threatengine.sh Sigma export
backend: cortex_xdr (one .txt per rule, the rendered query)
rules: 1524

files:
  T1574.001_apt27-emissary-panda-activity.txt  [T1574.001]  APT27 - Emissary Panda Activity
  T1218.011_apt29-2018-phishing-campaign-commandline-indicators.txt  [T1218.011]  APT29 2018 Phishing Campaign CommandLine Indicators
  T1218.011_apt29-2018-phishing-campaign-file-indicators.txt  [T1218.011]  APT29 2018 Phishing Campaign File Indicators
  T1003.001_apt31-judgement-panda-activity.txt  [T1003.001,T1560.001]  APT31 Judgement Panda Activity
  coldsteel-rat-cleanup-command-execution.txt  []  COLDSTEEL RAT Cleanup Command Execution
  coldsteel-rat-service-persistence-execution.txt  []  COLDSTEEL RAT Service Persistence Execution
  T1587_cve-2021-1675-print-spooler-exploitation-filename-pattern.txt  [T1587]  CVE-2021-1675 Print Spooler Exploitation Filename Pattern
  T1203_cve-2021-31979-cve-2021-33771-exploits.txt  [T1203,T1566]  CVE-2021-31979 CVE-2021-33771 Exploits
  T1203_cve-2021-31979-cve-2021-33771-exploits-by-sourgum.txt  [T1203,T1566]  CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum
  T1190_dns-rce-cve-2020-1350.txt  [T1190,T1569.002]  DNS RCE CVE-2020-1350
  T1204_darkside-ransomware-pattern.txt  [T1204]  DarkSide Ransomware Pattern
  T1203_droppers-exploiting-cve-2017-11882.txt  [T1203,T1204.002,T1566.001]  Droppers Exploiting CVE-2017-11882
  dumpstack-log-defender-evasion.txt  []  DumpStack.log Defender Evasion
  T1059.003_elise-backdoor-activity.txt  [T1059.003]  Elise Backdoor Activity
  T1218.011_equation-group-dll-u-export-function-load.txt  [T1218.011]  Equation Group DLL_U Export Function Load
  T1218.011_evilnum-apt-golden-chickens-deployment-via-ocx-files.txt  [T1218.011]  EvilNum APT Golden Chickens Deployment Via OCX Files
  T1036.005_exploit-for-cve-2015-1641.txt  [T1036.005]  Exploit for CVE-2015-1641
  T1203_exploit-for-cve-2017-8759.txt  [T1203,T1204.002,T1566.001]  Exploit for CVE-2017-8759
  T1068_exploiting-cve-2019-1388.txt  [T1068]  Exploiting CVE-2019-1388
  T1112_flowcloud-registry-markers.txt  [T1112]  FlowCloud Registry Markers
  T1587_foggyweb-backdoor-dll-loading.txt  [T1587]  FoggyWeb Backdoor DLL Loading
  T1036.005_greenbug-espionage-group-indicators.txt  [T1036.005,T1059.001,T1105]  Greenbug Espionage Group Indicators
  griffon-malware-attack-pattern.txt  []  Griffon Malware Attack Pattern
  T1053_hafnium-exchange-exploitation-activity.txt  [T1053,T1546]  HAFNIUM Exchange Exploitation Activity
  T1055_hacktool-dinjector-powershell-cradle-execution.txt  [T1055]  HackTool - DInjector PowerShell Cradle Execution
  T1003.001_hacktool-dumpert-process-dumper-default-file.txt  [T1003.001]  HackTool - Dumpert Process Dumper Default File
  T1548.002_hacktool-empire-powershell-uac-bypass.txt  [T1548.002]  HackTool - Empire PowerShell UAC Bypass
  T1218.011_hacktool-f-secure-c3-load-by-rundll32.txt  [T1218.011]  HackTool - F-Secure C3 Load by Rundll32
  T1219.002_hacktool-inveigh-execution-artefacts.txt  [T1219.002]  HackTool - Inveigh Execution Artefacts
  T1558_hacktool-mimikatz-kirbi-file-creation.txt  [T1558]  HackTool - Mimikatz Kirbi File Creation
  T1003.002_hacktool-quarkspwdump-dump-file.txt  [T1003.002]  HackTool - QuarksPwDump Dump File
  T1059_hacktool-sliver-c2-implant-activity-pattern.txt  [T1059]  HackTool - Sliver C2 Implant Activity Pattern
  T1068_installerfiletakeover-lpe-cve-2021-41379-file-create-event.txt  [T1068]  InstallerFileTakeOver LPE CVE-2021-41379 File Create Event
  T1059_lazarus-group-activity.txt  [T1059]  Lazarus Group Activity
  T1547.001_leviathan-registry-key-activity.txt  [T1547.001]  Leviathan Registry Key Activity
