splunk-security_content/docs/mitre-map/detections.csv

1	Technique ID	Detection Available	Link	score
2	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
3	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
4	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
5	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
6	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
7	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
8	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
9	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
10	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
11	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
12	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
13	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
14	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
15	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
16	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
17	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
18	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
19	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
20	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
21	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
22	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
23	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
24	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
25	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
26	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
27	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
28	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
29	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
30	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
31	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
32	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
33	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
34	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
35	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
36	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
37	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
38	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
39	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
40	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
41	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
42	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
43	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
44	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
45	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
46	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
47	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
48	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
49	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
50	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
51	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
52	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
53	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
54	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
55	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
56	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
57	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
58	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
59	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
60	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
61	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
62	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
63	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
64	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
65	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
66	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
67	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
68	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
69	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
70	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
71	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
72	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
73	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
74	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
75	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
76	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
77	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
78	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
79	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
80	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
81	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
82	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
83	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
84	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
85	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
86	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
87	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
88	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
89	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
90	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
91	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
92	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
93	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
94	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
95	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
96	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
97	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
98	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
99	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
100	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
101	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
102	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
103	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
104	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
105	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
106	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
107	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
108	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
109	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
110	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
111	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
112	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
113	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
114	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
115	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
116	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
117	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
118	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
119	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
120	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
121	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
122	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
123	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
124	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
125	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
126	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
127	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
128	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
129	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
130	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
131	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
132	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
133	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
134	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
135	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
136	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
137	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
138	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
139	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
140	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
141	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
142	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
143	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
144	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
145	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
146	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
147	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
148	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
149	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
150	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
151	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
152	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
153	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
154	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
155	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
156	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
157	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
158	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
159	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
160	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
161	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
162	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
163	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
164	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
165	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
166	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
167	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
168	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
169	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
170	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
171	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
172	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
173	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
174	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
175	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
176	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
177	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
178	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
179	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
180	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
181	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
182	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
183	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
184	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
185	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
186	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
187	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
188	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
189	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
190	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
191	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
192	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
193	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
194	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
195	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
196	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
197	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
198	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
199	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
200	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
201	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
202	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
203	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
204	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
205	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
206	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
207	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
208	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
209	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
210	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
211	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
212	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
213	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
214	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
215	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
216	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
217	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
218	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
219	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
220	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
221	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
222	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
223	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
224	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
225	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
226	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
227	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
228	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
229	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
230	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
231	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
232	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
233	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
234	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
235	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
236	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
237	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
238	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
239	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
240	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
241	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
242	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
243	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
244	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
245	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
246	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
247	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
248	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
249	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
250	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
251	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
252	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
253	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
254	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
255	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
256	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
257	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
258	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
259	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
260	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
261	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
262	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
263	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
264	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
265	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
266	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
267	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
268	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
269	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
270	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
271	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
272	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
273	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	52
274	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
275	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
276	T1193	No	-	51
277	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
278	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
279	T1193	No	-	51
280	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
281	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
