splunk-security_content/docs/mitre-map/coverage.csv

1	Technique ID	Detection Available	Link	score
2	T1502	No	-	0
3	T1531	No	-	0
4	T1124	No	-	0
5	T1578.004	No	-	0
6	T1574.008	No	-	0
7	T1008	No	-	0
8	T1040	No	-	0
9	T1573	No	-	0
10	T1194	No	-	0
11	T1191	No	-	0
12	T1131	No	-	0
13	T1036.004	No	-	0
14	T1157	No	-	0
15	T1027.002	No	-	0
16	T1088	No	-	0
17	T1574.005	No	-	0
18	T1542.001	No	-	0
19	T1519	No	-	0
20	T1214	No	-	0
21	T1114.003	No	-	0
22	T1070.006	No	-	0
23	T1101	No	-	0
24	T1546.004	No	-	0
25	T1018	No	-	0
26	T1098	No	-	0
27	T1070.003	No	-	0
28	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
29	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
30	T1560.003	No	-	0
31	T1574.007	No	-	0
32	T1218.007	No	-	0
33	T1494	No	-	0
34	T1003.004	No	-	0
35	T1547.009	No	-	0
36	T1069.001	No	-	0
37	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
38	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
39	T1121	No	-	0
40	T1198	No	-	0
41	T1055.009	No	-	0
42	T1069.003	No	-	0
43	T1166	No	-	0
44	T1087.004	No	-	0
45	T1045	No	-	0
46	T1505.001	No	-	0
47	T1569.001	No	-	0
48	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
49	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
50	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
51	T1028	No	-	0
52	T1552.004	No	-	0
53	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
54	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
55	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
56	T1134.004	No	-	0
57	T1548	No	-	0
58	T1073	No	-	0
59	T1167	No	-	0
60	T1206	No	-	0
61	T1208	No	-	0
62	T1001	No	-	0
63	T1134.001	No	-	0
64	T1148	No	-	0
65	T1498.001	No	-	0
66	T1563.002	No	-	0
67	T1564	No	-	0
68	T1561.002	No	-	0
69	T1518.001	No	-	0
70	T1219	No	-	0
71	T1149	No	-	0
72	T1574.001	No	-	0
73	T1074.001	No	-	0
74	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
75	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
76	T1141	No	-	0
77	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	6
78	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	6
79	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	6
80	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	6
81	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	6
82	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	6
83	T1039	No	-	0
84	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
85	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
86	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
87	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
88	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
89	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
90	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
91	T1546.003	No	-	0
92	T1547	No	-	3
93	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml	8
94	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml	8
95	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
96	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml	8
97	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
98	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8
99	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
100	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml	8
101	T1568.002	No	-	0
102	T1193	No	-	0
103	T1548.001	No	-	0
104	T1107	No	-	0
105	T1553.002	No	-	0
106	T1505	No	-	0
107	T1480.001	No	-	0
108	T1161	No	-	0
109	T1568.003	No	-	0
110	T1013	No	-	0
111	T1556.002	No	-	0
112	T1021.004	No	-	0
113	T1027.003	No	-	0
114	T1056	No	-	0
115	T1547.003	No	-	0
116	T1094	No	-	0
117	T1162	No	-	0
118	T1074	No	-	0
119	T1030	No	-	0
120	T1564.006	No	-	0
121	T1564.001	No	-	0
122	T1053.001	No	-	0
123	T1204.001	No	-	0
124	T1567.001	No	-	0
125	T1113	No	-	0
126	T1202	No	-	0
127	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
128	T1023	No	-	0
129	T1090.002	No	-	0
130	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
131	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
132	T1578.003	No	-	0
133	T1178	No	-	0
134	T1056.001	No	-	0
135	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	3
136	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml	3
137	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml	3
138	T1565.002	No	-	0
139	T1038	No	-	0
140	T1096	No	-	0
141	T1538	No	-	0
142	T1488	No	-	0
143	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
144	T1127	No	-	0
145	T1506	No	-	0
146	T1010	No	-	0
147	T1048.001	No	-	0
148	T1493	No	-	0
149	T1207	No	-	0
150	T1102.003	No	-	0
151	T1492	No	-	0
152	T1036.003	No	-	0
153	T1543.002	No	-	0
154	T1059.007	No	-	0
155	T1055.012	No	-	0
156	T1136.002	No	-	0
157	T1111	No	-	0
158	T1213.002	No	-	0
159	T1495	No	-	0
160	T1186	No	-	0
161	T1559.002	No	-	0
162	T1151	No	-	0
163	T1154	No	-	0
164	T1098.002	No	-	0
165	T1026	No	-	0
166	T1036.002	No	-	0
167	T1499	No	-	0
168	T1574.004	No	-	0
169	T1059.005	No	-	0
170	T1056.003	No	-	0
171	T1222.002	No	-	0
172	T1001.002	No	-	0
173	T1218.003	No	-	0
174	T1578.001	No	-	0
175	T1565	No	-	0
176	T1547.004	No	-	0
177	T1547.006	No	-	0
178	T1527	No	-	0
179	T1213.001	No	-	0
180	T1037	No	-	0
181	T1087.001	No	-	0
182	T1069.002	No	-	0
183	T1195.002	No	-	0
184	T1548.003	No	-	0
185	T1547.010	No	-	0
186	T1183	No	-	0
187	T1137.003	No	-	0
188	T1514	No	-	0
189	T1122	No	-	0
190	T1563.001	No	-	0
191	T1552	No	-	0
192	T1550.003	No	-	0
193	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
194	T1536	No	-	0
195	T1080	No	-	0
196	T1037.003	No	-	0
197	T1558	No	-	1
198	T1138	No	-	0
199	T1127.001	No	-	0
200	T1574.011	No	-	0
201	T1218.004	No	-	0
202	T1087.003	No	-	0
203	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
204	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
205	T1553	No	-	1
206	T1546.010	No	-	0
207	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	2
208	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	2
209	T1567	No	-	0
210	T1482	No	-	0
211	T1564.003	No	-	0
212	T1216.001	No	-	0
213	T1174	No	-	0
214	T1064	No	-	0
215	T1217	No	-	0
216	T1110	No	-	0
217	T1546	No	-	5
218	T1102.001	No	-	0
219	T1558.002	No	-	0
220	T1032	No	-	0
221	T1145	No	-	0
222	T1543.004	No	-	0
223	T1037.004	No	-	0
224	T1552.003	No	-	0
225	T1574.012	No	-	0
226	T1043	No	-	0
227	T1044	No	-	0
228	T1063	No	-	0
229	T1216	No	-	0
230	T1550.001	No	-	0
231	T1173	No	-	0
232	T1192	No	-	0
233	T1152	No	-	0
234	T1119	No	-	0
235	T1546.014	No	-	0
236	T1164	No	-	0
237	T1197	No	-	0
238	T1135	No	-	0
239	T1098.004	No	-	0
240	T1055.013	No	-	0
241	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
242	T1550	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_get_session_token_abuse.yml	2
243	T1539	No	-	0
244	T1497	No	-	0
245	T1001.003	No	-	0
246	T1561.001	No	-	0
247	T1123	No	-	0
248	T1486	No	-	0
249	T1014	No	-	0
250	T1099	No	-	0
251	T1562.002	No	-	0
252	T1102.002	No	-	0
253	T1086	No	-	0
254	T1555.001	No	-	0
255	T1489	No	-	0
256	T1069	No	-	0
257	T1182	No	-	0
258	T1114.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml	1
259	T1204	No	-	1
260	T1115	No	-	0
261	T1105	No	-	0
262	T1079	No	-	0
263	T1056.004	No	-	0
264	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	5
265	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml	5
266	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml	5
267	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	5
268	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	5
269	T1137.001	No	-	0
270	T1137.002	No	-	0
271	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml	5
272	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml	5
273	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml	5
274	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml	5
275	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml	5
276	T1133	No	-	0
277	T1017	No	-	0
278	T1487	No	-	0
279	T1501	No	-	0
280	T1031	No	-	0
281	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	29
282	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_gcploit_framework.yml	29
283	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml	29
284	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_assume_role_abuse.yml	29
285	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_permanent_key_creation.yml	29
286	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml	29
287	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_role_creation.yml	29
288	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml	29
289	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_attach_to_role_policy.yml	29
290	T1093	No	-	0
291	T1181	No	-	0
292	T1025	No	-	0
293	T1550.004	No	-	0
294	T1087.002	No	-	0
295	T1005	No	-	0
296	T1546.012	No	-	0
297	T1110.001	No	-	0
298	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
299	T1573.002	No	-	0
300	T1153	No	-	0
301	T1557.001	No	-	0
302	T1491	No	-	0
303	T1055.002	No	-	0
304	T1051	No	-	0
305	T1036.001	No	-	0
306	T1021.005	No	-	0
307	T1195	No	-	0
308	T1574.010	No	-	0
309	T1497.003	No	-	0
310	T1006	No	-	0
311	T1091	No	-	0
312	T1546.015	No	-	0
313	T1552.005	No	-	0
314	T1500	No	-	0
315	T1037.002	No	-	0
316	T1057	No	-	0
317	T1137.004	No	-	0
318	T1215	No	-	0
319	T1195.001	No	-	0
320	T1499.001	No	-	0
321	T1129	No	-	0
322	T1130	No	-	0
323	T1555.002	No	-	0
324	T1009	No	-	0
325	T1554	No	-	0
326	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
327	T1142	No	-	0
328	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
329	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
330	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
331	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
332	T1218.005	No	-	0
333	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
334	T1177	No	-	0
335	T1046	No	-	0
