splunk-security_content/docs/mitre-map/coverage.csv

1	Technique ID	Detection Available	Link	score
2	T1568.001	No	-	0
3	T1218.010	No	-	0
4	T1213	No	-	0
5	T1519	No	-	0
6	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
7	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
8	T1027.002	No	-	0
9	T1020	No	-	0
10	T1158	No	-	0
11	T1164	No	-	0
12	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	4
13	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	4
14	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	4
15	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	4
16	T1201	No	-	0
17	T1578.003	No	-	0
18	T1049	No	-	0
19	T1547.011	No	-	0
20	T1185	No	-	0
21	T1564.005	No	-	0
22	T1119	No	-	0
23	T1037	No	-	0
24	T1055.005	No	-	0
25	T1199	No	-	0
26	T1547.003	No	-	0
27	T1069.003	No	-	0
28	T1537	No	-	0
29	T1192	No	-	0
30	T1146	No	-	0
31	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
32	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
33	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
34	T1069	No	-	0
35	T1044	No	-	0
36	T1505	No	-	0
37	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
38	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
39	T1542.001	No	-	0
40	T1514	No	-	0
41	T1552	No	-	0
42	T1052	No	-	0
43	T1556.003	No	-	0
44	T1563.001	No	-	0
45	T1499.002	No	-	0
46	T1574	No	-	1
47	T1563	No	-	0
48	T1055.014	No	-	0
49	T1134.005	No	-	0
50	T1558	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	2
51	T1542.002	No	-	0
52	T1077	No	-	0
53	T1121	No	-	0
54	T1059.006	No	-	0
55	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml	2
56	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
57	T1574.002	No	-	0
58	T1079	No	-	0
59	T1213.001	No	-	0
60	T1504	No	-	0
61	T1090.001	No	-	0
62	T1083	No	-	0
63	T1552.001	No	-	0
64	T1134	No	-	0
65	T1144	No	-	0
66	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
67	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
68	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	3
69	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	3
70	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	3
71	T1120	No	-	0
72	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
73	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
74	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	3
75	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	3
76	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	3
77	T1550	No	-	1
78	T1547.004	No	-	0
79	T1218.003	No	-	0
80	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
81	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
82	T1059.004	No	-	0
83	T1011.001	No	-	0
84	T1100	No	-	0
85	T1054	No	-	0
86	T1021	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	7
87	T1564	No	-	0
88	T1547.009	No	-	0
89	T1022	No	-	0
90	T1102.001	No	-	0
91	T1105	No	-	0
92	T1559.001	No	-	0
93	T1036.001	No	-	0
94	T1070.004	No	-	0
95	T1578.004	No	-	0
96	T1572	No	-	0
97	T1546.009	No	-	0
98	T1518	No	-	0
99	T1501	No	-	0
100	T1053.002	No	-	0
101	T1548.002	No	-	0
102	T1212	No	-	0
103	T1065	No	-	0
104	T1546.003	No	-	0
105	T1175	No	-	0
106	T1552.004	No	-	0
107	T1223	No	-	0
108	T1574.008	No	-	0
109	T1015	No	-	0
110	T1567.002	No	-	0
111	T1218.002	No	-	0
112	T1023	No	-	0
113	T1183	No	-	0
114	T1125	No	-	0
115	T1200	No	-	0
116	T1108	No	-	0
117	T1578.001	No	-	0
118	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
119	T1573.002	No	-	0
120	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	7
121	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	7
122	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	7
123	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	7
124	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	7
125	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml	7
126	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	7
127	T1147	No	-	0
128	T1004	No	-	0
129	T1205	No	-	0
130	T1552.006	No	-	0
131	T1104	No	-	0
132	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
133	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
134	T1056	No	-	0
135	T1219	No	-	0
136	T1567.001	No	-	0
137	T1566.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	1
138	T1036.002	No	-	0
139	T1046	No	-	0
140	T1115	No	-	0
141	T1554	No	-	0
142	T1546.002	No	-	0
143	T1565.001	No	-	0
144	T1502	No	-	0
145	T1211	No	-	0
146	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	1
147	T1080	No	-	0
148	T1560.003	No	-	0
149	T1180	No	-	0
150	T1070.005	No	-	0
151	T1542.003	No	-	0
152	T1555.001	No	-	0
153	T1052.001	No	-	0
154	T1056.004	No	-	0
155	T1094	No	-	0
156	T1001.003	No	-	0
157	T1076	No	-	0
158	T1215	No	-	0
159	T1218.007	No	-	0
160	T1178	No	-	0
161	T1171	No	-	0
162	T1140	No	-	0
163	T1025	No	-	0
164	T1136.003	No	-	0
165	T1547.007	No	-	0
166	T1552.003	No	-	0
167	T1213.002	No	-	0
168	T1001.001	No	-	0
169	T1195.002	No	-	0
170	T1053	No	-	4
171	T1209	No	-	0
172	T1069.001	No	-	0
173	T1193	No	-	0
174	T1179	No	-	0
175	T1098.003	No	-	0
176	T1505.002	No	-	0
177	T1059.002	No	-	0
178	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	4
179	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	4
180	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	4
181	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	4
182	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
183	T1563.002	No	-	0
184	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
185	T1099	No	-	0
186	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
187	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
188	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
189	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
190	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
191	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
192	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
193	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
194	T1195.001	No	-	0
195	T1497.001	No	-	0
196	T1536	No	-	0
197	T1058	No	-	0
198	T1005	No	-	0
199	T1148	No	-	0
200	T1038	No	-	0
201	T1552.002	No	-	0
202	T1218.005	No	-	0
203	T1486	No	-	0
204	T1003.008	No	-	0
205	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	21
206	T1053.001	No	-	0
207	T1557.001	No	-	0
208	T1500	No	-	0
209	T1170	No	-	0
210	T1166	No	-	0
211	T1051	No	-	0
212	T1498.001	No	-	0
213	T1210	No	-	0
214	T1074.002	No	-	0
215	T1202	No	-	0
216	T1495	No	-	0
217	T1561.002	No	-	0
218	T1102.003	No	-	0
219	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
220	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	2
221	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	2
222	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	1
223	T1087.001	No	-	0
224	T1218.008	No	-	0
225	T1547.005	No	-	0
226	T1040	No	-	0
227	T1153	No	-	0
228	T1087.003	No	-	0
229	T1071	No	-	10
230	T1129	No	-	0
231	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
232	T1155	No	-	0
233	T1085	No	-	0
234	T1177	No	-	0
235	T1021.004	No	-	0
236	T1042	No	-	0
237	T1090.003	No	-	0
238	T1134.004	No	-	0
239	T1053.004	No	-	0
240	T1221	No	-	0
241	T1557	No	-	0
242	T1003.007	No	-	0
243	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
244	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
245	T1555.003	No	-	0
246	T1132.002	No	-	0
247	T1113	No	-	0
248	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	2
249	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	2
250	T1546.008	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	1
251	T1208	No	-	0
252	T1499	No	-	0
253	T1561	No	-	0
254	T1497.003	No	-	0
255	T1009	No	-	0
256	T1496	No	-	0
257	T1216.001	No	-	0
258	T1011	No	-	0
259	T1548.004	No	-	0
260	T1127	No	-	0
261	T1562.006	No	-	0
262	T1124	No	-	0
263	T1126	No	-	0
264	T1055.004	No	-	0
265	T1098.002	No	-	0
266	T1505.003	No	-	0
267	T1031	No	-	0
268	T1574.007	No	-	0
269	T1137.002	No	-	0
270	T1491.002	No	-	0
271	T1548.003	No	-	0
272	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
273	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
274	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
275	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
276	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
277	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
278	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
279	T1021.003	No	-	0
280	T1048.002	No	-	0
281	T1196	No	-	0
282	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
283	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
284	T1169	No	-	0
285	T1128	No	-	0
286	T1548.001	No	-	0
287	T1172	No	-	0
288	T1149	No	-	0
289	T1543	No	-	1
290	T1498.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml	1
291	T1182	No	-	0
292	T1547	No	-	3
293	T1059	No	-	15
294	T1093	No	-	0
295	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
296	T1037.002	No	-	0
297	T1098	No	-	0
298	T1527	No	-	0
299	T1220	No	-	0
300	T1034	No	-	0
301	T1141	No	-	0
302	T1116	No	-	0
303	T1003.005	No	-	0
304	T1041	No	-	0
305	T1055.002	No	-	0
306	T1522	No	-	0
307	T1074.001	No	-	0
308	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
309	T1111	No	-	0
310	T1546.005	No	-	0
311	T1050	No	-	0
312	T1574.001	No	-	0
313	T1055.011	No	-	0
314	T1184	No	-	0
315	T1074	No	-	0
316	T1542	No	-	0
317	T1073	No	-	0
318	T1092	No	-	0
319	T1014	No	-	0
320	T1189	No	-	0
321	T1137.006	No	-	0
322	T1075	No	-	0