282	T1193	No	-	51
283	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
284	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
285	T1193	No	-	51
286	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
287	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
288	T1193	No	-	51
289	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
290	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
291	T1193	No	-	51
292	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
293	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
294	T1193	No	-	51
295	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
296	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
297	T1193	No	-	51
298	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
299	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
300	T1193	No	-	51
301	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
302	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
303	T1193	No	-	51
304	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
305	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
306	T1193	No	-	51
307	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
308	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
309	T1193	No	-	51
310	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
311	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
312	T1193	No	-	51
313	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
314	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
315	T1193	No	-	51
316	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
317	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
318	T1193	No	-	51
319	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
320	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
321	T1193	No	-	51
322	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
323	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
324	T1193	No	-	51
325	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
326	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
327	T1193	No	-	51
328	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
329	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
330	T1193	No	-	51
331	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
332	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
333	T1193	No	-	51
334	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
335	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
336	T1193	No	-	51
337	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
338	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
339	T1193	No	-	51
340	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
341	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
342	T1193	No	-	51
343	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
344	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
345	T1193	No	-	51
346	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
347	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
348	T1193	No	-	51
349	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
350	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
351	T1193	No	-	51
352	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
353	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
354	T1193	No	-	51
355	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
356	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
357	T1193	No	-	51
358	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
359	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
360	T1193	No	-	51
361	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
362	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
363	T1193	No	-	51
364	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
365	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
366	T1193	No	-	51
367	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
368	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
369	T1193	No	-	51
370	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
371	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
372	T1193	No	-	51
373	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
374	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
375	T1193	No	-	51
376	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
377	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
378	T1193	No	-	51
379	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
380	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
381	T1193	No	-	51
382	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
383	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
384	T1193	No	-	51
385	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
386	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
387	T1193	No	-	51
388	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
389	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
390	T1193	No	-	51
391	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
392	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
393	T1193	No	-	51
394	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
395	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
396	T1193	No	-	51
397	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
398	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
399	T1193	No	-	51
400	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
401	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
402	T1193	No	-	51
403	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
404	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
405	T1193	No	-	51
406	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
407	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
408	T1193	No	-	51
409	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
410	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
411	T1193	No	-	51
412	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
413	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
414	T1193	No	-	51
415	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
416	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
417	T1193	No	-	51
418	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
419	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
420	T1193	No	-	51
421	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
422	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
423	T1193	No	-	51
424	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
425	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
426	T1193	No	-	51
427	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
428	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
429	T1193	No	-	51
430	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
431	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
432	T1193	No	-	51
433	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
434	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
435	T1193	No	-	51
436	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
437	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
438	T1193	No	-	51
439	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
440	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
441	T1193	No	-	51
442	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
443	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
444	T1193	No	-	51
445	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
446	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
447	T1193	No	-	51
448	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
449	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
450	T1193	No	-	51
451	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
452	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
453	T1193	No	-	51
454	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
455	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
456	T1193	No	-	51
457	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
458	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
459	T1193	No	-	51
460	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
461	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
462	T1193	No	-	51
463	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
464	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
465	T1193	No	-	51
466	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
467	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
468	T1193	No	-	51
469	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
470	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
471	T1193	No	-	51
472	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
473	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
474	T1193	No	-	51
475	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
476	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
477	T1193	No	-	51
478	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
479	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
480	T1193	No	-	51
481	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
482	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
483	T1193	No	-	51
484	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
485	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
486	T1193	No	-	51
487	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
488	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
489	T1193	No	-	51
490	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
491	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
492	T1193	No	-	51
493	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
494	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
495	T1193	No	-	51
496	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
497	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
498	T1193	No	-	51
499	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
500	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
501	T1193	No	-	51
502	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
503	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
504	T1193	No	-	51
505	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
506	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
507	T1193	No	-	51
508	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
509	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
510	T1193	No	-	51
511	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
512	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
513	T1193	No	-	51
514	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
515	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
516	T1193	No	-	51
517	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
518	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
519	T1193	No	-	51
520	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
521	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
522	T1193	No	-	51
523	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
524	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
525	T1193	No	-	51
526	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
527	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
528	T1193	No	-	51
529	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
530	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
531	T1193	No	-	51
532	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
533	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
534	T1193	No	-	51
535	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
536	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
537	T1193	No	-	51
538	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
539	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
540	T1193	No	-	51
541	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
542	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
543	T1193	No	-	51
544	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
545	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
546	T1193	No	-	51
547	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
548	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
549	T1193	No	-	51
550	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
551	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
552	T1193	No	-	51
553	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
554	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
555	T1193	No	-	51
556	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
557	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
558	T1193	No	-	51
559	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
560	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
561	T1193	No	-	51
562	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
563	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
564	T1193	No	-	51
565	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
566	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
567	T1193	No	-	51
568	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
569	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
570	T1193	No	-	51
571	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
572	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
573	T1193	No	-	51
574	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
575	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
576	T1193	No	-	51
577	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
578	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
579	T1193	No	-	51
580	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
581	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
582	T1193	No	-	51
583	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
584	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
585	T1193	No	-	51
586	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
587	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
588	T1193	No	-	51
589	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
590	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
591	T1193	No	-	51
592	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
593	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
594	T1193	No	-	51
595	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
596	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
597	T1193	No	-	51
598	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
599	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
600	T1193	No	-	51
601	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
602	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
603	T1193	No	-	51
604	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
605	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
606	T1193	No	-	51
607	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
608	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
609	T1193	No	-	51
610	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
611	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
612	T1193	No	-	51
613	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
614	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
615	T1193	No	-	51
616	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
617	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
618	T1193	No	-	51
619	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
620	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
621	T1193	No	-	51
622	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
623	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
624	T1193	No	-	51
625	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
626	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
627	T1193	No	-	51
628	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
629	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
630	T1193	No	-	51
631	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
632	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
633	T1193	No	-	51
634	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
635	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
636	T1193	No	-	51
637	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
638	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
639	T1193	No	-	51
640	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
641	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
642	T1193	No	-	51
643	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