336	T1546.007	No	-	0
337	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml	14
338	T1042	No	-	0
339	T1546.002	No	-	0
340	T1499.004	No	-	0
341	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
342	T1059.004	No	-	0
343	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	5
344	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml	5
345	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	5
346	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	5
347	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	5
348	T1212	No	-	0
349	T1104	No	-	0
350	T1097	No	-	0
351	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
352	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
353	T1565.003	No	-	0
354	T1103	No	-	0
355	T1569	No	-	1
356	T1553.001	No	-	0
357	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
358	T1543.001	No	-	0
359	T1560	No	-	0
360	T1108	No	-	0
361	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	5
362	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	5
363	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	5
364	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	5
365	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	5
366	T1065	No	-	0
367	T1136.003	No	-	0
368	T1150	No	-	0
369	T1037.005	No	-	0
370	T1021	No	-	6
371	T1566	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml	5
372	T1075	No	-	0
373	T1529	No	-	0
374	T1170	No	-	0
375	T1187	No	-	0
376	T1168	No	-	0
377	T1134	No	-	0
378	T1114	No	-	3
379	T1089	No	-	0
380	T1499.002	No	-	0
381	T1160	No	-	0
382	T1218.010	No	-	0
383	T1110.004	No	-	0
384	T1484	No	-	0
385	T1195.003	No	-	0
386	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
387	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
388	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
389	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
390	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
391	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
392	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
393	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
394	T1158	No	-	0
395	T1496	No	-	0
396	T1090.004	No	-	0
397	T1147	No	-	0
398	T1059.006	No	-	0
399	T1055.008	No	-	0
400	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
401	T1052	No	-	0
402	T1499.003	No	-	0
403	T1562.003	No	-	0
404	T1201	No	-	0
405	T1125	No	-	0
406	T1179	No	-	0
407	T1556.003	No	-	0
408	T1055.004	No	-	0
409	T1061	No	-	0
410	T1155	No	-	0
411	T1085	No	-	0
412	T1003.006	No	-	0
413	T1029	No	-	0
414	T1055.003	No	-	0
415	T1213	No	-	0
416	T1116	No	-	0
417	T1543	No	-	1
418	T1109	No	-	0
419	T1220	No	-	0
420	T1218.009	No	-	0
421	T1562	No	-	3
422	T1546.005	No	-	0
423	T1012	No	-	0
424	T1572	No	-	0
425	T1037.001	No	-	0
426	T1102	No	-	0
427	T1002	No	-	0
428	T1210	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml	1
429	T1020	No	-	0
430	T1083	No	-	0
431	T1081	No	-	0
432	T1171	No	-	0
433	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
434	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
435	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
436	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
437	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
438	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
439	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
440	T1106	No	-	0
441	T1574.002	No	-	0
442	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	3
443	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	3
444	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_zerologon_via_zeek.yml	3
445	T1480	No	-	0
446	T1218.008	No	-	0
447	T1560.001	No	-	0
448	T1049	No	-	0
449	T1027.001	No	-	0
450	T1004	No	-	0
451	T1062	No	-	0
452	T1070.005	No	-	0
453	T1218.001	No	-	0
454	T1568	No	-	0
455	T1552.006	No	-	0
456	T1542.003	No	-	0
457	T1497.002	No	-	0
458	T1132.002	No	-	0
459	T1071.003	No	-	0
460	T1053	No	-	4
461	T1056.002	No	-	0
462	T1033	No	-	0
463	T1175	No	-	0
464	T1011	No	-	0
465	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
466	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
467	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	3
468	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	3
469	T1137	No	-	0
470	T1126	No	-	0
471	T1146	No	-	0
472	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
473	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
474	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
475	T1188	No	-	0
476	T1491.002	No	-	0
477	T1483	No	-	0
478	T1564.002	No	-	0
479	T1053.003	No	-	0
480	T1041	No	-	0
481	T1185	No	-	0
482	T1087	No	-	0
483	T1218.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	1
484	T1205	No	-	0
485	T1570	No	-	0
486	T1067	No	-	0
487	T1003.005	No	-	0
488	T1556.001	No	-	0
489	T1568.001	No	-	0
490	T1550.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	1
491	T1128	No	-	0
492	T1084	No	-	0
493	T1552.002	No	-	0
494	T1199	No	-	0
495	T1137.006	No	-	0
496	T1548.002	No	-	0
497	T1542	No	-	0
498	T1137.005	No	-	0
499	T1552.001	No	-	0
500	T1059	No	-	15
501	T1092	No	-	0
502	T1559	No	-	0
503	T1561	No	-	0
504	T1027.004	No	-	0
505	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml	4
506	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml	4
507	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml	4
508	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml	4
509	T1053.004	No	-	0
510	T1036.005	No	-	0
511	T1218.002	No	-	0
512	T1055.011	No	-	0
513	T1055.001	No	-	0
514	T1546.013	No	-	0
515	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml	2
516	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml	2
517	T1050	No	-	0
518	T1055.005	No	-	0
519	T1528	No	-	0
520	T1134.003	No	-	0
521	T1144	No	-	0
522	T1016	No	-	0
523	T1076	No	-	0
524	T1563	No	-	0
525	T1060	No	-	0
526	T1021.003	No	-	0
527	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
528	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml	2
529	T1098.003	No	-	0
530	T1221	No	-	0
531	T1140	No	-	0
532	T1567.002	No	-	0
533	T1139	No	-	0
534	T1566.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	1
535	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	1
536	T1066	No	-	0
537	T1100	No	-	0
538	T1222	No	-	1
539	T1176	No	-	0
540	T1497.001	No	-	0
541	T1555.003	No	-	0
542	T1564.005	No	-	0
543	T1074.002	No	-	0
544	T1578.002	No	-	0
545	T1547.008	No	-	0
546	T1504	No	-	0
547	T1053.002	No	-	0
548	T1090.003	No	-	0
549	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	7
550	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	7
551	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	7
552	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml	7
553	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	7
554	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	7
555	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	7
556	T1223	No	-	0
557	T1143	No	-	0
558	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	3
559	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	3
560	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	3
561	T1565.001	No	-	0
562	T1553.003	No	-	0
563	T1134.005	No	-	0
564	T1077	No	-	0
565	T1566.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	1
566	T1548.004	No	-	0
567	T1003.007	No	-	0
568	T1537	No	-	0
569	T1132.001	No	-	0
570	T1159	No	-	0
571	T1098.001	No	-	0
572	T1205.001	No	-	0
573	T1574	No	-	1
574	T1165	No	-	0
575	T1003.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	1
576	T1034	No	-	0
577	T1189	No	-	0
578	T1015	No	-	0
579	T1036.006	No	-	0
580	T1024	No	-	0
581	T1055.014	No	-	0
582	T1003.008	No	-	0
583	T1546.009	No	-	0
584	T1035	No	-	0
585	T1021.006	No	-	0
586	T1156	No	-	0
587	T1022	No	-	0
588	T1547.005	No	-	0
589	T1547.002	No	-	0
590	T1120	No	-	0
591	T1184	No	-	0
592	T1054	No	-	0
593	T1556	No	-	0
594	T1071	No	-	10
595	T1070.002	No	-	0
596	T1090	No	-	0
597	T1132	No	-	0
598	T1196	No	-	0
599	T1011.001	No	-	0
600	T1118	No	-	0
601	T1534	No	-	0
602	T1134.002	No	-	0
603	T1110.003	No	-	0
604	T1007	No	-	0
605	T1562.007	No	-	0
606	T1027.005	No	-	0
607	T1558.001	No	-	0
608	T1559.001	No	-	0
609	T1578	No	-	0
610	T1560.002	No	-	0
611	T1573.001	No	-	0
612	T1569.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml	1
613	T1491.001	No	-	0
614	T1211	No	-	0
615	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
616	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
617	T1564.004	No	-	0
618	T1110.002	No	-	0
619	T1546.008	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	1
620	T1562.006	No	-	0
621	T1059.002	No	-	0
622	T1518	No	-	0
623	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	3
624	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	3
625	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_information_discovery_detection.yml	3
626	T1163	No	-	0
627	T1505.002	No	-	0
628	T1547.011	No	-	0
629	T1090.001	No	-	0
630	T1180	No	-	0
631	T1490	No	-	0
632	T1058	No	-	0
633	T1001.001	No	-	0
634	T1542.002	No	-	0
635	T1485	Yes	https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml	1
636	T1019	No	-	0
637	T1055	No	-	0
638	T1574.006	No	-	0
639	T1048.002	No	-	0
640	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	13
641	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	13
642	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	13
643	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	13
644	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	13
645	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	13
646	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	13
647	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	13
648	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	13