323	T1087.002	No	-	0
324	T1134.003	No	-	0
325	T1222.002	No	-	0
326	T1562.002	No	-	0
327	T1548	No	-	0
328	T1035	No	-	0
329	T1555	No	-	0
330	T1561.001	No	-	0
331	T1098.004	No	-	0
332	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
333	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
334	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
335	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
336	T1017	No	-	0
337	T1205.001	No	-	0
338	T1569.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml	1
339	T1565.002	No	-	0
340	T1569	No	-	1
341	T1499.004	No	-	0
342	T1037.005	No	-	0
343	T1553.003	No	-	0
344	T1546.004	No	-	0
345	T1053.003	No	-	0
346	T1560	No	-	0
347	T1181	No	-	0
348	T1565	No	-	0
349	T1131	No	-	0
350	T1558.002	No	-	0
351	T1218.009	No	-	0
352	T1001.002	No	-	0
353	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
354	T1160	No	-	0
355	T1060	No	-	0
356	T1560.001	No	-	0
357	T1489	No	-	0
358	T1207	No	-	0
359	T1204	No	-	1
360	T1553.001	No	-	0
361	T1018	No	-	0
362	T1547.002	No	-	0
363	T1091	No	-	0
364	T1019	No	-	0
365	T1543.001	No	-	0
366	T1555.002	No	-	0
367	T1492	No	-	0
368	T1048	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	3
369	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml	2
370	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml	2
371	T1574.004	No	-	0
372	T1550.003	No	-	0
373	T1480	No	-	0
374	T1161	No	-	0
375	T1558.001	No	-	0
376	T1214	No	-	0
377	T1546.006	No	-	0
378	T1556	No	-	0
379	T1087	No	-	0
380	T1574.005	No	-	0
381	T1506	No	-	0
382	T1564.001	No	-	0
383	T1130	No	-	0
384	T1139	No	-	0
385	T1045	No	-	0
386	T1546.007	No	-	0
387	T1032	No	-	0
388	T1090	No	-	0
389	T1498	No	-	1
390	T1027.005	No	-	0
391	T1543.004	No	-	0
392	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
393	T1566.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	1
394	T1097	No	-	0
395	T1546	No	-	5
396	T1556.002	No	-	0
397	T1176	No	-	0
398	T1562	No	-	3
399	T1187	No	-	0
400	T1070.006	No	-	0
401	T1186	No	-	0
402	T1057	No	-	0
403	T1543.002	No	-	0
404	T1574.010	No	-	0
405	T1028	No	-	0
406	T1010	No	-	0
407	T1565.003	No	-	0
408	T1056.001	No	-	0
409	T1110.003	No	-	0
410	T1109	No	-	0
411	T1142	No	-	0
412	T1154	No	-	0
413	T1547.006	No	-	0
414	T1487	No	-	0
415	T1037.003	No	-	0
416	T1071.003	No	-	0
417	T1027.003	No	-	0
418	T1055.012	No	-	0
419	T1056.003	No	-	0
420	T1090.004	No	-	0
421	T1137	No	-	0
422	T1485	Yes	https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml	1
423	T1110.001	No	-	0
424	T1204.001	No	-	0
425	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
426	T1137.001	No	-	0
427	T1027.004	No	-	0
428	T1106	No	-	0
429	T1036.005	No	-	0
430	T1553.002	No	-	0
431	T1070.003	No	-	0
432	T1218.001	No	-	0
433	T1482	No	-	0
434	T1137.005	No	-	0
435	T1013	No	-	0
436	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml	2
437	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml	2
438	T1123	No	-	0
439	T1021.005	No	-	0
440	T1574.006	No	-	0
441	T1012	No	-	0
442	T1499.003	No	-	0
443	T1218.004	No	-	0
444	T1168	No	-	0
445	T1048.001	No	-	0
446	T1222	No	-	1
447	T1173	No	-	0
448	T1156	No	-	0
449	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
450	T1134.002	No	-	0
451	T1055.003	No	-	0
452	T1480.001	No	-	0
453	T1570	No	-	0
454	T1101	No	-	0
455	T1029	No	-	0
456	T1534	No	-	0
457	T1556.001	No	-	0
458	T1086	No	-	0
459	T1494	No	-	0
460	T1491.001	No	-	0
461	T1056.002	No	-	0
462	T1008	No	-	0
463	T1036.004	No	-	0
464	T1195.003	No	-	0
465	T1055	No	-	0
466	T1568.003	No	-	0
467	T1007	No	-	0
468	T1574.011	No	-	0
469	T1067	No	-	0
470	T1505.001	No	-	0
471	T1206	No	-	0
472	T1062	No	-	0
473	T1152	No	-	0
474	T1564.003	No	-	0
475	T1114.003	No	-	0
476	T1528	No	-	0
477	T1037.001	No	-	0
478	T1198	No	-	0
479	T1064	No	-	0
480	T1145	No	-	0
481	T1059.005	No	-	0
482	T1493	No	-	0
483	T1110.004	No	-	0
484	T1055.008	No	-	0
485	T1568	No	-	0
486	T1081	No	-	0
487	T1055.001	No	-	0
488	T1194	No	-	0
489	T1218.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	1
490	T1546.010	No	-	0
491	T1002	No	-	0
492	T1039	No	-	0
493	T1573.001	No	-	0
494	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml	4
495	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml	4
496	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml	4
497	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml	4
498	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
499	T1550.001	No	-	0
500	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
501	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
502	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
503	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
504	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
505	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
506	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
507	T1538	No	-	0
508	T1191	No	-	0
509	T1001	No	-	0
510	T1150	No	-	0
511	T1098.001	No	-	0
512	T1568.002	No	-	0
513	T1547.008	No	-	0
514	T1133	No	-	0
515	T1559.002	No	-	0
516	T1567	No	-	0
517	T1084	No	-	0
518	T1114	No	-	3
519	T1070.002	No	-	0
520	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
521	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
522	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
523	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8
524	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml	8
525	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml	8
526	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml	8
527	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml	8
528	T1564.002	No	-	0
529	T1484	No	-	0
530	T1055.009	No	-	0
531	T1135	No	-	0
532	T1574.012	No	-	0
533	T1564.004	No	-	0
534	T1163	No	-	0
535	T1562.007	No	-	0
536	T1003.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	1
537	T1090.002	No	-	0
538	T1564.006	No	-	0
539	T1066	No	-	0
540	T1055.013	No	-	0
541	T1491	No	-	0
542	T1546.012	No	-	0
543	T1197	No	-	0
544	T1547.010	No	-	0
545	T1016	No	-	0
546	T1499.001	No	-	0
547	T1573	No	-	0
548	T1127.001	No	-	0
549	T1117	No	-	0
550	T1027.001	No	-	0
551	T1546.014	No	-	0
552	T1162	No	-	0
553	T1559	No	-	0
554	T1503	No	-	0
555	T1195	No	-	0
556	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	6
557	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	6
558	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	6
559	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	6
560	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	6
561	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	6
562	T1122	No	-	0
563	T1560.002	No	-	0
564	T1110.002	No	-	0
565	T1566	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml	5
566	T1059.007	No	-	0
567	T1043	No	-	0
568	T1488	No	-	0
569	T1529	No	-	0
570	T1096	No	-	0
571	T1550.004	No	-	0
572	T1217	No	-	0
573	T1218	No	-	1
574	T1578	No	-	0
575	T1546.015	No	-	0
576	T1006	No	-	0
577	T1137.003	No	-	0
578	T1174	No	-	0
579	T1134.001	No	-	0
580	T1070	Yes	https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml	3
581	T1550.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	1
582	T1030	No	-	0
583	T1137.004	No	-	0
584	T1036.006	No	-	0
585	T1539	No	-	0
586	T1518.001	No	-	0
587	T1061	No	-	0
588	T1151	No	-	0
589	T1578.002	No	-	0
590	T1037.004	No	-	0
591	T1107	No	-	0
592	T1114.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml	1
593	T1103	No	-	0
594	T1490	No	-	0
595	T1483	No	-	0
596	T1088	No	-	0
597	T1159	No	-	0
598	T1165	No	-	0
599	T1132.001	No	-	0
600	T1003.004	No	-	0
601	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	2
602	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	2
603	T1102	No	-	0
604	T1024	No	-	0
605	T1157	No	-	0
606	T1003	No	-	12
607	T1087.004	No	-	0
608	T1552.005	No	-	0
609	T1562.003	No	-	0
610	T1553	No	-	1
611	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml	3
612	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	3
613	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml	3
614	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml	5
615	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml	5
616	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml	5
617	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml	5
618	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml	5
619	T1216	No	-	0
620	T1063	No	-	0
621	T1036.003	No	-	0
622	T1569.001	No	-	0
623	T1118	No	-	0
624	T1571	No	-	0
625	T1069.002	No	-	0
626	T1089	No	-	0
627	T1143	No	-	0
628	T1003.006	No	-	0
629	T1497.002	No	-	0
630	T1188	No	-	0
631	T1110	No	-	0
632	T1531	No	-	0
633	T1138	No	-	0
634	T1132	No	-	0
635	T1546.013	No	-	0
636	T1026	No	-	0
637	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	5
638	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	5
639	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	5
640	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	5
641	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	5
642	T1102.002	No	-	0
643	T1033	No	-	0
644	T1021.006	No	-	0
645	T1497	No	-	0
646	T1167	No	-	0
647	T1136.002	No	-	0
648	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	13
649	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	13
650	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	13
651	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	13
652	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	13