644	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
645	T1193	No	-	51
646	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
647	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
648	T1193	No	-	51
649	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
650	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
651	T1193	No	-	51
652	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
653	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
654	T1193	No	-	51
655	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
656	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
657	T1193	No	-	51
658	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
659	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
660	T1193	No	-	51
661	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
662	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
663	T1193	No	-	51
664	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
665	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
666	T1193	No	-	51
667	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
668	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
669	T1193	No	-	51
670	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
671	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
672	T1193	No	-	51
673	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
674	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
675	T1193	No	-	51
676	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
677	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
678	T1193	No	-	51
679	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
680	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
681	T1193	No	-	51
682	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
683	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
684	T1193	No	-	51
685	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
686	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
687	T1193	No	-	51
688	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
689	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
690	T1193	No	-	51
691	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
692	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
693	T1193	No	-	51
694	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
695	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
696	T1193	No	-	51
697	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
698	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
699	T1193	No	-	51
700	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
701	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
702	T1193	No	-	51
703	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
704	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
705	T1193	No	-	51
706	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
707	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
708	T1193	No	-	51
709	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
710	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
711	T1193	No	-	51
712	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
713	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
714	T1193	No	-	51
715	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
716	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
717	T1193	No	-	51
718	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
719	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
720	T1193	No	-	51
721	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
722	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
723	T1193	No	-	51
724	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
725	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
726	T1193	No	-	51
727	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
728	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
729	T1193	No	-	51
730	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
731	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
732	T1193	No	-	51
733	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
734	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
735	T1193	No	-	51
736	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
737	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
738	T1193	No	-	51
739	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
740	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
741	T1193	No	-	51
742	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
743	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
744	T1193	No	-	51
745	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
746	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
747	T1193	No	-	51
748	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
749	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
750	T1193	No	-	51
751	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
752	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
753	T1193	No	-	51
754	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
755	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
756	T1193	No	-	51
757	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
758	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
759	T1193	No	-	51
760	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
761	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
762	T1193	No	-	51
763	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
764	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
765	T1193	No	-	51
766	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
767	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
768	T1193	No	-	51
769	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
770	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
771	T1193	No	-	51
772	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
773	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
774	T1193	No	-	51
775	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
776	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
777	T1193	No	-	51
778	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
779	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
780	T1193	No	-	51
781	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
782	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
783	T1193	No	-	51
784	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
785	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
786	T1193	No	-	51
787	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
788	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
789	T1193	No	-	51
790	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
791	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
792	T1193	No	-	51
793	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
794	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
795	T1193	No	-	51
796	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
797	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
798	T1193	No	-	51
799	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
800	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
801	T1193	No	-	51
802	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
803	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
804	T1193	No	-	51
805	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
806	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
807	T1193	No	-	51
808	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
809	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
810	T1193	No	-	51
811	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
812	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
813	T1193	No	-	51
814	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
815	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
816	T1193	No	-	51
817	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
818	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
819	T1193	No	-	51
820	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
821	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
822	T1193	No	-	51
823	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
824	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
825	T1193	No	-	51
826	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
827	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
828	T1193	No	-	51
829	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
830	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
831	T1193	No	-	51
832	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
833	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
834	T1193	No	-	51
835	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
836	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
837	T1193	No	-	51
838	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
839	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
840	T1193	No	-	51
841	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
842	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
843	T1193	No	-	51
844	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
845	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
846	T1193	No	-	51
847	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
848	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
849	T1193	No	-	51
850	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
851	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
852	T1193	No	-	51
853	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
854	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
855	T1193	No	-	51
856	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
857	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
858	T1193	No	-	51
859	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
860	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
861	T1193	No	-	51
862	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
863	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
864	T1193	No	-	51
865	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
866	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
867	T1193	No	-	51
868	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
869	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
870	T1193	No	-	51
871	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
872	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
873	T1193	No	-	51
874	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
875	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
876	T1193	No	-	51
877	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
878	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
879	T1193	No	-	51
880	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
881	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
882	T1193	No	-	51
883	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
884	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
885	T1193	No	-	51
886	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
887	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
888	T1193	No	-	51
889	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
890	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
891	T1193	No	-	51
892	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
893	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
894	T1193	No	-	51
895	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
896	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
897	T1193	No	-	51
898	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
899	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
900	T1193	No	-	51
901	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
902	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
903	T1193	No	-	51
904	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
905	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
906	T1193	No	-	51
907	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
908	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
909	T1193	No	-	51
910	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
911	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
912	T1193	No	-	51
913	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
914	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
915	T1193	No	-	51
916	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
917	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
918	T1193	No	-	51
919	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
920	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
921	T1193	No	-	51
922	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
923	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
924	T1193	No	-	51
925	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
926	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
927	T1193	No	-	51
928	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
929	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
930	T1193	No	-	51
931	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
932	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
933	T1193	No	-	51
934	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
935	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
936	T1193	No	-	51
937	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
938	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
939	T1193	No	-	51
940	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
941	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
942	T1193	No	-	51
943	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
944	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
945	T1193	No	-	51
946	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
947	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
948	T1193	No	-	51
949	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
950	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
951	T1193	No	-	51
952	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
953	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
954	T1193	No	-	51
955	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
956	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
957	T1193	No	-	51
958	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
959	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
960	T1193	No	-	51
961	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
962	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
963	T1193	No	-	51
964	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
965	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
966	T1193	No	-	51
967	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
968	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
969	T1193	No	-	51
970	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
971	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
972	T1193	No	-	51
973	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
974	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
975	T1193	No	-	51
976	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
977	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
978	T1193	No	-	51
979	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
980	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
981	T1193	No	-	51
982	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
983	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
984	T1193	No	-	51
985	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
986	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
987	T1193	No	-	51
988	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
989	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
990	T1193	No	-	51
991	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
992	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
993	T1193	No	-	51
994	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
995	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
996	T1193	No	-	51
997	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
998	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
999	T1193	No	-	51
1000	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1001	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1002	T1193	No	-	51
1003	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1004	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1005	T1193	No	-	51