649	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	13
650	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	13
651	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	13
652	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	13
653	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	4
654	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	4
655	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	4
656	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	4
657	T1209	No	-	0
658	T1522	No	-	0
659	T1169	No	-	0
660	T1503	No	-	0
661	T1498.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml	1
662	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	1
663	T1052.001	No	-	0
664	T1555	No	-	0
665	T1048	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	3
666	T1505.003	No	-	0
667	T1546.006	No	-	0
668	T1070.004	No	-	0
669	T1172	No	-	0
670	T1070	Yes	https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml	3
671	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml	2
672	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml	2
673	T1117	No	-	0
674	T1547.007	No	-	0
675	T1218	No	-	1
676	T1571	No	-	0
677	T1502	No	-	0
678	T1531	No	-	0
679	T1124	No	-	0
680	T1578.004	No	-	0
681	T1574.008	No	-	0
682	T1008	No	-	0
683	T1040	No	-	0
684	T1573	No	-	0
685	T1194	No	-	0
686	T1191	No	-	0
687	T1131	No	-	0
688	T1036.004	No	-	0
689	T1157	No	-	0
690	T1027.002	No	-	0
691	T1088	No	-	0
692	T1574.005	No	-	0
693	T1542.001	No	-	0
694	T1519	No	-	0
695	T1214	No	-	0
696	T1114.003	No	-	0
697	T1070.006	No	-	0
698	T1101	No	-	0
699	T1546.004	No	-	0
700	T1018	No	-	0
701	T1098	No	-	0
702	T1070.003	No	-	0
703	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
704	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
705	T1560.003	No	-	0
706	T1574.007	No	-	0
707	T1218.007	No	-	0
708	T1494	No	-	0
709	T1003.004	No	-	0
710	T1547.009	No	-	0
711	T1069.001	No	-	0
712	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
713	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
714	T1121	No	-	0
715	T1198	No	-	0
716	T1055.009	No	-	0
717	T1069.003	No	-	0
718	T1166	No	-	0
719	T1087.004	No	-	0
720	T1045	No	-	0
721	T1505.001	No	-	0
722	T1569.001	No	-	0
723	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
724	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
725	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
726	T1028	No	-	0
727	T1552.004	No	-	0
728	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
729	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
730	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
731	T1134.004	No	-	0
732	T1548	No	-	0
733	T1073	No	-	0
734	T1167	No	-	0
735	T1206	No	-	0
736	T1208	No	-	0
737	T1001	No	-	0
738	T1134.001	No	-	0
739	T1148	No	-	0
740	T1498.001	No	-	0
741	T1563.002	No	-	0
742	T1564	No	-	0
743	T1561.002	No	-	0
744	T1518.001	No	-	0
745	T1219	No	-	0
746	T1149	No	-	0
747	T1574.001	No	-	0
748	T1074.001	No	-	0
749	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
750	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
751	T1141	No	-	0
752	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	6
753	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	6
754	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	6
755	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	6
756	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	6
757	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	6
758	T1039	No	-	0
759	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
760	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
761	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
762	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
763	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
764	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
765	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
766	T1546.003	No	-	0
767	T1547	No	-	3
768	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml	8
769	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml	8
770	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
771	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml	8
772	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
773	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8
774	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
775	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml	8
776	T1568.002	No	-	0
777	T1193	No	-	0
778	T1548.001	No	-	0
779	T1107	No	-	0
780	T1553.002	No	-	0
781	T1505	No	-	0
782	T1480.001	No	-	0
783	T1161	No	-	0
784	T1568.003	No	-	0
785	T1013	No	-	0
786	T1556.002	No	-	0
787	T1021.004	No	-	0
788	T1027.003	No	-	0
789	T1056	No	-	0
790	T1547.003	No	-	0
791	T1094	No	-	0
792	T1162	No	-	0
793	T1074	No	-	0
794	T1030	No	-	0
795	T1564.006	No	-	0
796	T1564.001	No	-	0
797	T1053.001	No	-	0
798	T1204.001	No	-	0
799	T1567.001	No	-	0
800	T1113	No	-	0
801	T1202	No	-	0
802	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
803	T1023	No	-	0
804	T1090.002	No	-	0
805	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
806	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
807	T1578.003	No	-	0
808	T1178	No	-	0
809	T1056.001	No	-	0
810	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	3
811	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml	3
812	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml	3
813	T1565.002	No	-	0
814	T1038	No	-	0
815	T1096	No	-	0
816	T1538	No	-	0
817	T1488	No	-	0
818	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
819	T1127	No	-	0
820	T1506	No	-	0
821	T1010	No	-	0
822	T1048.001	No	-	0
823	T1493	No	-	0
824	T1207	No	-	0
825	T1102.003	No	-	0
826	T1492	No	-	0
827	T1036.003	No	-	0
828	T1543.002	No	-	0
829	T1059.007	No	-	0
830	T1055.012	No	-	0
831	T1136.002	No	-	0
832	T1111	No	-	0
833	T1213.002	No	-	0
834	T1495	No	-	0
835	T1186	No	-	0
836	T1559.002	No	-	0
837	T1151	No	-	0
838	T1154	No	-	0
839	T1098.002	No	-	0
840	T1026	No	-	0
841	T1036.002	No	-	0
842	T1499	No	-	0
843	T1574.004	No	-	0
844	T1059.005	No	-	0
845	T1056.003	No	-	0
846	T1222.002	No	-	0
847	T1001.002	No	-	0
848	T1218.003	No	-	0
849	T1578.001	No	-	0
850	T1565	No	-	0
851	T1547.004	No	-	0
852	T1547.006	No	-	0
853	T1527	No	-	0
854	T1213.001	No	-	0
855	T1037	No	-	0
856	T1087.001	No	-	0
857	T1069.002	No	-	0
858	T1195.002	No	-	0
859	T1548.003	No	-	0
860	T1547.010	No	-	0
861	T1183	No	-	0
862	T1137.003	No	-	0
863	T1514	No	-	0
864	T1122	No	-	0
865	T1563.001	No	-	0
866	T1552	No	-	0
867	T1550.003	No	-	0
868	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
869	T1536	No	-	0
870	T1080	No	-	0
871	T1037.003	No	-	0
872	T1558	No	-	1
873	T1138	No	-	0
874	T1127.001	No	-	0
875	T1574.011	No	-	0
876	T1218.004	No	-	0
877	T1087.003	No	-	0
878	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
879	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
880	T1553	No	-	1
881	T1546.010	No	-	0
882	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	2
883	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	2
884	T1567	No	-	0
885	T1482	No	-	0
886	T1564.003	No	-	0
887	T1216.001	No	-	0
888	T1174	No	-	0
889	T1064	No	-	0
890	T1217	No	-	0
891	T1110	No	-	0
892	T1546	No	-	5
893	T1102.001	No	-	0
894	T1558.002	No	-	0
895	T1032	No	-	0
896	T1145	No	-	0
897	T1543.004	No	-	0
898	T1037.004	No	-	0
899	T1552.003	No	-	0
900	T1574.012	No	-	0
901	T1043	No	-	0
902	T1044	No	-	0
903	T1063	No	-	0
904	T1216	No	-	0
905	T1550.001	No	-	0
906	T1173	No	-	0
907	T1192	No	-	0
908	T1152	No	-	0
909	T1119	No	-	0
910	T1546.014	No	-	0
911	T1164	No	-	0
912	T1197	No	-	0
913	T1135	No	-	0
914	T1098.004	No	-	0
915	T1055.013	No	-	0
916	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
917	T1550	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_get_session_token_abuse.yml	2
918	T1539	No	-	0
919	T1497	No	-	0
920	T1001.003	No	-	0
921	T1561.001	No	-	0
922	T1123	No	-	0
923	T1486	No	-	0
924	T1014	No	-	0
925	T1099	No	-	0
926	T1562.002	No	-	0
927	T1102.002	No	-	0
928	T1086	No	-	0
929	T1555.001	No	-	0
930	T1489	No	-	0
931	T1069	No	-	0
932	T1182	No	-	0
933	T1114.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml	1
934	T1204	No	-	1
935	T1115	No	-	0
936	T1105	No	-	0
937	T1079	No	-	0
938	T1056.004	No	-	0
939	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	5
940	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml	5
941	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml	5
942	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	5
943	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	5
944	T1137.001	No	-	0
945	T1137.002	No	-	0
946	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml	5
947	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml	5
948	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml	5
949	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml	5
950	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml	5
951	T1133	No	-	0
952	T1017	No	-	0
953	T1487	No	-	0
954	T1501	No	-	0
955	T1031	No	-	0
956	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	29
957	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_gcploit_framework.yml	29
958	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml	29
959	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_assume_role_abuse.yml	29
960	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_permanent_key_creation.yml	29
961	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml	29
962	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_role_creation.yml	29
963	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml	29
964	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_attach_to_role_policy.yml	29