653	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	13
654	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	13
655	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	13
656	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	13
657	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	13
658	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	13
659	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	13
660	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	13
661	T1568.001	No	-	0
662	T1218.010	No	-	0
663	T1213	No	-	0
664	T1519	No	-	0
665	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
666	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
667	T1027.002	No	-	0
668	T1020	No	-	0
669	T1158	No	-	0
670	T1164	No	-	0
671	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	4
672	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	4
673	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	4
674	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	4
675	T1201	No	-	0
676	T1578.003	No	-	0
677	T1049	No	-	0
678	T1547.011	No	-	0
679	T1185	No	-	0
680	T1564.005	No	-	0
681	T1119	No	-	0
682	T1037	No	-	0
683	T1055.005	No	-	0
684	T1199	No	-	0
685	T1547.003	No	-	0
686	T1069.003	No	-	0
687	T1537	No	-	0
688	T1192	No	-	0
689	T1146	No	-	0
690	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
691	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
692	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
693	T1069	No	-	0
694	T1044	No	-	0
695	T1505	No	-	0
696	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
697	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
698	T1542.001	No	-	0
699	T1514	No	-	0
700	T1552	No	-	0
701	T1052	No	-	0
702	T1556.003	No	-	0
703	T1563.001	No	-	0
704	T1499.002	No	-	0
705	T1574	No	-	1
706	T1563	No	-	0
707	T1055.014	No	-	0
708	T1134.005	No	-	0
709	T1558	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	2
710	T1542.002	No	-	0
711	T1077	No	-	0
712	T1121	No	-	0
713	T1059.006	No	-	0
714	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml	2
715	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
716	T1574.002	No	-	0
717	T1079	No	-	0
718	T1213.001	No	-	0
719	T1504	No	-	0
720	T1090.001	No	-	0
721	T1083	No	-	0
722	T1552.001	No	-	0
723	T1134	No	-	0
724	T1144	No	-	0
725	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
726	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
727	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	3
728	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	3
729	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	3
730	T1120	No	-	0
731	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
732	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
733	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	3
734	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	3
735	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	3
736	T1550	No	-	1
737	T1547.004	No	-	0
738	T1218.003	No	-	0
739	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
740	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
741	T1059.004	No	-	0
742	T1011.001	No	-	0
743	T1100	No	-	0
744	T1054	No	-	0
745	T1021	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	7
746	T1564	No	-	0
747	T1547.009	No	-	0
748	T1022	No	-	0
749	T1102.001	No	-	0
750	T1105	No	-	0
751	T1559.001	No	-	0
752	T1036.001	No	-	0
753	T1070.004	No	-	0
754	T1578.004	No	-	0
755	T1572	No	-	0
756	T1546.009	No	-	0
757	T1518	No	-	0
758	T1501	No	-	0
759	T1053.002	No	-	0
760	T1548.002	No	-	0
761	T1212	No	-	0
762	T1065	No	-	0
763	T1546.003	No	-	0
764	T1175	No	-	0
765	T1552.004	No	-	0
766	T1223	No	-	0
767	T1574.008	No	-	0
768	T1015	No	-	0
769	T1567.002	No	-	0
770	T1218.002	No	-	0
771	T1023	No	-	0
772	T1183	No	-	0
773	T1125	No	-	0
774	T1200	No	-	0
775	T1108	No	-	0
776	T1578.001	No	-	0
777	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
778	T1573.002	No	-	0
779	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	7
780	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	7
781	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	7
782	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	7
783	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	7
784	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml	7
785	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	7
786	T1147	No	-	0
787	T1004	No	-	0
788	T1205	No	-	0
789	T1552.006	No	-	0
790	T1104	No	-	0
791	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
792	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
793	T1056	No	-	0
794	T1219	No	-	0
795	T1567.001	No	-	0
796	T1566.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	1
797	T1036.002	No	-	0
798	T1046	No	-	0
799	T1115	No	-	0
800	T1554	No	-	0
801	T1546.002	No	-	0
802	T1565.001	No	-	0
803	T1502	No	-	0
804	T1211	No	-	0
805	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	1
806	T1080	No	-	0
807	T1560.003	No	-	0
808	T1180	No	-	0
809	T1070.005	No	-	0
810	T1542.003	No	-	0
811	T1555.001	No	-	0
812	T1052.001	No	-	0
813	T1056.004	No	-	0
814	T1094	No	-	0
815	T1001.003	No	-	0
816	T1076	No	-	0
817	T1215	No	-	0
818	T1218.007	No	-	0
819	T1178	No	-	0
820	T1171	No	-	0
821	T1140	No	-	0
822	T1025	No	-	0
823	T1136.003	No	-	0
824	T1547.007	No	-	0
825	T1552.003	No	-	0
826	T1213.002	No	-	0
827	T1001.001	No	-	0
828	T1195.002	No	-	0
829	T1053	No	-	4
830	T1209	No	-	0
831	T1069.001	No	-	0
832	T1193	No	-	0
833	T1179	No	-	0
834	T1098.003	No	-	0
835	T1505.002	No	-	0
836	T1059.002	No	-	0
837	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	4
838	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	4
839	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	4
840	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	4
841	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
842	T1563.002	No	-	0
843	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
844	T1099	No	-	0
845	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
846	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
847	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
848	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
849	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
850	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
851	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
852	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
853	T1195.001	No	-	0
854	T1497.001	No	-	0
855	T1536	No	-	0
856	T1058	No	-	0
857	T1005	No	-	0
858	T1148	No	-	0
859	T1038	No	-	0
860	T1552.002	No	-	0
861	T1218.005	No	-	0
862	T1486	No	-	0
863	T1003.008	No	-	0
864	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	21
865	T1053.001	No	-	0
866	T1557.001	No	-	0
867	T1500	No	-	0
868	T1170	No	-	0
869	T1166	No	-	0
870	T1051	No	-	0
871	T1498.001	No	-	0
872	T1210	No	-	0
873	T1074.002	No	-	0
874	T1202	No	-	0
875	T1495	No	-	0
876	T1561.002	No	-	0
877	T1102.003	No	-	0
878	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
879	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	2
880	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	2
881	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	1
882	T1087.001	No	-	0
883	T1218.008	No	-	0
884	T1547.005	No	-	0
885	T1040	No	-	0
886	T1153	No	-	0
887	T1087.003	No	-	0
888	T1071	No	-	10
889	T1129	No	-	0
890	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
891	T1155	No	-	0
892	T1085	No	-	0
893	T1177	No	-	0
894	T1021.004	No	-	0
895	T1042	No	-	0
896	T1090.003	No	-	0
897	T1134.004	No	-	0
898	T1053.004	No	-	0
899	T1221	No	-	0
900	T1557	No	-	0
901	T1003.007	No	-	0
902	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
903	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
904	T1555.003	No	-	0
905	T1132.002	No	-	0
906	T1113	No	-	0
907	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	2
908	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	2
909	T1546.008	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	1
910	T1208	No	-	0
911	T1499	No	-	0
912	T1561	No	-	0
913	T1497.003	No	-	0
914	T1009	No	-	0
915	T1496	No	-	0
916	T1216.001	No	-	0
917	T1011	No	-	0
918	T1548.004	No	-	0
919	T1127	No	-	0
920	T1562.006	No	-	0
921	T1124	No	-	0
922	T1126	No	-	0
923	T1055.004	No	-	0
924	T1098.002	No	-	0
925	T1505.003	No	-	0
926	T1031	No	-	0
927	T1574.007	No	-	0
928	T1137.002	No	-	0
929	T1491.002	No	-	0
930	T1548.003	No	-	0
931	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
932	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
933	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
934	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
935	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
936	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
937	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
938	T1021.003	No	-	0
939	T1048.002	No	-	0
940	T1196	No	-	0
941	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
942	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
943	T1169	No	-	0
944	T1128	No	-	0
945	T1548.001	No	-	0
946	T1172	No	-	0
947	T1149	No	-	0
948	T1543	No	-	1
949	T1498.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml	1
950	T1182	No	-	0
951	T1547	No	-	3
952	T1059	No	-	15
953	T1093	No	-	0
954	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
