splunk-security_content/dist/devsecops/lookups/uncommon_processes_default.csv

1	process_name	uncommon_default	category_default	analytic_story_default	kill_chain_phase_default	mitre_attack_default
2	sethc.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution|Accessibility Features
3	utilman.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution|Accessibility Features
4	osk.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution|Accessibility Features
5	magnify.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution|Accessibility Features
6	narrator.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution|Accessibility Features
7	displayswitch.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution|Accessibility Features
8	atbroker.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution|Accessibility Features
9	quser.exe	true		DHS Report TA18-074A|Unusual Processes	Actions on Objectives	Execution