965	T1093	No	-	0
966	T1181	No	-	0
967	T1025	No	-	0
968	T1550.004	No	-	0
969	T1087.002	No	-	0
970	T1005	No	-	0
971	T1546.012	No	-	0
972	T1110.001	No	-	0
973	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
974	T1573.002	No	-	0
975	T1153	No	-	0
976	T1557.001	No	-	0
977	T1491	No	-	0
978	T1055.002	No	-	0
979	T1051	No	-	0
980	T1036.001	No	-	0
981	T1021.005	No	-	0
982	T1195	No	-	0
983	T1574.010	No	-	0
984	T1497.003	No	-	0
985	T1006	No	-	0
986	T1091	No	-	0
987	T1546.015	No	-	0
988	T1552.005	No	-	0
989	T1500	No	-	0
990	T1037.002	No	-	0
991	T1057	No	-	0
992	T1137.004	No	-	0
993	T1215	No	-	0
994	T1195.001	No	-	0
995	T1499.001	No	-	0
996	T1129	No	-	0
997	T1130	No	-	0
998	T1555.002	No	-	0
999	T1009	No	-	0
1000	T1554	No	-	0
1001	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
1002	T1142	No	-	0
1003	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
1004	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
1005	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
1006	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
1007	T1218.005	No	-	0
1008	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
1009	T1177	No	-	0
1010	T1046	No	-	0
1011	T1546.007	No	-	0
1012	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml	14
1013	T1042	No	-	0
1014	T1546.002	No	-	0
1015	T1499.004	No	-	0
1016	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
1017	T1059.004	No	-	0
1018	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	5
1019	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml	5
1020	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	5
1021	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	5
1022	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	5
1023	T1212	No	-	0
1024	T1104	No	-	0
1025	T1097	No	-	0
1026	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
1027	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
1028	T1565.003	No	-	0
1029	T1103	No	-	0
1030	T1569	No	-	1
1031	T1553.001	No	-	0
1032	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
1033	T1543.001	No	-	0
1034	T1560	No	-	0
1035	T1108	No	-	0
1036	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	5
1037	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	5
1038	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	5
1039	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	5
1040	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	5
1041	T1065	No	-	0
1042	T1136.003	No	-	0
1043	T1150	No	-	0
1044	T1037.005	No	-	0
1045	T1021	No	-	6
1046	T1566	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml	5
1047	T1075	No	-	0
1048	T1529	No	-	0
1049	T1170	No	-	0
1050	T1187	No	-	0
1051	T1168	No	-	0
1052	T1134	No	-	0
1053	T1114	No	-	3
1054	T1089	No	-	0
1055	T1499.002	No	-	0
1056	T1160	No	-	0
1057	T1218.010	No	-	0
1058	T1110.004	No	-	0
1059	T1484	No	-	0
1060	T1195.003	No	-	0
1061	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
1062	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
1063	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
1064	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
1065	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
1066	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
1067	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
1068	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
1069	T1158	No	-	0
1070	T1496	No	-	0
1071	T1090.004	No	-	0
1072	T1147	No	-	0
1073	T1059.006	No	-	0
1074	T1055.008	No	-	0
1075	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
1076	T1052	No	-	0
1077	T1499.003	No	-	0
1078	T1562.003	No	-	0
1079	T1201	No	-	0
1080	T1125	No	-	0
1081	T1179	No	-	0
1082	T1556.003	No	-	0
1083	T1055.004	No	-	0
1084	T1061	No	-	0
1085	T1155	No	-	0
1086	T1085	No	-	0
1087	T1003.006	No	-	0
1088	T1029	No	-	0
1089	T1055.003	No	-	0
1090	T1213	No	-	0
1091	T1116	No	-	0
1092	T1543	No	-	1
1093	T1109	No	-	0
1094	T1220	No	-	0
1095	T1218.009	No	-	0
1096	T1562	No	-	3
1097	T1546.005	No	-	0
1098	T1012	No	-	0
1099	T1572	No	-	0
1100	T1037.001	No	-	0
1101	T1102	No	-	0
1102	T1002	No	-	0
1103	T1210	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml	1
1104	T1020	No	-	0
1105	T1083	No	-	0
1106	T1081	No	-	0
1107	T1171	No	-	0
1108	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
1109	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
1110	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
1111	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
1112	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
1113	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
1114	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
1115	T1106	No	-	0
1116	T1574.002	No	-	0
1117	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	3
1118	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	3
1119	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_zerologon_via_zeek.yml	3
1120	T1480	No	-	0
1121	T1218.008	No	-	0
1122	T1560.001	No	-	0
1123	T1049	No	-	0
1124	T1027.001	No	-	0
1125	T1004	No	-	0
1126	T1062	No	-	0
1127	T1070.005	No	-	0
1128	T1218.001	No	-	0
1129	T1568	No	-	0
1130	T1552.006	No	-	0
1131	T1542.003	No	-	0
1132	T1497.002	No	-	0
1133	T1132.002	No	-	0
1134	T1071.003	No	-	0
1135	T1053	No	-	4
1136	T1056.002	No	-	0
1137	T1033	No	-	0
1138	T1175	No	-	0
1139	T1011	No	-	0
1140	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
1141	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
1142	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	3
1143	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	3
1144	T1137	No	-	0
1145	T1126	No	-	0
1146	T1146	No	-	0
1147	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
1148	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
1149	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
1150	T1188	No	-	0
1151	T1491.002	No	-	0
1152	T1483	No	-	0
1153	T1564.002	No	-	0
1154	T1053.003	No	-	0
1155	T1041	No	-	0
1156	T1185	No	-	0
1157	T1087	No	-	0
1158	T1218.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	1
1159	T1205	No	-	0
1160	T1570	No	-	0
1161	T1067	No	-	0
1162	T1003.005	No	-	0
1163	T1556.001	No	-	0
1164	T1568.001	No	-	0
1165	T1550.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	1
1166	T1128	No	-	0
1167	T1084	No	-	0
1168	T1552.002	No	-	0
1169	T1199	No	-	0
1170	T1137.006	No	-	0
1171	T1548.002	No	-	0
1172	T1542	No	-	0
1173	T1137.005	No	-	0
1174	T1552.001	No	-	0
1175	T1059	No	-	15
1176	T1092	No	-	0
1177	T1559	No	-	0
1178	T1561	No	-	0
1179	T1027.004	No	-	0
1180	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml	4
1181	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml	4
1182	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml	4
1183	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml	4
1184	T1053.004	No	-	0
1185	T1036.005	No	-	0
1186	T1218.002	No	-	0
1187	T1055.011	No	-	0
1188	T1055.001	No	-	0
1189	T1546.013	No	-	0
1190	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml	2
1191	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml	2
1192	T1050	No	-	0
1193	T1055.005	No	-	0
1194	T1528	No	-	0
1195	T1134.003	No	-	0
1196	T1144	No	-	0
1197	T1016	No	-	0
1198	T1076	No	-	0
1199	T1563	No	-	0
1200	T1060	No	-	0
1201	T1021.003	No	-	0
1202	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
1203	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml	2
1204	T1098.003	No	-	0
1205	T1221	No	-	0
1206	T1140	No	-	0
1207	T1567.002	No	-	0
1208	T1139	No	-	0
1209	T1566.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	1
1210	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	1
1211	T1066	No	-	0
1212	T1100	No	-	0
1213	T1222	No	-	1
1214	T1176	No	-	0
1215	T1497.001	No	-	0
1216	T1555.003	No	-	0
1217	T1564.005	No	-	0
1218	T1074.002	No	-	0
1219	T1578.002	No	-	0
1220	T1547.008	No	-	0
1221	T1504	No	-	0
1222	T1053.002	No	-	0
1223	T1090.003	No	-	0
1224	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	7
1225	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	7
1226	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	7
1227	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml	7
1228	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	7
1229	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	7
1230	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	7
1231	T1223	No	-	0
1232	T1143	No	-	0
1233	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	3
1234	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	3
1235	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	3
1236	T1565.001	No	-	0
1237	T1553.003	No	-	0
1238	T1134.005	No	-	0
1239	T1077	No	-	0
1240	T1566.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	1
1241	T1548.004	No	-	0
1242	T1003.007	No	-	0
1243	T1537	No	-	0
1244	T1132.001	No	-	0
1245	T1159	No	-	0
1246	T1098.001	No	-	0
1247	T1205.001	No	-	0
1248	T1574	No	-	1
1249	T1165	No	-	0
1250	T1003.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	1
1251	T1034	No	-	0
1252	T1189	No	-	0
1253	T1015	No	-	0
1254	T1036.006	No	-	0
1255	T1024	No	-	0
1256	T1055.014	No	-	0
1257	T1003.008	No	-	0
1258	T1546.009	No	-	0
1259	T1035	No	-	0
1260	T1021.006	No	-	0
1261	T1156	No	-	0
1262	T1022	No	-	0
1263	T1547.005	No	-	0
1264	T1547.002	No	-	0
1265	T1120	No	-	0
1266	T1184	No	-	0
1267	T1054	No	-	0
1268	T1556	No	-	0
1269	T1071	No	-	10
1270	T1070.002	No	-	0
1271	T1090	No	-	0
1272	T1132	No	-	0
1273	T1196	No	-	0
1274	T1011.001	No	-	0
1275	T1118	No	-	0
1276	T1534	No	-	0
1277	T1134.002	No	-	0
1278	T1110.003	No	-	0
1279	T1007	No	-	0
1280	T1562.007	No	-	0
1281	T1027.005	No	-	0
1282	T1558.001	No	-	0
1283	T1559.001	No	-	0
1284	T1578	No	-	0
1285	T1560.002	No	-	0
1286	T1573.001	No	-	0