955	T1037.002	No	-	0
956	T1098	No	-	0
957	T1527	No	-	0
958	T1220	No	-	0
959	T1034	No	-	0
960	T1141	No	-	0
961	T1116	No	-	0
962	T1003.005	No	-	0
963	T1041	No	-	0
964	T1055.002	No	-	0
965	T1522	No	-	0
966	T1074.001	No	-	0
967	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
968	T1111	No	-	0
969	T1546.005	No	-	0
970	T1050	No	-	0
971	T1574.001	No	-	0
972	T1055.011	No	-	0
973	T1184	No	-	0
974	T1074	No	-	0
975	T1542	No	-	0
976	T1073	No	-	0
977	T1092	No	-	0
978	T1014	No	-	0
979	T1189	No	-	0
980	T1137.006	No	-	0
981	T1075	No	-	0
982	T1087.002	No	-	0
983	T1134.003	No	-	0
984	T1222.002	No	-	0
985	T1562.002	No	-	0
986	T1548	No	-	0
987	T1035	No	-	0
988	T1555	No	-	0
989	T1561.001	No	-	0
990	T1098.004	No	-	0
991	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
992	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
993	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
994	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
995	T1017	No	-	0
996	T1205.001	No	-	0
997	T1569.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml	1
998	T1565.002	No	-	0
999	T1569	No	-	1
1000	T1499.004	No	-	0
1001	T1037.005	No	-	0
1002	T1553.003	No	-	0
1003	T1546.004	No	-	0
1004	T1053.003	No	-	0
1005	T1560	No	-	0
1006	T1181	No	-	0
1007	T1565	No	-	0
1008	T1131	No	-	0
1009	T1558.002	No	-	0
1010	T1218.009	No	-	0
1011	T1001.002	No	-	0
1012	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
1013	T1160	No	-	0
1014	T1060	No	-	0
1015	T1560.001	No	-	0
1016	T1489	No	-	0
1017	T1207	No	-	0
1018	T1204	No	-	1
1019	T1553.001	No	-	0
1020	T1018	No	-	0
1021	T1547.002	No	-	0
1022	T1091	No	-	0
1023	T1019	No	-	0
1024	T1543.001	No	-	0
1025	T1555.002	No	-	0
1026	T1492	No	-	0
1027	T1048	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	3
1028	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml	2
1029	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml	2
1030	T1574.004	No	-	0
1031	T1550.003	No	-	0
1032	T1480	No	-	0
1033	T1161	No	-	0
1034	T1558.001	No	-	0
1035	T1214	No	-	0
1036	T1546.006	No	-	0
1037	T1556	No	-	0
1038	T1087	No	-	0
1039	T1574.005	No	-	0
1040	T1506	No	-	0
1041	T1564.001	No	-	0
1042	T1130	No	-	0
1043	T1139	No	-	0
1044	T1045	No	-	0
1045	T1546.007	No	-	0
1046	T1032	No	-	0
1047	T1090	No	-	0
1048	T1498	No	-	1
1049	T1027.005	No	-	0
1050	T1543.004	No	-	0
1051	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
1052	T1566.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	1
1053	T1097	No	-	0
1054	T1546	No	-	5
1055	T1556.002	No	-	0
1056	T1176	No	-	0
1057	T1562	No	-	3
1058	T1187	No	-	0
1059	T1070.006	No	-	0
1060	T1186	No	-	0
1061	T1057	No	-	0
1062	T1543.002	No	-	0
1063	T1574.010	No	-	0
1064	T1028	No	-	0
1065	T1010	No	-	0
1066	T1565.003	No	-	0
1067	T1056.001	No	-	0
1068	T1110.003	No	-	0
1069	T1109	No	-	0
1070	T1142	No	-	0
1071	T1154	No	-	0
1072	T1547.006	No	-	0
1073	T1487	No	-	0
1074	T1037.003	No	-	0
1075	T1071.003	No	-	0
1076	T1027.003	No	-	0
1077	T1055.012	No	-	0
1078	T1056.003	No	-	0
1079	T1090.004	No	-	0
1080	T1137	No	-	0
1081	T1485	Yes	https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml	1
1082	T1110.001	No	-	0
1083	T1204.001	No	-	0
1084	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
1085	T1137.001	No	-	0
1086	T1027.004	No	-	0
1087	T1106	No	-	0
1088	T1036.005	No	-	0
1089	T1553.002	No	-	0
1090	T1070.003	No	-	0
1091	T1218.001	No	-	0
1092	T1482	No	-	0
1093	T1137.005	No	-	0
1094	T1013	No	-	0
1095	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml	2
1096	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml	2
1097	T1123	No	-	0
1098	T1021.005	No	-	0
1099	T1574.006	No	-	0
1100	T1012	No	-	0
1101	T1499.003	No	-	0
1102	T1218.004	No	-	0
1103	T1168	No	-	0
1104	T1048.001	No	-	0
1105	T1222	No	-	1
1106	T1173	No	-	0
1107	T1156	No	-	0
1108	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
1109	T1134.002	No	-	0
1110	T1055.003	No	-	0
1111	T1480.001	No	-	0
1112	T1570	No	-	0
1113	T1101	No	-	0
1114	T1029	No	-	0
1115	T1534	No	-	0
1116	T1556.001	No	-	0
1117	T1086	No	-	0
1118	T1494	No	-	0
1119	T1491.001	No	-	0
1120	T1056.002	No	-	0
1121	T1008	No	-	0
1122	T1036.004	No	-	0
1123	T1195.003	No	-	0
1124	T1055	No	-	0
1125	T1568.003	No	-	0
1126	T1007	No	-	0
1127	T1574.011	No	-	0
1128	T1067	No	-	0
1129	T1505.001	No	-	0
1130	T1206	No	-	0
1131	T1062	No	-	0
1132	T1152	No	-	0
1133	T1564.003	No	-	0
1134	T1114.003	No	-	0
1135	T1528	No	-	0
1136	T1037.001	No	-	0
1137	T1198	No	-	0
1138	T1064	No	-	0
1139	T1145	No	-	0
1140	T1059.005	No	-	0
1141	T1493	No	-	0
1142	T1110.004	No	-	0
1143	T1055.008	No	-	0
1144	T1568	No	-	0
1145	T1081	No	-	0
1146	T1055.001	No	-	0
1147	T1194	No	-	0
1148	T1218.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	1
1149	T1546.010	No	-	0
1150	T1002	No	-	0
1151	T1039	No	-	0
1152	T1573.001	No	-	0
1153	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml	4
1154	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml	4
1155	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml	4
1156	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml	4
1157	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
1158	T1550.001	No	-	0
1159	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
1160	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
1161	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
1162	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
1163	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
1164	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
1165	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
1166	T1538	No	-	0
1167	T1191	No	-	0
1168	T1001	No	-	0
1169	T1150	No	-	0
1170	T1098.001	No	-	0
1171	T1568.002	No	-	0
1172	T1547.008	No	-	0
1173	T1133	No	-	0
1174	T1559.002	No	-	0
1175	T1567	No	-	0
1176	T1084	No	-	0
1177	T1114	No	-	3
1178	T1070.002	No	-	0
1179	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
1180	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
1181	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
1182	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8
1183	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml	8
1184	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml	8
1185	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml	8
1186	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml	8
1187	T1564.002	No	-	0
1188	T1484	No	-	0
1189	T1055.009	No	-	0
1190	T1135	No	-	0
1191	T1574.012	No	-	0
1192	T1564.004	No	-	0
1193	T1163	No	-	0
1194	T1562.007	No	-	0
1195	T1003.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	1
1196	T1090.002	No	-	0
1197	T1564.006	No	-	0
1198	T1066	No	-	0
1199	T1055.013	No	-	0
1200	T1491	No	-	0
1201	T1546.012	No	-	0
1202	T1197	No	-	0
1203	T1547.010	No	-	0
1204	T1016	No	-	0
1205	T1499.001	No	-	0
1206	T1573	No	-	0
1207	T1127.001	No	-	0
1208	T1117	No	-	0
1209	T1027.001	No	-	0
1210	T1546.014	No	-	0
1211	T1162	No	-	0
1212	T1559	No	-	0
1213	T1503	No	-	0
1214	T1195	No	-	0
1215	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	6
1216	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	6
1217	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	6
1218	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	6
1219	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	6
1220	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	6
1221	T1122	No	-	0
1222	T1560.002	No	-	0
1223	T1110.002	No	-	0
1224	T1566	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml	5
1225	T1059.007	No	-	0
1226	T1043	No	-	0
1227	T1488	No	-	0
1228	T1529	No	-	0
1229	T1096	No	-	0
1230	T1550.004	No	-	0
1231	T1217	No	-	0
1232	T1218	No	-	1
1233	T1578	No	-	0
1234	T1546.015	No	-	0
1235	T1006	No	-	0
1236	T1137.003	No	-	0
1237	T1174	No	-	0
1238	T1134.001	No	-	0
1239	T1070	Yes	https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml	3
1240	T1550.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	1
1241	T1030	No	-	0
1242	T1137.004	No	-	0
1243	T1036.006	No	-	0
1244	T1539	No	-	0
1245	T1518.001	No	-	0
1246	T1061	No	-	0
1247	T1151	No	-	0
1248	T1578.002	No	-	0
1249	T1037.004	No	-	0
1250	T1107	No	-	0
1251	T1114.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml	1
1252	T1103	No	-	0
1253	T1490	No	-	0
1254	T1483	No	-	0
1255	T1088	No	-	0
1256	T1159	No	-	0
1257	T1165	No	-	0
1258	T1132.001	No	-	0
1259	T1003.004	No	-	0
1260	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	2
1261	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	2
1262	T1102	No	-	0
1263	T1024	No	-	0
1264	T1157	No	-	0
1265	T1003	No	-	12
1266	T1087.004	No	-	0
1267	T1552.005	No	-	0
1268	T1562.003	No	-	0
1269	T1553	No	-	1
1270	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml	3
1271	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	3
1272	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml	3
1273	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml	5
1274	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml	5
1275	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml	5
1276	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml	5
1277	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml	5
1278	T1216	No	-	0
1279	T1063	No	-	0
1280	T1036.003	No	-	0
1281	T1569.001	No	-	0
1282	T1118	No	-	0
1283	T1571	No	-	0
1284	T1069.002	No	-	0
1285	T1089	No	-	0
1286	T1143	No	-	0
1287	T1003.006	No	-	0
1288	T1497.002	No	-	0
