No	-	1
392	T1021.006	No	-	1
393	T1078.004	No	-	1