1006	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1007	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1008	T1193	No	-	51
1009	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1010	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1011	T1193	No	-	51
1012	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1013	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1014	T1193	No	-	51
1015	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1016	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1017	T1193	No	-	51
1018	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1019	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1020	T1193	No	-	51
1021	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1022	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1023	T1193	No	-	51
1024	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1025	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1026	T1193	No	-	51
1027	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1028	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1029	T1193	No	-	51
1030	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1031	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1032	T1193	No	-	51
1033	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1034	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1035	T1193	No	-	51
1036	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1037	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1038	T1193	No	-	51
1039	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1040	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1041	T1193	No	-	51
1042	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1043	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1044	T1193	No	-	51
1045	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1046	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1047	T1193	No	-	51
1048	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1049	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1050	T1193	No	-	51
1051	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1052	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1053	T1193	No	-	51
1054	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1055	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1056	T1193	No	-	51
1057	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1058	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1059	T1193	No	-	51
1060	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1061	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1062	T1193	No	-	51
1063	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1064	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1065	T1193	No	-	51
1066	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1067	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1068	T1193	No	-	51
1069	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1070	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1071	T1193	No	-	51
1072	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1073	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1074	T1193	No	-	51
1075	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1076	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1077	T1193	No	-	51
1078	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1079	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1080	T1193	No	-	51
1081	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1082	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1083	T1193	No	-	51
1084	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1085	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1086	T1193	No	-	51
1087	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	49
1088	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	49
1089	T1193	No	-	51
1090	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1091	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1092	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1093	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1094	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1095	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1096	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1097	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1098	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1099	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1100	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1101	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1102	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1103	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1104	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1105	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1106	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1107	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1108	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1109	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1110	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1111	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1112	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1113	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1114	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1115	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1116	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1117	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1118	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1119	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1120	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1121	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1122	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1123	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1124	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1125	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1126	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1127	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1128	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1129	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1130	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1131	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1132	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1133	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1134	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1135	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1136	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1137	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1138	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1139	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1140	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1141	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1142	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1143	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1144	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1145	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1146	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1147	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1148	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1149	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1150	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1151	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1152	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1153	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1154	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1155	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1156	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1157	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1158	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1159	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1160	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1161	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1162	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1163	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1164	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1165	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1166	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1167	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1168	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1169	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1170	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1171	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1172	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1173	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1174	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1175	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1176	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1177	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1178	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1179	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1180	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1181	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1182	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1183	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1184	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1185	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1186	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1187	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1188	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1189	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1190	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1191	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1192	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1193	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1194	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1195	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1196	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1197	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1198	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1199	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1200	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1201	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1202	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1203	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1204	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1205	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1206	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1207	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1208	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1209	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1210	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1211	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1212	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1213	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1214	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1215	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1216	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1217	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1218	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1219	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1220	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1221	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1222	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1223	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1224	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1225	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1226	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1227	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1228	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1229	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1230	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1231	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1232	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1233	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1234	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1235	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1236	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1237	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1238	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1239	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1240	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1241	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1242	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1243	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1244	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1245	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1246	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1247	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1248	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1249	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1250	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1251	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1252	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1253	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1254	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1255	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1256	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1257	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1258	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1259	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1260	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1261	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1262	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1263	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1264	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1265	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1266	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1267	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1268	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1269	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1270	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1271	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1272	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1273	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1274	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1275	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1276	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1277	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1278	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1279	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1280	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1281	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1282	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1283	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1284	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1285	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1286	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1287	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1288	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1289	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1290	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1291	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1292	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1293	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1294	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1295	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1296	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1297	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1298	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1299	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1300	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1301	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1302	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1303	