1289	T1188	No	-	0
1290	T1110	No	-	0
1291	T1531	No	-	0
1292	T1138	No	-	0
1293	T1132	No	-	0
1294	T1546.013	No	-	0
1295	T1026	No	-	0
1296	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	5
1297	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	5
1298	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	5
1299	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	5
1300	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	5
1301	T1102.002	No	-	0
1302	T1033	No	-	0
1303	T1021.006	No	-	0
1304	T1497	No	-	0
1305	T1167	No	-	0
1306	T1136.002	No	-	0
1307	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	13
1308	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	13
1309	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	13
1310	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	13
1311	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	13
1312	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	13
1313	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	13
1314	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	13
1315	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	13
1316	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	13
1317	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	13
1318	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	13
1319	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	13
1320	T1568.001	No	-	0
1321	T1218.010	No	-	0
1322	T1213	No	-	0
1323	T1519	No	-	0
1324	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
1325	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
1326	T1027.002	No	-	0
1327	T1020	No	-	0
1328	T1158	No	-	0
1329	T1164	No	-	0
1330	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	4
1331	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	4
1332	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	4
1333	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	4
1334	T1201	No	-	0
1335	T1578.003	No	-	0
1336	T1049	No	-	0
1337	T1547.011	No	-	0
1338	T1185	No	-	0
1339	T1564.005	No	-	0
1340	T1119	No	-	0
1341	T1037	No	-	0
1342	T1055.005	No	-	0
1343	T1199	No	-	0
1344	T1547.003	No	-	0
1345	T1069.003	No	-	0
1346	T1537	No	-	0
1347	T1192	No	-	0
1348	T1146	No	-	0
1349	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
1350	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
1351	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
1352	T1069	No	-	0
1353	T1044	No	-	0
1354	T1505	No	-	0
1355	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
1356	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
1357	T1542.001	No	-	0
1358	T1514	No	-	0
1359	T1552	No	-	0
1360	T1052	No	-	0
1361	T1556.003	No	-	0
1362	T1563.001	No	-	0
1363	T1499.002	No	-	0
1364	T1574	No	-	1
1365	T1563	No	-	0
1366	T1055.014	No	-	0
1367	T1134.005	No	-	0
1368	T1558	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	2
1369	T1542.002	No	-	0
1370	T1077	No	-	0
1371	T1121	No	-	0
1372	T1059.006	No	-	0
1373	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml	2
1374	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
1375	T1574.002	No	-	0
1376	T1079	No	-	0
1377	T1213.001	No	-	0
1378	T1504	No	-	0
1379	T1090.001	No	-	0
1380	T1083	No	-	0
1381	T1552.001	No	-	0
1382	T1134	No	-	0
1383	T1144	No	-	0
1384	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
1385	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
1386	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	3
1387	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	3
1388	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	3
1389	T1120	No	-	0
1390	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
1391	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
1392	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	3
1393	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	3
1394	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	3
1395	T1550	No	-	1
1396	T1547.004	No	-	0
1397	T1218.003	No	-	0
1398	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
1399	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
1400	T1059.004	No	-	0
1401	T1011.001	No	-	0
1402	T1100	No	-	0
1403	T1054	No	-	0
1404	T1021	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	7
1405	T1564	No	-	0
1406	T1547.009	No	-	0
1407	T1022	No	-	0
1408	T1102.001	No	-	0
1409	T1105	No	-	0
1410	T1559.001	No	-	0
1411	T1036.001	No	-	0
1412	T1070.004	No	-	0
1413	T1578.004	No	-	0
1414	T1572	No	-	0
1415	T1546.009	No	-	0
1416	T1518	No	-	0
1417	T1501	No	-	0
1418	T1053.002	No	-	0
1419	T1548.002	No	-	0
1420	T1212	No	-	0
1421	T1065	No	-	0
1422	T1546.003	No	-	0
1423	T1175	No	-	0
1424	T1552.004	No	-	0
1425	T1223	No	-	0
1426	T1574.008	No	-	0
1427	T1015	No	-	0
1428	T1567.002	No	-	0
1429	T1218.002	No	-	0
1430	T1023	No	-	0
1431	T1183	No	-	0
1432	T1125	No	-	0
1433	T1200	No	-	0
1434	T1108	No	-	0
1435	T1578.001	No	-	0
1436	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
1437	T1573.002	No	-	0
1438	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	7
1439	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	7
1440	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	7
1441	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	7
1442	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	7
1443	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml	7
1444	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	7
1445	T1147	No	-	0
1446	T1004	No	-	0
1447	T1205	No	-	0
1448	T1552.006	No	-	0
1449	T1104	No	-	0
1450	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
1451	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
1452	T1056	No	-	0
1453	T1219	No	-	0
1454	T1567.001	No	-	0
1455	T1566.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	1
1456	T1036.002	No	-	0
1457	T1046	No	-	0
1458	T1115	No	-	0
1459	T1554	No	-	0
1460	T1546.002	No	-	0
1461	T1565.001	No	-	0
1462	T1502	No	-	0
1463	T1211	No	-	0
1464	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	1
1465	T1080	No	-	0
1466	T1560.003	No	-	0
1467	T1180	No	-	0
1468	T1070.005	No	-	0
1469	T1542.003	No	-	0
1470	T1555.001	No	-	0
1471	T1052.001	No	-	0
1472	T1056.004	No	-	0
1473	T1094	No	-	0
1474	T1001.003	No	-	0
1475	T1076	No	-	0
1476	T1215	No	-	0
1477	T1218.007	No	-	0
1478	T1178	No	-	0
1479	T1171	No	-	0
1480	T1140	No	-	0
1481	T1025	No	-	0
1482	T1136.003	No	-	0
1483	T1547.007	No	-	0
1484	T1552.003	No	-	0
1485	T1213.002	No	-	0
1486	T1001.001	No	-	0
1487	T1195.002	No	-	0
1488	T1053	No	-	4
1489	T1209	No	-	0
1490	T1069.001	No	-	0
1491	T1193	No	-	0
1492	T1179	No	-	0
1493	T1098.003	No	-	0
1494	T1505.002	No	-	0
1495	T1059.002	No	-	0
1496	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	4
1497	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	4
1498	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	4
1499	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	4
1500	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
1501	T1563.002	No	-	0
1502	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
1503	T1099	No	-	0
1504	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
1505	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
1506	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
1507	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
1508	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
1509	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
1510	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
1511	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
1512	T1195.001	No	-	0
1513	T1497.001	No	-	0
1514	T1536	No	-	0
1515	T1058	No	-	0
1516	T1005	No	-	0
1517	T1148	No	-	0
1518	T1038	No	-	0
1519	T1552.002	No	-	0
1520	T1218.005	No	-	0
1521	T1486	No	-	0
1522	T1003.008	No	-	0
1523	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	21
1524	T1053.001	No	-	0
1525	T1557.001	No	-	0
1526	T1500	No	-	0
1527	T1170	No	-	0
1528	T1166	No	-	0
1529	T1051	No	-	0
1530	T1498.001	No	-	0
1531	T1210	No	-	0
1532	T1074.002	No	-	0
1533	T1202	No	-	0
1534	T1495	No	-	0
1535	T1561.002	No	-	0
1536	T1102.003	No	-	0
1537	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
1538	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	2
1539	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	2
1540	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	1
1541	T1087.001	No	-	0
1542	T1218.008	No	-	0
1543	T1547.005	No	-	0
1544	T1040	No	-	0
1545	T1153	No	-	0
1546	T1087.003	No	-	0
1547	T1071	No	-	10
1548	T1129	No	-	0
1549	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
1550	T1155	No	-	0
1551	T1085	No	-	0
1552	T1177	No	-	0
1553	T1021.004	No	-	0
1554	T1042	No	-	0
1555	T1090.003	No	-	0
1556	T1134.004	No	-	0
1557	T1053.004	No	-	0
1558	T1221	No	-	0
1559	T1557	No	-	0
1560	T1003.007	No	-	0
1561	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
1562	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
1563	T1555.003	No	-	0
1564	T1132.002	No	-	0
1565	T1113	No	-	0
1566	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	2
1567	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	2
1568	T1546.008	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	1
1569	T1208	No	-	0
1570	T1499	No	-	0
1571	T1561	No	-	0
1572	T1497.003	No	-	0
1573	T1009	No	-	0
1574	T1496	No	-	0
1575	T1216.001	No	-	0
1576	T1011	No	-	0
1577	T1548.004	No	-	0
1578	T1127	No	-	0