  T1059.004_linux-reverse-shell-indicator.txt  [T1059.004]  Linux Reverse Shell Indicator
  T1486_lockergoga-ransomware-activity.txt  [T1486]  LockerGoga Ransomware Activity
  mint-sandstorm-asperafaspex-suspicious-process-execution.txt  []  Mint Sandstorm - AsperaFaspex Suspicious Process Execution
  mint-sandstorm-manageengine-suspicious-process-execution.txt  []  Mint Sandstorm - ManageEngine Suspicious Process Execution
  T1543.003_moriya-rootkit-file-created.txt  [T1543.003]  Moriya Rootkit File Created
  T1112_oceanlotus-registry-activity.txt  [T1112]  OceanLotus Registry Activity
  T1053.005_oilrig-apt-activity.txt  [T1053.005,T1071.004,T1112,T1543.003]  OilRig APT Activity
  T1053.005_oilrig-apt-registry-persistence.txt  [T1053.005,T1071.004,T1112,T1543.003]  OilRig APT Registry Persistence
  T1105_pandemic-registry-key.txt  [T1105]  Pandemic Registry Key
  T1546.008_persistence-via-sticky-key-backdoor.txt  [T1546.008]  Persistence Via Sticky Key Backdoor
  T1486_potential-conti-ransomware-activity.txt  [T1486]  Potential Conti Ransomware Activity
  T1003_potential-credential-dumping-via-lsass-process-clone.txt  [T1003,T1003.001]  Potential Credential Dumping Via LSASS Process Clone
  T1003.001_potential-credential-dumping-via-lsass-silentprocessexit-tec.txt  [T1003.001]  Potential Credential Dumping Via LSASS SilentProcessExit Technique
  T1021.002_potential-dcom-internetexplorer-application-dll-hijack.txt  [T1021.002,T1021.003]  Potential DCOM InternetExplorer.Application DLL Hijack
  T1021.002_potential-dcom-internetexplorer-application-dll-hijack-image.txt  [T1021.002,T1021.003]  Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
  T1033_potential-dridex-activity.txt  [T1033,T1055,T1135]  Potential Dridex Activity
  T1490_potential-dtrack-rat-activity.txt  [T1490]  Potential Dtrack RAT Activity
  T1047_potential-maze-ransomware-activity.txt  [T1047,T1204.002,T1490]  Potential Maze Ransomware Activity
  T1059.005_potential-qbot-activity.txt  [T1059.005]  Potential QBot Activity
  T1003.003_potential-russian-apt-credential-theft-activity.txt  [T1003.003,T1552.001]  Potential Russian APT Credential Theft Activity
  T1557.001_potential-smb-relay-attack-tool-execution.txt  [T1557.001]  Potential SMB Relay Attack Tool Execution
  T1190_potential-sharepoint-toolshell-cve-2025-53770-exploitation-f.txt  [T1190]  Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create
  T1068_potential-systemnightmare-exploitation-attempt.txt  [T1068]  Potential SystemNightmare Exploitation Attempt
  T1204_printernightmare-mimikatz-driver-name.txt  [T1204]  PrinterNightmare Mimikatz Driver Name
  qakbot-rundll32-exports-execution.txt  []  Qakbot Rundll32 Exports Execution
  qakbot-rundll32-fake-dll-extension-execution.txt  []  Qakbot Rundll32 Fake DLL Extension Execution
  T1059_revil-kaseya-incident-malware-patterns.txt  [T1059]  REvil Kaseya Incident Malware Patterns
  T1036.005_redsun-tieringengineservice-exe-staged-in-rs-prefixed-temp-d.txt  [T1036.005]  RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir
  T1059.001_rorschach-ransomware-execution-activity.txt  [T1059.001,T1059.003]  Rorschach Ransomware Execution Activity
  snake-malware-kernel-driver-file-indicator.txt  []  SNAKE Malware Kernel Driver File Indicator
  T1136.001_serv-u-exploitation-cve-2021-35211-by-dev-0322.txt  [T1136.001]  Serv-U Exploitation CVE-2021-35211 by DEV-0322
  T1546.008_sticky-key-like-backdoor-execution.txt  [T1546.008]  Sticky Key Like Backdoor Execution
  T1546.008_sticky-key-like-backdoor-usage-registry.txt  [T1546.008]  Sticky Key Like Backdoor Usage - Registry
  suspicious-child-process-of-veeam-dabatase.txt  []  Suspicious Child Process Of Veeam Dabatase