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1304	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1305	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1306	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1307	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1308	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1309	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1310	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1311	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1312	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1313	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1314	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1315	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1316	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1317	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1318	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1319	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1320	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1321	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1322	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1323	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1324	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1325	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1326	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1327	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1328	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1329	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1330	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1331	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1332	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1333	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1334	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1335	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1336	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1337	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1338	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1339	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1340	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1341	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1342	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1343	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1344	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1345	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1346	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1347	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1348	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1349	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1350	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1351	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1352	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1353	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1354	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1355	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1356	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1357	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1358	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1359	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1360	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1361	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	49
1362	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1363	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1364	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1365	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1366	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1367	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1368	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1369	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1370	T1086	No	-	44
1371	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1372	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1373	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1374	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1375	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1376	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1377	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1378	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1379	T1086	No	-	44
1380	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1381	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1382	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1383	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1384	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1385	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1386	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1387	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1388	T1086	No	-	44
1389	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1390	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1391	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1392	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1393	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1394	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1395	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1396	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1397	T1086	No	-	44
1398	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1399	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1400	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1401	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1402	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1403	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1404	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1405	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1406	T1086	No	-	44
1407	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1408	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1409	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1410	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1411	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1412	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1413	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1414	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1415	T1086	No	-	44
1416	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1417	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1418	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1419	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1420	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1421	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1422	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1423	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1424	T1086	No	-	44
1425	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1426	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1427	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1428	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1429	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1430	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1431	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1432	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1433	T1086	No	-	44
1434	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1435	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1436	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1437	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1438	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1439	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1440	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1441	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1442	T1086	No	-	44
1443	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1444	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1445	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1446	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1447	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1448	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1449	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1450	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1451	T1086	No	-	44
1452	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1453	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1454	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1455	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1456	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1457	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1458	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1459	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1460	T1086	No	-	44
1461	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1462	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1463	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1464	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1465	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1466	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1467	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1468	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1469	T1086	No	-	44
1470	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1471	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1472	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1473	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1474	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1475	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1476	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1477	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1478	T1086	No	-	44
1479	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1480	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1481	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1482	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1483	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1484	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1485	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1486	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1487	T1086	No	-	44
1488	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1489	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1490	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1491	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1492	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1493	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1494	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1495	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1496	T1086	No	-	44
1497	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1498	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1499	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1500	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1501	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1502	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1503	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1504	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1505	T1086	No	-	44
1506	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1507	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1508	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1509	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1510	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1511	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1512	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1513	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1514	T1086	No	-	44
1515	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1516	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1517	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1518	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1519	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1520	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1521	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1522	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1523	T1086	No	-	44
1524	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1525	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1526	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1527	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1528	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1529	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1530	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1531	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1532	T1086	No	-	44
1533	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1534	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1535	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1536	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1537	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1538	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1539	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1540	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1541	T1086	No	-	44
1542	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1543	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1544	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1545	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1546	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1547	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1548	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1549	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1550	T1086	No	-	44
1551	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1552	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1553	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1554	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1555	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1556	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1557	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1558	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1559	T1086	No	-	44
1560	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1561	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1562	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1563	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1564	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1565	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1566	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1567	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1568	T1086	No	-	44
1569	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1570	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1571	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1572	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1573	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1574	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1575	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1576	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1577	T1086	No	-	44
1578	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1579	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1580	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1581	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1582	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1583	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1584	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1585	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1586	T1086	No	-	44
1587	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1588	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1589	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1590	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1591	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1592	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1593	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1594	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1595	T1086	No	-	44