1579	T1562.006	No	-	0
1580	T1124	No	-	0
1581	T1126	No	-	0
1582	T1055.004	No	-	0
1583	T1098.002	No	-	0
1584	T1505.003	No	-	0
1585	T1031	No	-	0
1586	T1574.007	No	-	0
1587	T1137.002	No	-	0
1588	T1491.002	No	-	0
1589	T1548.003	No	-	0
1590	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
1591	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
1592	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
1593	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
1594	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
1595	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
1596	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
1597	T1021.003	No	-	0
1598	T1048.002	No	-	0
1599	T1196	No	-	0
1600	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
1601	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
1602	T1169	No	-	0
1603	T1128	No	-	0
1604	T1548.001	No	-	0
1605	T1172	No	-	0
1606	T1149	No	-	0
1607	T1543	No	-	1
1608	T1498.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml	1
1609	T1182	No	-	0
1610	T1547	No	-	3
1611	T1059	No	-	15
1612	T1093	No	-	0
1613	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
1614	T1037.002	No	-	0
1615	T1098	No	-	0
1616	T1527	No	-	0
1617	T1220	No	-	0
1618	T1034	No	-	0
1619	T1141	No	-	0
1620	T1116	No	-	0
1621	T1003.005	No	-	0
1622	T1041	No	-	0
1623	T1055.002	No	-	0
1624	T1522	No	-	0
1625	T1074.001	No	-	0
1626	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
1627	T1111	No	-	0
1628	T1546.005	No	-	0
1629	T1050	No	-	0
1630	T1574.001	No	-	0
1631	T1055.011	No	-	0
1632	T1184	No	-	0
1633	T1074	No	-	0
1634	T1542	No	-	0
1635	T1073	No	-	0
1636	T1092	No	-	0
1637	T1014	No	-	0
1638	T1189	No	-	0
1639	T1137.006	No	-	0
1640	T1075	No	-	0
1641	T1087.002	No	-	0
1642	T1134.003	No	-	0
1643	T1222.002	No	-	0
1644	T1562.002	No	-	0
1645	T1548	No	-	0
1646	T1035	No	-	0
1647	T1555	No	-	0
1648	T1561.001	No	-	0
1649	T1098.004	No	-	0
1650	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
1651	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
1652	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
1653	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
1654	T1017	No	-	0
1655	T1205.001	No	-	0
1656	T1569.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml	1
1657	T1565.002	No	-	0
1658	T1569	No	-	1
1659	T1499.004	No	-	0
1660	T1037.005	No	-	0
1661	T1553.003	No	-	0
1662	T1546.004	No	-	0
1663	T1053.003	No	-	0
1664	T1560	No	-	0
1665	T1181	No	-	0
1666	T1565	No	-	0
1667	T1131	No	-	0
1668	T1558.002	No	-	0
1669	T1218.009	No	-	0
1670	T1001.002	No	-	0
1671	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
1672	T1160	No	-	0
1673	T1060	No	-	0
1674	T1560.001	No	-	0
1675	T1489	No	-	0
1676	T1207	No	-	0
1677	T1204	No	-	1
1678	T1553.001	No	-	0
1679	T1018	No	-	0
1680	T1547.002	No	-	0
1681	T1091	No	-	0
1682	T1019	No	-	0
1683	T1543.001	No	-	0
1684	T1555.002	No	-	0
1685	T1492	No	-	0
1686	T1048	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	3
1687	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml	2
1688	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml	2
1689	T1574.004	No	-	0
1690	T1550.003	No	-	0
1691	T1480	No	-	0
1692	T1161	No	-	0
1693	T1558.001	No	-	0
1694	T1214	No	-	0
1695	T1546.006	No	-	0
1696	T1556	No	-	0
1697	T1087	No	-	0
1698	T1574.005	No	-	0
1699	T1506	No	-	0
1700	T1564.001	No	-	0
1701	T1130	No	-	0
1702	T1139	No	-	0
1703	T1045	No	-	0
1704	T1546.007	No	-	0
1705	T1032	No	-	0
1706	T1090	No	-	0
1707	T1498	No	-	1
1708	T1027.005	No	-	0
1709	T1543.004	No	-	0
1710	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
1711	T1566.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	1
1712	T1097	No	-	0
1713	T1546	No	-	5
1714	T1556.002	No	-	0
1715	T1176	No	-	0
1716	T1562	No	-	3
1717	T1187	No	-	0
1718	T1070.006	No	-	0
1719	T1186	No	-	0
1720	T1057	No	-	0
1721	T1543.002	No	-	0
1722	T1574.010	No	-	0
1723	T1028	No	-	0
1724	T1010	No	-	0
1725	T1565.003	No	-	0
1726	T1056.001	No	-	0
1727	T1110.003	No	-	0
1728	T1109	No	-	0
1729	T1142	No	-	0
1730	T1154	No	-	0
1731	T1547.006	No	-	0
1732	T1487	No	-	0
1733	T1037.003	No	-	0
1734	T1071.003	No	-	0
1735	T1027.003	No	-	0
1736	T1055.012	No	-	0
1737	T1056.003	No	-	0
1738	T1090.004	No	-	0
1739	T1137	No	-	0
1740	T1485	Yes	https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml	1
1741	T1110.001	No	-	0
1742	T1204.001	No	-	0
1743	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
1744	T1137.001	No	-	0
1745	T1027.004	No	-	0
1746	T1106	No	-	0
1747	T1036.005	No	-	0
1748	T1553.002	No	-	0
1749	T1070.003	No	-	0
1750	T1218.001	No	-	0
1751	T1482	No	-	0
1752	T1137.005	No	-	0
1753	T1013	No	-	0
1754	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml	2
1755	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml	2
1756	T1123	No	-	0
1757	T1021.005	No	-	0
1758	T1574.006	No	-	0
1759	T1012	No	-	0
1760	T1499.003	No	-	0
1761	T1218.004	No	-	0
1762	T1168	No	-	0
1763	T1048.001	No	-	0
1764	T1222	No	-	1
1765	T1173	No	-	0
1766	T1156	No	-	0
1767	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
1768	T1134.002	No	-	0
1769	T1055.003	No	-	0
1770	T1480.001	No	-	0
1771	T1570	No	-	0
1772	T1101	No	-	0
1773	T1029	No	-	0
1774	T1534	No	-	0
1775	T1556.001	No	-	0
1776	T1086	No	-	0
1777	T1494	No	-	0
1778	T1491.001	No	-	0
1779	T1056.002	No	-	0
1780	T1008	No	-	0
1781	T1036.004	No	-	0
1782	T1195.003	No	-	0
1783	T1055	No	-	0
1784	T1568.003	No	-	0
1785	T1007	No	-	0
1786	T1574.011	No	-	0
1787	T1067	No	-	0
1788	T1505.001	No	-	0
1789	T1206	No	-	0
1790	T1062	No	-	0
1791	T1152	No	-	0
1792	T1564.003	No	-	0
1793	T1114.003	No	-	0
1794	T1528	No	-	0
1795	T1037.001	No	-	0
1796	T1198	No	-	0
1797	T1064	No	-	0
1798	T1145	No	-	0
1799	T1059.005	No	-	0
1800	T1493	No	-	0
1801	T1110.004	No	-	0
1802	T1055.008	No	-	0
1803	T1568	No	-	0
1804	T1081	No	-	0
1805	T1055.001	No	-	0
1806	T1194	No	-	0
1807	T1218.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	1
1808	T1546.010	No	-	0
1809	T1002	No	-	0
1810	T1039	No	-	0
1811	T1573.001	No	-	0
1812	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml	4
1813	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml	4
1814	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml	4
1815	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml	4
1816	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
1817	T1550.001	No	-	0
1818	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
1819	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
1820	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
1821	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
1822	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
1823	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
1824	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
1825	T1538	No	-	0
1826	T1191	No	-	0
1827	T1001	No	-	0
1828	T1150	No	-	0
1829	T1098.001	No	-	0
1830	T1568.002	No	-	0
1831	T1547.008	No	-	0
1832	T1133	No	-	0
1833	T1559.002	No	-	0
1834	T1567	No	-	0
1835	T1084	No	-	0
1836	T1114	No	-	3
1837	T1070.002	No	-	0
1838	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
1839	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
1840	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
1841	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8
1842	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml	8
1843	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml	8
1844	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml	8
1845	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml	8
1846	T1564.002	No	-	0
1847	T1484	No	-	0
1848	T1055.009	No	-	0
1849	T1135	No	-	0
1850	T1574.012	No	-	0
1851	T1564.004	No	-	0
1852	T1163	No	-	0
1853	T1562.007	No	-	0
1854	T1003.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml	1
1855	T1090.002	No	-	0
1856	T1564.006	No	-	0
1857	T1066	No	-	0
1858	T1055.013	No	-	0
1859	T1491	No	-	0
1860	T1546.012	No	-	0
1861	T1197	No	-	0
1862	T1547.010	No	-	0
1863	T1016	No	-	0
1864	T1499.001	No	-	0
1865	T1573	No	-	0
1866	T1127.001	No	-	0
1867	T1117	No	-	0
1868	T1027.001	No	-	0
1869	T1546.014	No	-	0
1870	T1162	No	-	0
1871	T1559	No	-	0
1872	T1503	No	-	0
1873	T1195	No	-	0
1874	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml	6
1875	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml	6
1876	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml	6
1877	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml	6
1878	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml	6
1879	T1047	Yes	https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml	6
1880	T1122	No	-	0
1881	T1560.002	No	-	0
1882	T1110.002	No	-	0
1883	T1566	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml	5
1884	T1059.007	No	-	0
1885	T1043	No	-	0
1886	T1488	No	-	0
1887	T1529	No	-	0
1888	T1096	No	-	0
1889	T1550.004	No	-	0
1890	T1217	No	-	0
1891	T1218	No	-	1
1892	T1578	No	-	0
1893	T1546.015	No	-	0
1894	T1006	No	-	0
1895	T1137.003	No	-	0
1896	T1174	No	-	0
1897	T1134.001	No	-	0
1898	T1070	Yes	https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml	3
1899	T1550.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml	1
1900	T1030	No	-	0
1901	T1137.004	No	-	0
1902	T1036.006	No	-	0
1903	T1539	No	-	0
1904	T1518.001	No	-	0
1905	T1061	No	-	0
1906	T1151	No	-	0
1907	T1578.002	No	-	0
1908	T1037.004	No	-	0
1909	T1107	No	-	0