1287	T1569.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml	1
1288	T1491.001	No	-	0
1289	T1211	No	-	0
1290	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
1291	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
1292	T1564.004	No	-	0
1293	T1110.002	No	-	0
1294	T1546.008	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	1
1295	T1562.006	No	-	0
1296	T1059.002	No	-	0
1297	T1518	No	-	0
1298	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	3
1299	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	3
1300	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_information_discovery_detection.yml	3
1301	T1163	No	-	0
1302	T1505.002	No	-	0
1303	T1547.011	No	-	0
1304	T1090.001	No	-	0
1305	T1180	No	-	0
1306	T1490	No	-	0
1307	T1058	No	-	0
1308	T1001.001	No	-	0
1309	T1542.002	No	-	0
1310	T1485	Yes	https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml	1
1311	T1019	No	-	0
1312	T1055	No	-	0
1313	T1574.006	No	-	0
1314	T1048.002	No	-	0
1315	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	13
1316	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	13
1317	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	13
1318	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	13
1319	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	13
1320	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	13
1321	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	13
1322	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	13
1323	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	13
1324	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	13
1325	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	13
1326	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	13
1327	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	13
1328	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	4
1329	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	4
1330	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	4
1331	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	4
1332	T1209	No	-	0
1333	T1522	No	-	0
1334	T1169	No	-	0
1335	T1503	No	-	0
1336	T1498.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml	1
1337	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	1
1338	T1052.001	No	-	0
1339	T1555	No	-	0
1340	T1048	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	3
1341	T1505.003	No	-	0
1342	T1546.006	No	-	0
1343	T1070.004	No	-	0
1344	T1172	No	-	0
1345	T1070	Yes	https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml	3
1346	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml	2
1347	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml	2
1348	T1117	No	-	0
1349	T1547.007	No	-	0
1350	T1218	No	-	1
1351	T1571	No	-	0
1352	T1502	No	-	0
1353	T1531	No	-	0
1354	T1124	No	-	0
1355	T1578.004	No	-	0
1356	T1574.008	No	-	0
1357	T1008	No	-	0
1358	T1040	No	-	0
1359	T1573	No	-	0
1360	T1194	No	-	0
1361	T1191	No	-	0
1362	T1131	No	-	0
1363	T1036.004	No	-	0
1364	T1157	No	-	0
1365	T1027.002	No	-	0
1366	T1088	No	-	0
1367	T1574.005	No	-	0
1368	T1542.001	No	-	0
1369	T1519	No	-	0
1370	T1214	No	-	0
1371	T1114.003	No	-	0
1372	T1070.006	No	-	0
1373	T1101	No	-	0
1374	T1546.004	No	-	0
1375	T1018	No	-	0
1376	T1098	No	-	0
1377	T1070.003	No	-	0
1378	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
1379	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
1380	T1560.003	No	-	0
1381	T1574.007	No	-	0
1382	T1218.007	No	-	0
1383	T1494	No	-	0
1384	T1003.004	No	-	0
1385	T1547.009	No	-	0
1386	T1069.001	No	-	0
1387	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
1388	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
1389	T1121	No	-	0
1390	T1198	No	-	0
1391	T1055.009	No	-	0
1392	T1069.003	No	-	0
1393	T1166	No	-	0
1394	T1087.004	No	-	0
1395	T1045	No	-	0
1396	T1505.001	No	-	0
1397	T1569.001	No	-	0
1398	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
1399	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
1400	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
1401	T1028	No	-	0
1402	T1552.004	No	-	0
1403	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
1404	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
1405	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
1406	T1134.004	No	-	0
1407	T1548	No	-	0
1408	T1073	No	-	0
1409	T1167	No	-	0
1410	T1206	No	-	0
1411	T1208	No	-	0
1412	T1001	No	-	0
1413	T1134.001	No	-	0
1414	T1148	No	-	0
1415	T1498.001	No	-	0
1416	T1563.002	No	-	0
1417	T1564	No	-	0
1418	T1561.002	No	-	0
1419	T1518.001	No	-	0
1420	T1219	No	-	0
1421	T1149	No	-	0
1422	T1574.001	No	-	0
1423	T1074.001	No	-	0
1424	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
1425	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
1426	T1141	No	-	0
1427	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	6
1428	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	6
1429	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	6
1430	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	6
1431	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	6
1432	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	6
1433	T1039	No	-	0
1434	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
1435	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
1436	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
1437	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
1438	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
1439	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
1440	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
1441	T1546.003	No	-	0
1442	T1547	No	-	3
1443	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml	8
1444	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml	8
1445	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
1446	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml	8
1447	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
1448	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8
1449	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
1450	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml	8
1451	T1568.002	No	-	0
1452	T1193	No	-	0
1453	T1548.001	No	-	0
1454	T1107	No	-	0
1455	T1553.002	No	-	0
1456	T1505	No	-	0
1457	T1480.001	No	-	0
1458	T1161	No	-	0
1459	T1568.003	No	-	0
1460	T1013	No	-	0
1461	T1556.002	No	-	0
1462	T1021.004	No	-	0
1463	T1027.003	No	-	0
1464	T1056	No	-	0
1465	T1547.003	No	-	0
1466	T1094	No	-	0
1467	T1162	No	-	0
1468	T1074	No	-	0
1469	T1030	No	-	0
1470	T1564.006	No	-	0
1471	T1564.001	No	-	0
1472	T1053.001	No	-	0
1473	T1204.001	No	-	0
1474	T1567.001	No	-	0
1475	T1113	No	-	0
1476	T1202	No	-	0
1477	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
1478	T1023	No	-	0
1479	T1090.002	No	-	0
1480	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
1481	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
1482	T1578.003	No	-	0
1483	T1178	No	-	0
1484	T1056.001	No	-	0
1485	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	3
1486	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml	3
1487	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml	3
1488	T1565.002	No	-	0
1489	T1038	No	-	0
1490	T1096	No	-	0
1491	T1538	No	-	0
1492	T1488	No	-	0
1493	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
1494	T1127	No	-	0
1495	T1506	No	-	0
1496	T1010	No	-	0
1497	T1048.001	No	-	0
1498	T1493	No	-	0
1499	T1207	No	-	0
1500	T1102.003	No	-	0
1501	T1492	No	-	0
1502	T1036.003	No	-	0
1503	T1543.002	No	-	0
1504	T1059.007	No	-	0
1505	T1055.012	No	-	0
1506	T1136.002	No	-	0
1507	T1111	No	-	0
1508	T1213.002	No	-	0
1509	T1495	No	-	0
1510	T1186	No	-	0
1511	T1559.002	No	-	0
1512	T1151	No	-	0
1513	T1154	No	-	0
1514	T1098.002	No	-	0
1515	T1026	No	-	0
1516	T1036.002	No	-	0
1517	T1499	No	-	0
1518	T1574.004	No	-	0
1519	T1059.005	No	-	0
1520	T1056.003	No	-	0
1521	T1222.002	No	-	0
1522	T1001.002	No	-	0
1523	T1218.003	No	-	0
1524	T1578.001	No	-	0
1525	T1565	No	-	0
1526	T1547.004	No	-	0
1527	T1547.006	No	-	0
1528	T1527	No	-	0
1529	T1213.001	No	-	0
1530	T1037	No	-	0
1531	T1087.001	No	-	0
1532	T1069.002	No	-	0
1533	T1195.002	No	-	0
1534	T1548.003	No	-	0
1535	T1547.010	No	-	0
1536	T1183	No	-	0
1537	T1137.003	No	-	0
1538	T1514	No	-	0
1539	T1122	No	-	0
1540	T1563.001	No	-	0
1541	T1552	No	-	0
1542	T1550.003	No	-	0
1543	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
1544	T1536	No	-	0
1545	T1080	No	-	0
1546	T1037.003	No	-	0
1547	T1558	No	-	1
1548	T1138	No	-	0
1549	T1127.001	No	-	0
1550	T1574.011	No	-	0
1551	T1218.004	No	-	0
1552	T1087.003	No	-	0
1553	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
1554	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
1555	T1553	No	-	1
1556	T1546.010	No	-	0
1557	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	2
1558	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	2
1559	T1567	No	-	0
1560	T1482	No	-	0
1561	T1564.003	No	-	0
1562	T1216.001	No	-	0
1563	T1174	No	-	0
1564	T1064	No	-	0
1565	T1217	No	-	0
1566	T1110	No	-	0
1567	T1546	No	-	5
1568	T1102.001	No	-	0
1569	T1558.002	No	-	0
1570	T1032	No	-	0
1571	T1145	No	-	0
1572	T1543.004	No	-	0
1573	T1037.004	No	-	0
1574	T1552.003	No	-	0
1575	T1574.012	No	-	0
1576	T1043	No	-	0
1577	T1044	No	-	0
1578	T1063	No	-	0
1579	T1216	No	-	0
1580	T1550.001	No	-	0
1581	T1173	No	-	0
1582	T1192	No	-	0
1583	T1152	No	-	0
1584	T1119	No	-	0
1585	T1546.014	No	-	0
1586	T1164	No	-	0
1587	T1197	No	-	0
1588	T1135	No	-	0
1589	T1098.004	No	-	0
1590	T1055.013	No	-	0
1591	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
1592	T1550	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_get_session_token_abuse.yml	2
1593	T1539	No	-	0
1594	T1497	No	-	0
1595	T1001.003	No	-	0
1596	T1561.001	No	-	0