1596	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1597	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1598	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1599	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1600	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1601	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1602	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1603	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1604	T1086	No	-	44
1605	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1606	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1607	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1608	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1609	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1610	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1611	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1612	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1613	T1086	No	-	44
1614	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1615	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1616	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1617	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1618	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1619	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1620	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1621	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1622	T1086	No	-	44
1623	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1624	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1625	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1626	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1627	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1628	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1629	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1630	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1631	T1086	No	-	44
1632	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1633	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1634	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1635	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1636	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1637	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1638	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1639	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1640	T1086	No	-	44
1641	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1642	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1643	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1644	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1645	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1646	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1647	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1648	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1649	T1086	No	-	44
1650	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1651	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1652	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1653	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1654	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1655	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1656	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1657	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1658	T1086	No	-	44
1659	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1660	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1661	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1662	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1663	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1664	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1665	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1666	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1667	T1086	No	-	44
1668	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1669	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1670	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1671	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1672	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1673	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1674	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1675	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1676	T1086	No	-	44
1677	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1678	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1679	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1680	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1681	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1682	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1683	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1684	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1685	T1086	No	-	44
1686	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1687	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1688	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1689	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1690	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1691	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1692	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1693	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1694	T1086	No	-	44
1695	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1696	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1697	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1698	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1699	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1700	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1701	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1702	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1703	T1086	No	-	44
1704	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1705	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1706	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1707	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1708	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1709	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1710	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1711	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1712	T1086	No	-	44
1713	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1714	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1715	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1716	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1717	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1718	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1719	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1720	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1721	T1086	No	-	44
1722	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1723	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1724	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1725	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1726	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1727	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1728	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1729	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1730	T1086	No	-	44
1731	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1732	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1733	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1734	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1735	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1736	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1737	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1738	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1739	T1086	No	-	44
1740	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1741	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1742	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1743	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1744	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1745	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1746	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1747	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1748	T1086	No	-	44
1749	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1750	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1751	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1752	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1753	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1754	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1755	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1756	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1757	T1086	No	-	44
1758	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1759	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1760	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1761	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1762	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1763	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1764	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1765	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1766	T1086	No	-	44
1767	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1768	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1769	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1770	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1771	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1772	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1773	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1774	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1775	T1086	No	-	44
1776	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1777	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1778	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1779	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1780	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1781	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1782	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1783	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1784	T1086	No	-	44
1785	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1786	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1787	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1788	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1789	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1790	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1791	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1792	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1793	T1086	No	-	44
1794	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1795	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1796	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1797	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1798	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1799	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1800	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1801	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1802	T1086	No	-	44
1803	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1804	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1805	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1806	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1807	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1808	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1809	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1810	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1811	T1086	No	-	44
1812	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1813	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1814	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1815	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1816	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1817	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1818	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1819	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1820	T1086	No	-	44
1821	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1822	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1823	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1824	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1825	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1826	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1827	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1828	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1829	T1086	No	-	44
1830	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1831	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1832	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1833	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1834	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1835	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1836	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1837	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1838	T1086	No	-	44
1839	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1840	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1841	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1842	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1843	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1844	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1845	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1846	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1847	T1086	No	-	44
1848	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1849	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1850	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1851	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1852	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1853	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1854	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1855	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1856	T1086	No	-	44
1857	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1858	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1859	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1860	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1861	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1862	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1863	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1864	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1865	T1086	No	-	44
1866	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1867	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1868	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1869	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1870	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1871	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1872	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1873	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1874	T1086	No	-	44
1875	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1876	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1877	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1878	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1879	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1880	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1881	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1882	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1883	T1086	No	-	44
1884	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1885	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1886	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1887	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1888	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1889	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1890	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1891	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1892	T1086	No	-	44
1893	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1894	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1895	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1896	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1897	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1898	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1899	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1900	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1901	T1086	No	-	44