1910	T1114.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml	1
1911	T1103	No	-	0
1912	T1490	No	-	0
1913	T1483	No	-	0
1914	T1088	No	-	0
1915	T1159	No	-	0
1916	T1165	No	-	0
1917	T1132.001	No	-	0
1918	T1003.004	No	-	0
1919	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml	2
1920	T1566.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml	2
1921	T1102	No	-	0
1922	T1024	No	-	0
1923	T1157	No	-	0
1924	T1003	No	-	12
1925	T1087.004	No	-	0
1926	T1552.005	No	-	0
1927	T1562.003	No	-	0
1928	T1553	No	-	1
1929	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml	3
1930	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml	3
1931	T1547.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml	3
1932	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml	5
1933	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml	5
1934	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml	5
1935	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml	5
1936	T1526	Yes	https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml	5
1937	T1216	No	-	0
1938	T1063	No	-	0
1939	T1036.003	No	-	0
1940	T1569.001	No	-	0
1941	T1118	No	-	0
1942	T1571	No	-	0
1943	T1069.002	No	-	0
1944	T1089	No	-	0
1945	T1143	No	-	0
1946	T1003.006	No	-	0
1947	T1497.002	No	-	0
1948	T1188	No	-	0
1949	T1110	No	-	0
1950	T1531	No	-	0
1951	T1138	No	-	0
1952	T1132	No	-	0
1953	T1546.013	No	-	0
1954	T1026	No	-	0
1955	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml	5
1956	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml	5
1957	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml	5
1958	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml	5
1959	T1036	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml	5
1960	T1102.002	No	-	0
1961	T1033	No	-	0
1962	T1021.006	No	-	0
1963	T1497	No	-	0
1964	T1167	No	-	0
1965	T1136.002	No	-	0
1966	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml	13
1967	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml	13
1968	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml	13
1969	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml	13
1970	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml	13
1971	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml	13
1972	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml	13
1973	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml	13
1974	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml	13
1975	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml	13
1976	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml	13
1977	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml	13
1978	T1078.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml	13
1979	T1568.001	No	-	0
1980	T1218.010	No	-	0
1981	T1213	No	-	0
1982	T1519	No	-	0
1983	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml	2
1984	T1021.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml	2
1985	T1027.002	No	-	0
1986	T1020	No	-	0
1987	T1158	No	-	0
1988	T1164	No	-	0
1989	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml	4
1990	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml	4
1991	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml	4
1992	T1003.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml	4
1993	T1201	No	-	0
1994	T1578.003	No	-	0
1995	T1049	No	-	0
1996	T1547.011	No	-	0
1997	T1185	No	-	0
1998	T1564.005	No	-	0
1999	T1119	No	-	0
2000	T1037	No	-	0
2001	T1055.005	No	-	0
2002	T1199	No	-	0
2003	T1547.003	No	-	0
2004	T1069.003	No	-	0
2005	T1537	No	-	0
2006	T1192	No	-	0
2007	T1146	No	-	0
2008	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml	3
2009	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml	3
2010	T1136.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml	3
2011	T1069	No	-	0
2012	T1044	No	-	0
2013	T1505	No	-	0
2014	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml	2
2015	T1114.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml	2
2016	T1542.001	No	-	0
2017	T1514	No	-	0
2018	T1552	No	-	0
2019	T1052	No	-	0
2020	T1556.003	No	-	0
2021	T1563.001	No	-	0
2022	T1499.002	No	-	0
2023	T1574	No	-	1
2024	T1563	No	-	0
2025	T1055.014	No	-	0
2026	T1134.005	No	-	0
2027	T1558	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	2
2028	T1542.002	No	-	0
2029	T1077	No	-	0
2030	T1121	No	-	0
2031	T1059.006	No	-	0
2032	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml	2
2033	T1048.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml	2
2034	T1574.002	No	-	0
2035	T1079	No	-	0
2036	T1213.001	No	-	0
2037	T1504	No	-	0
2038	T1090.001	No	-	0
2039	T1083	No	-	0
2040	T1552.001	No	-	0
2041	T1134	No	-	0
2042	T1144	No	-	0
2043	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml	2
2044	T1078.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml	2
2045	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml	3
2046	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml	3
2047	T1530	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml	3
2048	T1120	No	-	0
2049	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml	2
2050	T1112	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml	2
2051	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml	3
2052	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml	3
2053	T1546.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml	3
2054	T1550	No	-	1
2055	T1547.004	No	-	0
2056	T1218.003	No	-	0
2057	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml	2
2058	T1068	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml	2
2059	T1059.004	No	-	0
2060	T1011.001	No	-	0
2061	T1100	No	-	0
2062	T1054	No	-	0
2063	T1021	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	7
2064	T1564	No	-	0
2065	T1547.009	No	-	0
2066	T1022	No	-	0
2067	T1102.001	No	-	0
2068	T1105	No	-	0
2069	T1559.001	No	-	0
2070	T1036.001	No	-	0
2071	T1070.004	No	-	0
2072	T1578.004	No	-	0
2073	T1572	No	-	0
2074	T1546.009	No	-	0
2075	T1518	No	-	0
2076	T1501	No	-	0
2077	T1053.002	No	-	0
2078	T1548.002	No	-	0
2079	T1212	No	-	0
2080	T1065	No	-	0
2081	T1546.003	No	-	0
2082	T1175	No	-	0
2083	T1552.004	No	-	0
2084	T1223	No	-	0
2085	T1574.008	No	-	0
2086	T1015	No	-	0
2087	T1567.002	No	-	0
2088	T1218.002	No	-	0
2089	T1023	No	-	0
2090	T1183	No	-	0
2091	T1125	No	-	0
2092	T1200	No	-	0
2093	T1108	No	-	0
2094	T1578.001	No	-	0
2095	T1136	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml	4
2096	T1573.002	No	-	0
2097	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	7
2098	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml	7
2099	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	7
2100	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml	7
2101	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml	7
2102	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml	7
2103	T1059.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	7
2104	T1147	No	-	0
2105	T1004	No	-	0
2106	T1205	No	-	0
2107	T1552.006	No	-	0
2108	T1104	No	-	0
2109	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml	2
2110	T1562.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml	2
2111	T1056	No	-	0
2112	T1219	No	-	0
2113	T1567.001	No	-	0
2114	T1566.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml	1
2115	T1036.002	No	-	0
2116	T1046	No	-	0
2117	T1115	No	-	0
2118	T1554	No	-	0
2119	T1546.002	No	-	0
2120	T1565.001	No	-	0
2121	T1502	No	-	0
2122	T1211	No	-	0
2123	T1072	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml	1
2124	T1080	No	-	0
2125	T1560.003	No	-	0
2126	T1180	No	-	0
2127	T1070.005	No	-	0
2128	T1542.003	No	-	0
2129	T1555.001	No	-	0
2130	T1052.001	No	-	0
2131	T1056.004	No	-	0
2132	T1094	No	-	0
2133	T1001.003	No	-	0
2134	T1076	No	-	0
2135	T1215	No	-	0
2136	T1218.007	No	-	0
2137	T1178	No	-	0
2138	T1171	No	-	0
2139	T1140	No	-	0
2140	T1025	No	-	0
2141	T1136.003	No	-	0
2142	T1547.007	No	-	0
2143	T1552.003	No	-	0
2144	T1213.002	No	-	0
2145	T1001.001	No	-	0
2146	T1195.002	No	-	0
2147	T1053	No	-	4
2148	T1209	No	-	0
2149	T1069.001	No	-	0
2150	T1193	No	-	0
2151	T1179	No	-	0
2152	T1098.003	No	-	0
2153	T1505.002	No	-	0
2154	T1059.002	No	-	0
2155	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml	4
2156	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml	4
2157	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml	4
2158	T1078.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml	4
2159	T1562.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml	1
2160	T1563.002	No	-	0
2161	T1558.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml	1
2162	T1099	No	-	0
2163	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml	8
2164	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml	8
2165	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml	8
2166	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml	8
2167	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml	8
2168	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml	8
2169	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml	8
2170	T1059.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml	8
2171	T1195.001	No	-	0
2172	T1497.001	No	-	0
2173	T1536	No	-	0
2174	T1058	No	-	0
2175	T1005	No	-	0
2176	T1148	No	-	0
2177	T1038	No	-	0
2178	T1552.002	No	-	0
2179	T1218.005	No	-	0
2180	T1486	No	-	0
2181	T1003.008	No	-	0