  suspicious-powershell-mailbox-export-to-share.txt  []  Suspicious PowerShell Mailbox Export to Share
  T1548.002_trustedpath-uac-bypass-pattern.txt  [T1548.002]  TrustedPath UAC Bypass Pattern
  T1027_turla-group-commands-may-2020.txt  [T1027,T1053.005,T1059.001]  Turla Group Commands May 2020
  T1021.002_turla-group-lateral-movement.txt  [T1021.002,T1059,T1083,T1135]  Turla Group Lateral Movement
  T1047_unc2452-powershell-pattern.txt  [T1047,T1059.001]  UNC2452 PowerShell Pattern
  unc4841-potential-seaspy-execution.txt  []  UNC4841 - Potential SEASPY Execution
  T1546.003_wmi-backdoor-exchange-transport-agent.txt  [T1546.003]  WMI Backdoor Exchange Transport Agent
  T1083_wannacry-ransomware-activity.txt  [T1083,T1210,T1222.001,T1486,T1490]  WannaCry Ransomware Activity
  T1003.001_windows-credential-editor-registry.txt  [T1003.001]  Windows Credential Editor Registry
  T1574.001_winnti-malware-hk-university-campaign.txt  [T1574.001]  Winnti Malware HK University Campaign
  T1574.001_winnti-pipemon-characteristics.txt  [T1574.001]  Winnti Pipemon Characteristics
  T1047_wmiexec-default-output-file.txt  [T1047]  Wmiexec Default Output File
  T1021.002_wmiprvse-wbemcomn-dll-hijack-file.txt  [T1021.002,T1047]  Wmiprvse Wbemcomn DLL Hijack - File
  T1059.003_zxshell-malware.txt  [T1059.003,T1218.011]  ZxShell Malware
  rdp-file-created-by-uncommon-application.txt  []  .RDP File Created By Uncommon Application
  T1685_amsi-disabled-via-registry-modification.txt  [T1685]  AMSI Disabled via Registry Modification
  T1055_apt-privatelog-image-load-pattern.txt  [T1055]  APT PRIVATELOG Image Load Pattern
  T1059_abusable-dll-potential-sideloading-from-suspicious-location.txt  [T1059]  Abusable DLL Potential Sideloading From Suspicious Location
  add-debugger-entry-to-hangs-key-for-persistence.txt  []  Add Debugger Entry To Hangs Key For Persistence
  T1059.005_adwind-rat-jrat.txt  [T1059.005,T1059.007]  Adwind RAT / JRAT
  T1059.005_adwind-rat-jrat-file-artifact.txt  [T1059.005,T1059.007]  Adwind RAT / JRAT File Artifact
  T1685_antivirus-filter-driver-disallowed-on-dev-drive-registry.txt  [T1685]  Antivirus Filter Driver Disallowed On Dev Drive - Registry
  T1190_apache-spark-shell-command-injection-processcreation.txt  [T1190]  Apache Spark Shell Command Injection - ProcessCreation
  T1574.001_aruba-network-service-potential-dll-sideloading.txt  [T1574.001]  Aruba Network Service Potential DLL Sideloading
  T1059_atlassian-confluence-cve-2022-26134.txt  [T1059,T1190]  Atlassian Confluence CVE-2022-26134
  T1059.002_atomic-macos-stealer-filegrabber-activity.txt  [T1059.002]  Atomic MacOS Stealer - FileGrabber Activity
  T1543.004_atomic-macos-stealer-persistence-indicators.txt  [T1543.004,T1564.001]  Atomic MacOS Stealer - Persistence Indicators
  T1187_attempts-of-kerberos-coercion-via-dns-spn-spoofing.txt  [T1187,T1557.001]  Attempts of Kerberos Coercion Via DNS SPN Spoofing
  T1685.001_audit-policy-tampering-via-nt-resource-kit-auditpol.txt  [T1685.001]  Audit Policy Tampering Via NT Resource Kit Auditpol
  T1685.004_audit-rules-deleted-via-auditctl.txt  [T1685.004]  Audit Rules Deleted Via Auditctl
  T1105_axios-npm-compromise-file-creation-indicators-linux.txt  [T1105,T1195.002]  Axios NPM Compromise File Creation Indicators - Linux
  T1105_axios-npm-compromise-file-creation-indicators-macos.txt  [T1105,T1195.002]  Axios NPM Compromise File Creation Indicators - MacOS
  T1195.002_axios-npm-compromise-file-creation-indicators-windows.txt  [T1195.002]  Axios NPM Compromise File Creation Indicators - Windows
  T1059.004_axios-npm-compromise-indicators-linux.txt  [T1059.004,T1059.006,T1105,T1195.002]  Axios NPM Compromise Indicators - Linux