1902	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1903	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1904	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1905	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1906	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1907	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1908	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1909	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1910	T1086	No	-	44
1911	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1912	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1913	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1914	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1915	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1916	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1917	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1918	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1919	T1086	No	-	44
1920	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1921	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1922	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1923	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1924	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1925	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1926	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1927	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1928	T1086	No	-	44
1929	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1930	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1931	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1932	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1933	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1934	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1935	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1936	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1937	T1086	No	-	44
1938	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1939	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1940	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1941	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1942	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1943	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1944	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1945	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1946	T1086	No	-	44
1947	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1948	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1949	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1950	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1951	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1952	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1953	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1954	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1955	T1086	No	-	44
1956	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1957	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1958	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1959	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1960	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1961	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1962	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1963	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1964	T1086	No	-	44
1965	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1966	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1967	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1968	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1969	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1970	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1971	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1972	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1973	T1086	No	-	44
1974	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1975	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1976	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1977	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1978	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1979	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1980	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1981	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1982	T1086	No	-	44
1983	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1984	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1985	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1986	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1987	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1988	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1989	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1990	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
1991	T1086	No	-	44
1992	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
1993	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
1994	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
1995	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
1996	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
1997	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
1998	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
1999	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2000	T1086	No	-	44
2001	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2002	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2003	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2004	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2005	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2006	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2007	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2008	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2009	T1086	No	-	44
2010	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2011	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2012	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2013	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2014	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2015	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2016	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2017	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2018	T1086	No	-	44
2019	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2020	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2021	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2022	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2023	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2024	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2025	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2026	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2027	T1086	No	-	44
2028	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2029	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2030	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2031	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2032	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2033	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2034	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2035	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2036	T1086	No	-	44
2037	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2038	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2039	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2040	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2041	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2042	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2043	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2044	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2045	T1086	No	-	44
2046	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2047	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2048	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2049	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2050	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2051	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2052	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2053	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2054	T1086	No	-	44
2055	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2056	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2057	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2058	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2059	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2060	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2061	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2062	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2063	T1086	No	-	44
2064	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2065	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2066	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2067	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2068	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2069	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2070	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2071	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2072	T1086	No	-	44
2073	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2074	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2075	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2076	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2077	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2078	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2079	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2080	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2081	T1086	No	-	44
2082	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2083	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2084	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2085	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2086	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2087	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2088	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2089	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2090	T1086	No	-	44
2091	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2092	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2093	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2094	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2095	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2096	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2097	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2098	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2099	T1086	No	-	44
2100	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2101	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2102	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2103	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2104	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2105	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2106	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2107	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2108	T1086	No	-	44
2109	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2110	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2111	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2112	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2113	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2114	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2115	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2116	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2117	T1086	No	-	44
2118	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2119	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2120	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2121	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2122	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2123	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2124	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2125	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2126	T1086	No	-	44
2127	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2128	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2129	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2130	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2131	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2132	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2133	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2134	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2135	T1086	No	-	44
2136	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2137	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2138	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2139	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2140	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2141	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2142	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2143	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2144	T1086	No	-	44
2145	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2146	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2147	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2148	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2149	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2150	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2151	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2152	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2153	T1086	No	-	44
2154	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2155	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2156	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2157	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2158	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2159	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2160	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2161	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2162	T1086	No	-	44
2163	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2164	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2165	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2166	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2167	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2168	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2169	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2170	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2171	T1086	No	-	44
2172	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2173	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2174	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2175	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2176	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2177	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2178	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2179	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2180	T1086	No	-	44
2181	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2182	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2183	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2184	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2185	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2186	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2187	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2188	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2189	T1086	No	-	44
2190	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2191	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2192	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2193	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2194	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2195	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2196	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2197	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2198	T1086	No	-	44