2182	T1078	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml	21
2183	T1053.001	No	-	0
2184	T1557.001	No	-	0
2185	T1500	No	-	0
2186	T1170	No	-	0
2187	T1166	No	-	0
2188	T1051	No	-	0
2189	T1498.001	No	-	0
2190	T1210	No	-	0
2191	T1074.002	No	-	0
2192	T1202	No	-	0
2193	T1495	No	-	0
2194	T1561.002	No	-	0
2195	T1102.003	No	-	0
2196	T1574.009	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml	1
2197	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml	2
2198	T1190	Yes	https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml	2
2199	T1095	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml	1
2200	T1087.001	No	-	0
2201	T1218.008	No	-	0
2202	T1547.005	No	-	0
2203	T1040	No	-	0
2204	T1153	No	-	0
2205	T1087.003	No	-	0
2206	T1071	No	-	10
2207	T1129	No	-	0
2208	T1204.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml	1
2209	T1155	No	-	0
2210	T1085	No	-	0
2211	T1177	No	-	0
2212	T1021.004	No	-	0
2213	T1042	No	-	0
2214	T1090.003	No	-	0
2215	T1134.004	No	-	0
2216	T1053.004	No	-	0
2217	T1221	No	-	0
2218	T1557	No	-	0
2219	T1003.007	No	-	0
2220	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml	2
2221	T1070.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml	2
2222	T1555.003	No	-	0
2223	T1132.002	No	-	0
2224	T1113	No	-	0
2225	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml	2
2226	T1082	Yes	https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml	2
2227	T1546.008	Yes	https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml	1
2228	T1208	No	-	0
2229	T1499	No	-	0
2230	T1561	No	-	0
2231	T1497.003	No	-	0
2232	T1009	No	-	0
2233	T1496	No	-	0
2234	T1216.001	No	-	0
2235	T1011	No	-	0
2236	T1548.004	No	-	0
2237	T1127	No	-	0
2238	T1562.006	No	-	0
2239	T1124	No	-	0
2240	T1126	No	-	0
2241	T1055.004	No	-	0
2242	T1098.002	No	-	0
2243	T1505.003	No	-	0
2244	T1031	No	-	0
2245	T1574.007	No	-	0
2246	T1137.002	No	-	0
2247	T1491.002	No	-	0
2248	T1548.003	No	-	0
2249	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml	7
2250	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml	7
2251	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml	7
2252	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml	7
2253	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml	7
2254	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml	7
2255	T1071.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml	7
2256	T1021.003	No	-	0
2257	T1048.002	No	-	0
2258	T1196	No	-	0
2259	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml	2
2260	T1071.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml	2
2261	T1169	No	-	0
2262	T1128	No	-	0
2263	T1548.001	No	-	0
2264	T1172	No	-	0
2265	T1149	No	-	0
2266	T1543	No	-	1
2267	T1498.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml	1
2268	T1182	No	-	0
2269	T1547	No	-	3
2270	T1059	No	-	15
2271	T1093	No	-	0
2272	T1553.004	Yes	https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml	1
2273	T1037.002	No	-	0
2274	T1098	No	-	0
2275	T1527	No	-	0
2276	T1220	No	-	0
2277	T1034	No	-	0
2278	T1141	No	-	0
2279	T1116	No	-	0
2280	T1003.005	No	-	0
2281	T1041	No	-	0
2282	T1055.002	No	-	0
2283	T1522	No	-	0
2284	T1074.001	No	-	0
2285	T1071.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml	1
2286	T1111	No	-	0
2287	T1546.005	No	-	0
2288	T1050	No	-	0
2289	T1574.001	No	-	0
2290	T1055.011	No	-	0
2291	T1184	No	-	0
2292	T1074	No	-	0
2293	T1542	No	-	0
2294	T1073	No	-	0
2295	T1092	No	-	0
2296	T1014	No	-	0
2297	T1189	No	-	0
2298	T1137.006	No	-	0
2299	T1075	No	-	0
2300	T1087.002	No	-	0
2301	T1134.003	No	-	0
2302	T1222.002	No	-	0
2303	T1562.002	No	-	0
2304	T1548	No	-	0
2305	T1035	No	-	0
2306	T1555	No	-	0
2307	T1561.001	No	-	0
2308	T1098.004	No	-	0
2309	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml	4
2310	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml	4
2311	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml	4
2312	T1021.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml	4
2313	T1017	No	-	0
2314	T1205.001	No	-	0
2315	T1569.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml	1
2316	T1565.002	No	-	0
2317	T1569	No	-	1
2318	T1499.004	No	-	0
2319	T1037.005	No	-	0
2320	T1553.003	No	-	0
2321	T1546.004	No	-	0
2322	T1053.003	No	-	0
2323	T1560	No	-	0
2324	T1181	No	-	0
2325	T1565	No	-	0
2326	T1131	No	-	0
2327	T1558.002	No	-	0
2328	T1218.009	No	-	0
2329	T1001.002	No	-	0
2330	T1078.002	Yes	https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml	1
2331	T1160	No	-	0
2332	T1060	No	-	0
2333	T1560.001	No	-	0
2334	T1489	No	-	0
2335	T1207	No	-	0
2336	T1204	No	-	1
2337	T1553.001	No	-	0
2338	T1018	No	-	0
2339	T1547.002	No	-	0
2340	T1091	No	-	0
2341	T1019	No	-	0
2342	T1543.001	No	-	0
2343	T1555.002	No	-	0
2344	T1492	No	-	0
2345	T1048	Yes	https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml	3
2346	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml	2
2347	T1525	Yes	https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml	2
2348	T1574.004	No	-	0
2349	T1550.003	No	-	0
2350	T1480	No	-	0
2351	T1161	No	-	0
2352	T1558.001	No	-	0
2353	T1214	No	-	0
2354	T1546.006	No	-	0
2355	T1556	No	-	0
2356	T1087	No	-	0
2357	T1574.005	No	-	0
2358	T1506	No	-	0
2359	T1564.001	No	-	0
2360	T1130	No	-	0
2361	T1139	No	-	0
2362	T1045	No	-	0
2363	T1546.007	No	-	0
2364	T1032	No	-	0
2365	T1090	No	-	0
2366	T1498	No	-	1
2367	T1027.005	No	-	0
2368	T1543.004	No	-	0
2369	T1027	Yes	https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml	1
2370	T1566.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml	1
2371	T1097	No	-	0
2372	T1546	No	-	5
2373	T1556.002	No	-	0
2374	T1176	No	-	0
2375	T1562	No	-	3
2376	T1187	No	-	0
2377	T1070.006	No	-	0
2378	T1186	No	-	0
2379	T1057	No	-	0
2380	T1543.002	No	-	0
2381	T1574.010	No	-	0
2382	T1028	No	-	0
2383	T1010	No	-	0
2384	T1565.003	No	-	0
2385	T1056.001	No	-	0
2386	T1110.003	No	-	0
2387	T1109	No	-	0
2388	T1142	No	-	0
2389	T1154	No	-	0
2390	T1547.006	No	-	0
2391	T1487	No	-	0
2392	T1037.003	No	-	0
2393	T1071.003	No	-	0
2394	T1027.003	No	-	0
2395	T1055.012	No	-	0
2396	T1056.003	No	-	0
2397	T1090.004	No	-	0
2398	T1137	No	-	0
2399	T1485	Yes	https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml	1
2400	T1110.001	No	-	0
2401	T1204.001	No	-	0
2402	T1222.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml	1
2403	T1137.001	No	-	0
2404	T1027.004	No	-	0
2405	T1106	No	-	0
2406	T1036.005	No	-	0
2407	T1553.002	No	-	0
2408	T1070.003	No	-	0
2409	T1218.001	No	-	0
2410	T1482	No	-	0
2411	T1137.005	No	-	0
2412	T1013	No	-	0
2413	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml	2
2414	T1203	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml	2
2415	T1123	No	-	0
2416	T1021.005	No	-	0
2417	T1574.006	No	-	0
2418	T1012	No	-	0
2419	T1499.003	No	-	0
2420	T1218.004	No	-	0
2421	T1168	No	-	0
2422	T1048.001	No	-	0
2423	T1222	No	-	1
2424	T1173	No	-	0
2425	T1156	No	-	0
2426	T1543.003	Yes	https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml	1
2427	T1134.002	No	-	0
2428	T1055.003	No	-	0
2429	T1480.001	No	-	0
2430	T1570	No	-	0
2431	T1101	No	-	0
2432	T1029	No	-	0
2433	T1534	No	-	0
2434	T1556.001	No	-	0
2435	T1086	No	-	0
2436	T1494	No	-	0
2437	T1491.001	No	-	0
2438	T1056.002	No	-	0
2439	T1008	No	-	0
2440	T1036.004	No	-	0
2441	T1195.003	No	-	0
2442	T1055	No	-	0
2443	T1568.003	No	-	0
2444	T1007	No	-	0
2445	T1574.011	No	-	0
2446	T1067	No	-	0
2447	T1505.001	No	-	0
2448	T1206	No	-	0
2449	T1062	No	-	0
2450	T1152	No	-	0
2451	T1564.003	No	-	0
2452	T1114.003	No	-	0
2453	T1528	No	-	0
2454	T1037.001	No	-	0
2455	T1198	No	-	0
2456	T1064	No	-	0
2457	T1145	No	-	0
2458	T1059.005	No	-	0
2459	T1493	No	-	0
2460	T1110.004	No	-	0
2461	T1055.008	No	-	0
2462	T1568	No	-	0
2463	T1081	No	-	0
2464	T1055.001	No	-	0
2465	T1194	No	-	0
2466	T1218.011	Yes	https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml	1
2467	T1546.010	No	-	0
2468	T1002	No	-	0
2469	T1039	No	-	0
2470	T1573.001	No	-	0
2471	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml	4
2472	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml	4
2473	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml	4
2474	T1053.005	Yes	https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml	4
2475	T1546.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml	1
2476	T1550.001	No	-	0
2477	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml	7
2478	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml	7
2479	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml	7
2480	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml	7
2481	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml	7
2482	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml	7
2483	T1003.001	Yes	https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml	7
2484	T1538	No	-	0
2485	T1191	No	-	0
2486	T1001	No	-	0
2487	T1150	No	-	0
2488	T1098.001	No	-	0
2489	T1568.002	No	-	0
2490	T1547.008	No	-	0
2491	T1133	No	-	0
2492	T1559.002	No	-	0
2493	T1567	No	-	0
2494	T1084	No	-	0
2495	T1114	No	-	3
2496	T1070.002	No	-	0
2497	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml	8
2498	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml	8
2499	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml	8
2500	T1535	Yes	https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml	8

The file is too large to be shown. View Raw