1597	T1123	No	-	0
1598	T1486	No	-	0
1599	T1014	No	-	0
1600	T1099	No	-	0
1601	T1562.002	No	-	0
1602	T1102.002	No	-	0
1603	T1086	No	-	0
1604	T1555.001	No	-	0
1605	T1489	No	-	0
1606	T1069	No	-	0
1607	T1182	No	-	0
1608	T1114.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml	1
1609	T1204	No	-	1
1610	T1115	No	-	0
1611	T1105	No	-	0
1612	T1079	No	-	0
1613	T1056.004	No	-	0
1614	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	5
1615	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml	5
1616	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml	5
1617	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	5
1618	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	5
1619	T1137.001	No	-	0
1620	T1137.002	No	-	0
1621	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml	5
1622	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml	5
1623	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml	5
1624	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml	5
1625	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml	5
1626	T1133	No	-	0
1627	T1017	No	-	0
1628	T1487	No	-	0
1629	T1501	No	-	0
1630	T1031	No	-	0
1631	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	29
1632	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_gcploit_framework.yml	29
1633	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml	29
1634	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_assume_role_abuse.yml	29
1635	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_permanent_key_creation.yml	29
1636	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml	29
1637	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_role_creation.yml	29
1638	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml	29
1639	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_attach_to_role_policy.yml	29
1640	T1093	No	-	0
1641	T1181	No	-	0
1642	T1025	No	-	0
1643	T1550.004	No	-	0
1644	T1087.002	No	-	0
1645	T1005	No	-	0
1646	T1546.012	No	-	0
1647	T1110.001	No	-	0
1648	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
1649	T1573.002	No	-	0
1650	T1153	No	-	0
1651	T1557.001	No	-	0
1652	T1491	No	-	0
1653	T1055.002	No	-	0
1654	T1051	No	-	0
1655	T1036.001	No	-	0
1656	T1021.005	No	-	0
1657	T1195	No	-	0
1658	T1574.010	No	-	0
1659	T1497.003	No	-	0
1660	T1006	No	-	0
1661	T1091	No	-	0
1662	T1546.015	No	-	0
1663	T1552.005	No	-	0
1664	T1500	No	-	0
1665	T1037.002	No	-	0
1666	T1057	No	-	0
1667	T1137.004	No	-	0
1668	T1215	No	-	0
1669	T1195.001	No	-	0
1670	T1499.001	No	-	0
1671	T1129	No	-	0
1672	T1130	No	-	0
1673	T1555.002	No	-	0
1674	T1009	No	-	0
1675	T1554	No	-	0
1676	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
1677	T1142	No	-	0
1678	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
1679	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
1680	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
1681	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
1682	T1218.005	No	-	0
1683	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
1684	T1177	No	-	0
1685	T1046	No	-	0
1686	T1546.007	No	-	0
1687	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml	14
1688	T1042	No	-	0
1689	T1546.002	No	-	0
1690	T1499.004	No	-	0
1691	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
1692	T1059.004	No	-	0
1693	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	5
1694	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml	5
1695	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	5
1696	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	5
1697	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	5
1698	T1212	No	-	0
1699	T1104	No	-	0
1700	T1097	No	-	0
1701	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
1702	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
1703	T1565.003	No	-	0
1704	T1103	No	-	0
1705	T1569	No	-	1
1706	T1553.001	No	-	0
1707	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
1708	T1543.001	No	-	0
1709	T1560	No	-	0
1710	T1108	No	-	0
1711	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	5
1712	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	5
1713	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	5
1714	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	5
1715	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	5
1716	T1065	No	-	0
1717	T1136.003	No	-	0
1718	T1150	No	-	0
1719	T1037.005	No	-	0
1720	T1021	No	-	6
1721	T1566	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml	5
1722	T1075	No	-	0
1723	T1529	No	-	0
1724	T1170	No	-	0
1725	T1187	No	-	0
1726	T1168	No	-	0
1727	T1134	No	-	0
1728	T1114	No	-	3
1729	T1089	No	-	0
1730	T1499.002	No	-	0
1731	T1160	No	-	0
1732	T1218.010	No	-	0
1733	T1110.004	No	-	0
1734	T1484	No	-	0
1735	T1195.003	No	-	0
1736	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
1737	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
1738	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
1739	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
1740	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
1741	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
1742	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
1743	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
1744	T1158	No	-	0
1745	T1496	No	-	0
1746	T1090.004	No	-	0
1747	T1147	No	-	0
1748	T1059.006	No	-	0
1749	T1055.008	No	-	0
1750	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
1751	T1052	No	-	0
1752	T1499.003	No	-	0
1753	T1562.003	No	-	0
1754	T1201	No	-	0
1755	T1125	No	-	0
1756	T1179	No	-	0
1757	T1556.003	No	-	0
1758	T1055.004	No	-	0
1759	T1061	No	-	0
1760	T1155	No	-	0
1761	T1085	No	-	0
1762	T1003.006	No	-	0
1763	T1029	No	-	0
1764	T1055.003	No	-	0
1765	T1213	No	-	0
1766	T1116	No	-	0
1767	T1543	No	-	1
1768	T1109	No	-	0
1769	T1220	No	-	0
1770	T1218.009	No	-	0
1771	T1562	No	-	3
1772	T1546.005	No	-	0
1773	T1012	No	-	0
1774	T1572	No	-	0
1775	T1037.001	No	-	0
1776	T1102	No	-	0
1777	T1002	No	-	0
1778	T1210	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml	1
1779	T1020	No	-	0
1780	T1083	No	-	0
1781	T1081	No	-	0
1782	T1171	No	-	0
1783	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
1784	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
1785	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
1786	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
1787	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
1788	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
1789	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
1790	T1106	No	-	0
1791	T1574.002	No	-	0
1792	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	3
1793	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	3
1794	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_zerologon_via_zeek.yml	3
1795	T1480	No	-	0
1796	T1218.008	No	-	0
1797	T1560.001	No	-	0
1798	T1049	No	-	0
1799	T1027.001	No	-	0
1800	T1004	No	-	0
1801	T1062	No	-	0
1802	T1070.005	No	-	0
1803	T1218.001	No	-	0
1804	T1568	No	-	0
1805	T1552.006	No	-	0
1806	T1542.003	No	-	0
1807	T1497.002	No	-	0
1808	T1132.002	No	-	0
1809	T1071.003	No	-	0
1810	T1053	No	-	4
1811	T1056.002	No	-	0
1812	T1033	No	-	0
1813	T1175	No	-	0
1814	T1011	No	-	0
1815	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
1816	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
1817	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	3
1818	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	3
1819	T1137	No	-	0
1820	T1126	No	-	0
1821	T1146	No	-	0
1822	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
1823	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
1824	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
1825	T1188	No	-	0
1826	T1491.002	No	-	0
1827	T1483	No	-	0
1828	T1564.002	No	-	0
1829	T1053.003	No	-	0
1830	T1041	No	-	0
1831	T1185	No	-	0
1832	T1087	No	-	0
1833	T1218.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	1
1834	T1205	No	-	0
1835	T1570	No	-	0
1836	T1067	No	-	0
1837	T1003.005	No	-	0
1838	T1556.001	No	-	0
1839	T1568.001	No	-	0
1840	T1550.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	1
1841	T1128	No	-	0
1842	T1084	No	-	0
1843	T1552.002	No	-	0
1844	T1199	No	-	0
1845	T1137.006	No	-	0
1846	T1548.002	No	-	0
1847	T1542	No	-	0
1848	T1137.005	No	-	0
1849	T1552.001	No	-	0
1850	T1059	No	-	15
1851	T1092	No	-	0
1852	T1559	No	-	0
1853	T1561	No	-	0
1854	T1027.004	No	-	0
1855	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml	4
1856	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml	4
1857	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml	4
1858	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml	4
1859	T1053.004	No	-	0
1860	T1036.005	No	-	0
1861	T1218.002	No	-	0
1862	T1055.011	No	-	0
1863	T1055.001	No	-	0
1864	T1546.013	No	-	0
1865	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml	2
1866	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml	2
1867	T1050	No	-	0
1868	T1055.005	No	-	0
1869	T1528	No	-	0
1870	T1134.003	No	-	0
1871	T1144	No	-	0
1872	T1016	No	-	0
1873	T1076	No	-	0
1874	T1563	No	-	0
1875	T1060	No	-	0
1876	T1021.003	No	-	0
1877	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
1878	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml	2
1879	T1098.003	No	-	0
1880	T1221	No	-	0
1881	T1140	No	-	0
1882	T1567.002	No	-	0
1883	T1139	No	-	0
1884	T1566.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	1
1885	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	1
1886	T1066	No	-	0
1887	T1100	No	-	0
1888	T1222	No	-	1
1889	T1176	No	-	0
1890	T1497.001	No	-	0
1891	T1555.003	No	-	0
1892	T1564.005	No	-	0
1893	T1074.002	No	-	0
1894	T1578.002	No	-	0
1895	T1547.008	No	-	0
1896	T1504	No	-	0
1897	T1053.002	No	-	0