2199	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2200	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2201	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2202	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2203	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2204	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2205	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2206	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2207	T1086	No	-	44
2208	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2209	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2210	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2211	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2212	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2213	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2214	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2215	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2216	T1086	No	-	44
2217	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2218	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2219	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2220	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2221	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2222	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2223	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2224	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2225	T1086	No	-	44
2226	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2227	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2228	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2229	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2230	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2231	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2232	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2233	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2234	T1086	No	-	44
2235	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2236	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2237	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2238	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2239	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2240	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2241	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2242	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2243	T1086	No	-	44
2244	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2245	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2246	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2247	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2248	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2249	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2250	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2251	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2252	T1086	No	-	44
2253	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2254	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2255	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2256	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2257	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2258	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2259	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2260	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2261	T1086	No	-	44
2262	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2263	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2264	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2265	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2266	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2267	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2268	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2269	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2270	T1086	No	-	44
2271	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2272	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2273	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2274	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2275	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2276	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2277	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2278	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2279	T1086	No	-	44
2280	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2281	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2282	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2283	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2284	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2285	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2286	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2287	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2288	T1086	No	-	44
2289	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2290	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2291	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2292	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2293	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2294	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2295	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2296	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2297	T1086	No	-	44
2298	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2299	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2300	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2301	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2302	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2303	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2304	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2305	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2306	T1086	No	-	44
2307	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2308	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2309	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2310	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2311	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2312	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2313	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2314	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2315	T1086	No	-	44
2316	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2317	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2318	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2319	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2320	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2321	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2322	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2323	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2324	T1086	No	-	44
2325	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2326	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2327	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2328	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2329	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2330	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2331	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2332	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2333	T1086	No	-	44
2334	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2335	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2336	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2337	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2338	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2339	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2340	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2341	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2342	T1086	No	-	44
2343	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2344	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2345	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2346	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2347	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2348	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2349	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2350	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2351	T1086	No	-	44
2352	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2353	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2354	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2355	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2356	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2357	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2358	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2359	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2360	T1086	No	-	44
2361	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2362	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2363	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2364	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2365	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2366	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2367	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2368	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2369	T1086	No	-	44
2370	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2371	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2372	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2373	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2374	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2375	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2376	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2377	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2378	T1086	No	-	44
2379	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2380	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2381	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2382	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2383	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2384	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2385	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2386	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2387	T1086	No	-	44
2388	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2389	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2390	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2391	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2392	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2393	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2394	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2395	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2396	T1086	No	-	44
2397	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2398	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2399	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2400	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2401	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2402	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2403	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2404	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2405	T1086	No	-	44
2406	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2407	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2408	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2409	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2410	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2411	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2412	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2413	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2414	T1086	No	-	44
2415	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2416	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2417	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2418	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2419	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2420	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2421	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2422	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2423	T1086	No	-	44
2424	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2425	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2426	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2427	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2428	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2429	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2430	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2431	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2432	T1086	No	-	44
2433	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2434	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2435	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2436	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2437	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2438	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2439	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2440	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2441	T1086	No	-	44
2442	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2443	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2444	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2445	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2446	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2447	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2448	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2449	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2450	T1086	No	-	44
2451	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2452	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2453	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2454	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2455	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2456	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2457	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2458	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2459	T1086	No	-	44
2460	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2461	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2462	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2463	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2464	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2465	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2466	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2467	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2468	T1086	No	-	44
2469	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2470	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2471	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2472	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2473	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2474	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2475	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2476	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2477	T1086	No	-	44
2478	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2479	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2480	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2481	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2482	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2483	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2484	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2485	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2486	T1086	No	-	44
2487	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2488	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2489	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2490	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2491	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36
2492	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	36
2493	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	36
2494	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	36
2495	T1086	No	-	44
2496	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	36
2497	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	36
2498	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	36
2499	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	36
2500	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	36

The file is too large to be shown. View Raw