1898	T1090.003	No	-	0
1899	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	7
1900	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	7
1901	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	7
1902	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml	7
1903	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	7
1904	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	7
1905	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	7
1906	T1223	No	-	0
1907	T1143	No	-	0
1908	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	3
1909	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	3
1910	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	3
1911	T1565.001	No	-	0
1912	T1553.003	No	-	0
1913	T1134.005	No	-	0
1914	T1077	No	-	0
1915	T1566.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	1
1916	T1548.004	No	-	0
1917	T1003.007	No	-	0
1918	T1537	No	-	0
1919	T1132.001	No	-	0
1920	T1159	No	-	0
1921	T1098.001	No	-	0
1922	T1205.001	No	-	0
1923	T1574	No	-	1
1924	T1165	No	-	0
1925	T1003.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	1
1926	T1034	No	-	0
1927	T1189	No	-	0
1928	T1015	No	-	0
1929	T1036.006	No	-	0
1930	T1024	No	-	0
1931	T1055.014	No	-	0
1932	T1003.008	No	-	0
1933	T1546.009	No	-	0
1934	T1035	No	-	0
1935	T1021.006	No	-	0
1936	T1156	No	-	0
1937	T1022	No	-	0
1938	T1547.005	No	-	0
1939	T1547.002	No	-	0
1940	T1120	No	-	0
1941	T1184	No	-	0
1942	T1054	No	-	0
1943	T1556	No	-	0
1944	T1071	No	-	10
1945	T1070.002	No	-	0
1946	T1090	No	-	0
1947	T1132	No	-	0
1948	T1196	No	-	0
1949	T1011.001	No	-	0
1950	T1118	No	-	0
1951	T1534	No	-	0
1952	T1134.002	No	-	0
1953	T1110.003	No	-	0
1954	T1007	No	-	0
1955	T1562.007	No	-	0
1956	T1027.005	No	-	0
1957	T1558.001	No	-	0
1958	T1559.001	No	-	0
1959	T1578	No	-	0
1960	T1560.002	No	-	0
1961	T1573.001	No	-	0
1962	T1569.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml	1
1963	T1491.001	No	-	0
1964	T1211	No	-	0
1965	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
1966	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
1967	T1564.004	No	-	0
1968	T1110.002	No	-	0
1969	T1546.008	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	1
1970	T1562.006	No	-	0
1971	T1059.002	No	-	0
1972	T1518	No	-	0
1973	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	3
1974	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	3
1975	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_information_discovery_detection.yml	3
1976	T1163	No	-	0
1977	T1505.002	No	-	0
1978	T1547.011	No	-	0
1979	T1090.001	No	-	0
1980	T1180	No	-	0
1981	T1490	No	-	0
1982	T1058	No	-	0
1983	T1001.001	No	-	0
1984	T1542.002	No	-	0
1985	T1485	Yes	https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml	1
1986	T1019	No	-	0
1987	T1055	No	-	0
1988	T1574.006	No	-	0
1989	T1048.002	No	-	0
1990	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	13
1991	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	13
1992	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	13
1993	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	13
1994	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	13
1995	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	13
1996	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	13
1997	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	13
1998	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	13
1999	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	13
2000	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	13
2001	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	13
2002	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	13
2003	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	4
2004	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	4
2005	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	4
2006	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	4
2007	T1209	No	-	0
2008	T1522	No	-	0
2009	T1169	No	-	0
2010	T1503	No	-	0
2011	T1498.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml	1
2012	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	1
2013	T1052.001	No	-	0
2014	T1555	No	-	0
2015	T1048	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	3
2016	T1505.003	No	-	0
2017	T1546.006	No	-	0
2018	T1070.004	No	-	0
2019	T1172	No	-	0
2020	T1070	Yes	https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml	3
2021	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml	2
2022	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml	2
2023	T1117	No	-	0
2024	T1547.007	No	-	0
2025	T1218	No	-	1
2026	T1571	No	-	0
2027	T1502	No	-	0
2028	T1531	No	-	0
2029	T1124	No	-	0
2030	T1578.004	No	-	0
2031	T1574.008	No	-	0
2032	T1008	No	-	0
2033	T1040	No	-	0
2034	T1573	No	-	0
2035	T1194	No	-	0
2036	T1191	No	-	0
2037	T1131	No	-	0
2038	T1036.004	No	-	0
2039	T1157	No	-	0
2040	T1027.002	No	-	0
2041	T1088	No	-	0
2042	T1574.005	No	-	0
2043	T1542.001	No	-	0
2044	T1519	No	-	0
2045	T1214	No	-	0
2046	T1114.003	No	-	0
2047	T1070.006	No	-	0
2048	T1101	No	-	0
2049	T1546.004	No	-	0
2050	T1018	No	-	0
2051	T1098	No	-	0
2052	T1070.003	No	-	0
2053	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
2054	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
2055	T1560.003	No	-	0
2056	T1574.007	No	-	0
2057	T1218.007	No	-	0
2058	T1494	No	-	0
2059	T1003.004	No	-	0
2060	T1547.009	No	-	0
2061	T1069.001	No	-	0
2062	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
2063	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
2064	T1121	No	-	0
2065	T1198	No	-	0
2066	T1055.009	No	-	0
2067	T1069.003	No	-	0
2068	T1166	No	-	0
2069	T1087.004	No	-	0
2070	T1045	No	-	0
2071	T1505.001	No	-	0
2072	T1569.001	No	-	0
2073	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
2074	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
2075	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
2076	T1028	No	-	0
2077	T1552.004	No	-	0
2078	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
2079	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
2080	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
2081	T1134.004	No	-	0
2082	T1548	No	-	0
2083	T1073	No	-	0
2084	T1167	No	-	0
2085	T1206	No	-	0
2086	T1208	No	-	0
2087	T1001	No	-	0
2088	T1134.001	No	-	0
2089	T1148	No	-	0
2090	T1498.001	No	-	0
2091	T1563.002	No	-	0
2092	T1564	No	-	0
2093	T1561.002	No	-	0
2094	T1518.001	No	-	0
2095	T1219	No	-	0
2096	T1149	No	-	0
2097	T1574.001	No	-	0
2098	T1074.001	No	-	0
2099	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
2100	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
2101	T1141	No	-	0
2102	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	6
2103	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	6
2104	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	6
2105	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	6
2106	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	6
2107	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	6
2108	T1039	No	-	0
2109	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
2110	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
2111	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
2112	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
2113	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
2114	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
2115	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
2116	T1546.003	No	-	0
2117	T1547	No	-	3
2118	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml	8
2119	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml	8
2120	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
2121	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml	8
2122	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
2123	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8
2124	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
2125	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml	8
2126	T1568.002	No	-	0
2127	T1193	No	-	0
2128	T1548.001	No	-	0
2129	T1107	No	-	0
2130	T1553.002	No	-	0
2131	T1505	No	-	0
2132	T1480.001	No	-	0
2133	T1161	No	-	0
2134	T1568.003	No	-	0
2135	T1013	No	-	0
2136	T1556.002	No	-	0
2137	T1021.004	No	-	0
2138	T1027.003	No	-	0
2139	T1056	No	-	0
2140	T1547.003	No	-	0
2141	T1094	No	-	0
2142	T1162	No	-	0
2143	T1074	No	-	0
2144	T1030	No	-	0
2145	T1564.006	No	-	0
2146	T1564.001	No	-	0
2147	T1053.001	No	-	0
2148	T1204.001	No	-	0
2149	T1567.001	No	-	0
2150	T1113	No	-	0
2151	T1202	No	-	0
2152	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
2153	T1023	No	-	0
2154	T1090.002	No	-	0
2155	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
2156	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
2157	T1578.003	No	-	0
2158	T1178	No	-	0
2159	T1056.001	No	-	0
2160	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	3
2161	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml	3
2162	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml	3
2163	T1565.002	No	-	0
2164	T1038	No	-	0
2165	T1096	No	-	0
2166	T1538	No	-	0
2167	T1488	No	-	0
2168	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
2169	T1127	No	-	0
2170	T1506	No	-	0
2171	T1010	No	-	0
2172	T1048.001	No	-	0
2173	T1493	No	-	0
2174	T1207	No	-	0
2175	T1102.003	No	-	0
2176	T1492	No	-	0
2177	T1036.003	No	-	0
2178	T1543.002	No	-	0
2179	T1059.007	No	-	0
2180	T1055.012	No	-	0
2181	T1136.002	No	-	0
2182	T1111	No	-	0
2183	T1213.002	No	-	0
2184	T1495	No	-	0
2185	T1186	No	-	0
2186	T1559.002	No	-	0
2187	T1151	No	-	0
2188	T1154	No	-	0
2189	T1098.002	No	-	0
2190	T1026	No	-	0
2191	T1036.002	No	-	0
2192	T1499	No	-	0
2193	T1574.004	No	-	0
2194	T1059.005	No	-	0
2195	T1056.003	No	-	0
2196	T1222.002	No	-	0
2197	T1001.002	No	-	0
2198	T1218.003	No	-	0
2199	T1578.001	No	-	0
2200	T1565	No	-	0
2201	T1547.004	No	-	0
2202	T1547.006	No	-	0
2203	T1527	No	-	0
2204	T1213.001	No	-	0
2205	T1037	No	-	0
2206	T1087.001	No	-	0
2207	T1069.002	No	-	0
2208	T1195.002	No	-	0
2209	T1548.003	No	-	0
2210	T1547.010	No	-	0
2211	T1183	No	-	0
2212	T1137.003	No	-	0
2213	T1514	No	-	0
2214	T1122	No	-	0
2215	T1563.001	No	-	0
2216	T1552	No	-	0
2217	T1550.003	No	-	0
2218	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
2219	T1536	No	-	0
2220	T1080	No	-	0
2221	T1037.003	No	-	0
2222	T1558	No	-	1
2223	T1138	No	-	0
2224	T1127.001	No	-	0
2225	T1574.011	No	-	0
2226	T1218.004	No	-	0
2227	T1087.003	No	-	0
2228	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
2229	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
2230	T1553	No	-	1
2231	T1546.010	No	-	0
2232	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	2
2233	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	2
2234	T1567	No	-	0
2235	T1482	No	-	0
2236	T1564.003	No	-	0
2237	T1216.001	No	-	0
2238	T1174	No	-	0
2239	T1064	No	-	0
2240	T1217	No	-	0
2241	T1110	No	-	0
2242	T1546	No	-	5
2243	T1102.001	No	-	0
2244	T1558.002	No	-	0
2245	T1032	No	-	0
2246	T1145	No	-	0
2247	T1543.004	No	-	0
2248	T1037.004	No	-	0
2249	T1552.003	No	-	0
2250	T1574.012	No	-	0
2251	T1043	No	-	0
2252	T1044	No	-	0
2253	T1063	No	-	0
2254	T1216	No	-	0
2255	T1550.001	No	-	0
2256	T1173	No	-	0
2257	T1192	No	-	0
2258	T1152	No	-	0
2259	T1119	No	-	0
2260	T1546.014	No	-	0
2261	T1164	No	-	0
2262	T1197	No	-	0
2263	T1135	No	-	0
2264	T1098.004	No	-	0
2265	T1055.013	No	-	0
2266	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
2267	T1550	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_get_session_token_abuse.yml	2
2268	T1539	No	-	0
2269	T1497	No	-	0
2270	T1001.003	No	-	0
2271	T1561.001	No	-	0
2272	T1123	No	-	0
2273	T1486	No	-	0
2274	T1014	No	-	0
2275	T1099	No	-	0
2276	T1562.002	No	-	0
2277	T1102.002	No	-	0
2278	T1086	No	-	0
2279	T1555.001	No	-	0
2280	T1489	No	-	0
2281	T1069	No	-	0
2282	T1182	No	-	0
2283	T1114.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml	1
2284	T1204	No	-	1
2285	T1115	No	-	0
2286	T1105	No	-	0
2287	T1079	No	-	0
2288	T1056.004	No	-	0
2289	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	5
2290	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml	5
2291	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml	5
2292	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	5
2293	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	5
2294	T1137.001	No	-	0
2295	T1137.002	No	-	0
2296	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml	5
2297	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml	5
2298	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml	5
2299	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml	5
2300	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml	5
2301	T1133	No	-	0
2302	T1017	No	-	0
2303	T1487	No	-	0
2304	T1501	No	-	0
2305	T1031	No	-	0
2306	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	29
2307	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_gcploit_framework.yml	29
2308	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml	29
2309	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_sts_assume_role_abuse.yml	29
2310	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_permanent_key_creation.yml	29
2311	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml	29
2312	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_role_creation.yml	29
2313	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml	29
2314	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_detect_attach_to_role_policy.yml	29
2315	T1093	No	-	0
2316	T1181	No	-	0
2317	T1025	No	-	0
2318	T1550.004	No	-	0
2319	T1087.002	No	-	0
2320	T1005	No	-	0
2321	T1546.012	No	-	0
2322	T1110.001	No	-	0
2323	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
2324	T1573.002	No	-	0
2325	T1153	No	-	0
2326	T1557.001	No	-	0
2327	T1491	No	-	0
2328	T1055.002	No	-	0
2329	T1051	No	-	0
2330	T1036.001	No	-	0
2331	T1021.005	No	-	0
2332	T1195	No	-	0
2333	T1574.010	No	-	0
2334	T1497.003	No	-	0
2335	T1006	No	-	0
2336	T1091	No	-	0
2337	T1546.015	No	-	0
2338	T1552.005	No	-	0
2339	T1500	No	-	0
2340	T1037.002	No	-	0
2341	T1057	No	-	0
2342	T1137.004	No	-	0
2343	T1215	No	-	0
2344	T1195.001	No	-	0
2345	T1499.001	No	-	0
2346	T1129	No	-	0
2347	T1130	No	-	0
2348	T1555.002	No	-	0
2349	T1009	No	-	0
2350	T1554	No	-	0
2351	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
2352	T1142	No	-	0
2353	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
2354	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
2355	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
2356	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
2357	T1218.005	No	-	0
2358	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
2359	T1177	No	-	0
2360	T1046	No	-	0
2361	T1546.007	No	-	0
2362	T1003	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml	14
2363	T1042	No	-	0
2364	T1546.002	No	-	0
2365	T1499.004	No	-	0
2366	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
2367	T1059.004	No	-	0
2368	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	5
2369	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml	5
2370	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	5
2371	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	5
2372	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	5
2373	T1212	No	-	0
2374	T1104	No	-	0
2375	T1097	No	-	0
2376	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
2377	T1200	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
2378	T1565.003	No	-	0
2379	T1103	No	-	0
2380	T1569	No	-	1
2381	T1553.001	No	-	0
2382	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
2383	T1543.001	No	-	0
2384	T1560	No	-	0
2385	T1108	No	-	0
2386	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	5
2387	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	5
2388	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	5
2389	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	5
2390	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	5
2391	T1065	No	-	0
2392	T1136.003	No	-	0
2393	T1150	No	-	0
2394	T1037.005	No	-	0
2395	T1021	No	-	6
2396	T1566	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml	5
2397	T1075	No	-	0
2398	T1529	No	-	0
2399	T1170	No	-	0
2400	T1187	No	-	0
2401	T1168	No	-	0
2402	T1134	No	-	0
2403	T1114	No	-	3
2404	T1089	No	-	0
2405	T1499.002	No	-	0
2406	T1160	No	-	0
2407	T1218.010	No	-	0
2408	T1110.004	No	-	0
2409	T1484	No	-	0
2410	T1195.003	No	-	0
2411	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
2412	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
2413	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
2414	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
2415	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
2416	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
2417	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
2418	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
2419	T1158	No	-	0
2420	T1496	No	-	0
2421	T1090.004	No	-	0
2422	T1147	No	-	0
2423	T1059.006	No	-	0
2424	T1055.008	No	-	0
2425	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
2426	T1052	No	-	0
2427	T1499.003	No	-	0
2428	T1562.003	No	-	0
2429	T1201	No	-	0
2430	T1125	No	-	0
2431	T1179	No	-	0
2432	T1556.003	No	-	0
2433	T1055.004	No	-	0
2434	T1061	No	-	0
2435	T1155	No	-	0
2436	T1085	No	-	0
2437	T1003.006	No	-	0
2438	T1029	No	-	0
2439	T1055.003	No	-	0
2440	T1213	No	-	0
2441	T1116	No	-	0
2442	T1543	No	-	1
2443	T1109	No	-	0
2444	T1220	No	-	0
2445	T1218.009	No	-	0
2446	T1562	No	-	3
2447	T1546.005	No	-	0
2448	T1012	No	-	0
2449	T1572	No	-	0
2450	T1037.001	No	-	0
2451	T1102	No	-	0
2452	T1002	No	-	0
2453	T1210	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml	1
2454	T1020	No	-	0
2455	T1083	No	-	0
2456	T1081	No	-	0
2457	T1171	No	-	0
2458	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
2459	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
2460	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
2461	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
2462	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
2463	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
2464	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
2465	T1106	No	-	0
2466	T1574.002	No	-	0
2467	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	3
2468	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	3
2469	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_zerologon_via_zeek.yml	3
2470	T1480	No	-	0
2471	T1218.008	No	-	0
2472	T1560.001	No	-	0
2473	T1049	No	-	0
2474	T1027.001	No	-	0
2475	T1004	No	-	0
2476	T1062	No	-	0
2477	T1070.005	No	-	0
2478	T1218.001	No	-	0
2479	T1568	No	-	0
2480	T1552.006	No	-	0
2481	T1542.003	No	-	0
2482	T1497.002	No	-	0
2483	T1132.002	No	-	0
2484	T1071.003	No	-	0
2485	T1053	No	-	4
2486	T1056.002	No	-	0
2487	T1033	No	-	0
2488	T1175	No	-	0
2489	T1011	No	-	0
2490	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
2491	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
2492	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	3
2493	T1498	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	3
2494	T1137	No	-	0
2495	T1126	No	-	0
2496	T1146	No	-	0
2497	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
2498	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_arp_poisoning.yml	2
2499	T1557	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_rogue_dhcp_server.yml	2
2500	T1188	No	-	0

The file is too large to be shown. View Raw