  T1059.002_axios-npm-compromise-indicators-macos.txt  [T1059.002,T1059.004,T1105,T1195.002]  Axios NPM Compromise Indicators - macOS
  T1021.003_baaupdate-exe-suspicious-dll-load.txt  [T1021.003,T1218]  BaaUpdate.exe Suspicious DLL Load
  T1218.011_bad-opsec-defaults-sacrificial-processes-with-improper-argum.txt  [T1218.011]  Bad Opsec Defaults Sacrificial Processes With Improper Arguments
  T1027_base64-encoded-powershell-command-detected.txt  [T1027,T1059.001,T1140]  Base64 Encoded PowerShell Command Detected
  base64-mz-header-in-commandline.txt  []  Base64 MZ Header In CommandLine
  T1027.001_binary-padding-macos.txt  [T1027.001]  Binary Padding - MacOS
  T1112_blackbyte-ransomware-registry.txt  [T1112]  Blackbyte Ransomware Registry
  T1059.001_bloodhound-collection-files.txt  [T1059.001,T1069.001,T1069.002,T1087.001,T1087.002,T1482]  BloodHound Collection Files
  T1047_blue-mockingbird.txt  [T1047,T1112]  Blue Mockingbird
  T1047_blue-mockingbird-registry.txt  [T1047,T1112]  Blue Mockingbird - Registry
  T1548.002_bypass-uac-using-delegateexecute.txt  [T1548.002]  Bypass UAC Using DelegateExecute
  T1547.010_bypass-uac-using-event-viewer.txt  [T1547.010]  Bypass UAC Using Event Viewer
  T1548.002_bypass-uac-using-silentcleanup-task.txt  [T1548.002]  Bypass UAC Using SilentCleanup Task
  T1548.002_bypass-uac-via-fodhelper-exe.txt  [T1548.002]  Bypass UAC via Fodhelper.exe
  T1218.003_cmstp-execution-process-creation.txt  [T1218.003]  CMSTP Execution Process Creation
  T1218.003_cmstp-execution-registry-event.txt  [T1218.003]  CMSTP Execution Registry Event
  T1218.003_cmstp-uac-bypass-via-com-object-access.txt  [T1218.003,T1548.002]  CMSTP UAC Bypass via COM Object Access
  coldsteel-rat-anonymous-user-process-execution.txt  []  COLDSTEEL RAT Anonymous User Process Execution
  T1546_com-hijack-via-sdclt.txt  [T1546,T1548]  COM Hijack via Sdclt
  T1546.015_com-object-hijacking-via-modification-of-default-system-clsi.txt  [T1546.015]  COM Object Hijacking Via Modification Of Default System CLSID Default Value
  T1112_cve-2020-1048-exploitation-attempt-suspicious-new-printer-po.txt  [T1112]  CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
  T1203_cve-2021-26858-exchange-exploitation.txt  [T1203]  CVE-2021-26858 Exchange Exploitation
  cve-2021-44077-poc-default-dropped-file.txt  []  CVE-2021-44077 POC Default Dropped File
  T1059.001_cve-2022-24527-microsoft-connected-cache-lpe.txt  [T1059.001]  CVE-2022-24527 Microsoft Connected Cache LPE
  T1059_cve-2023-22518-exploitation-attempt-suspicious-confluence-ch.txt  [T1059,T1190]  CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)
  cve-2023-38331-exploitation-attempt-suspicious-double-extens.txt  []  CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File
  T1190_cve-2024-50623-exploitation-attempt-cleo.txt  [T1190]  CVE-2024-50623 Exploitation Attempt - Cleo
  cab-file-extraction-via-wusa-exe-from-potentially-suspicious.txt  []  Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths
  T1059_capsh-shell-invocation-linux.txt  [T1059]  Capsh Shell Invocation - Linux
  T1112_change-user-account-associated-with-the-fax-service.txt  [T1112]  Change User Account Associated with the FAX Service
  T1685.001_change-winevt-channel-access-permission-via-registry.txt  [T1685.001]  Change Winevt Channel Access Permission Via Registry
  T1112_change-the-fax-dll.txt  [T1112]  Change the Fax Dll
  T1018_chopper-webshell-process-pattern.txt  [T1018,T1033,T1087,T1505.003]  Chopper Webshell Process Pattern
  T1053.005_chromeloader-malware-execution.txt  [T1053.005,T1059.001,T1176]  ChromeLoader Malware Execution
  chromium-browser-headless-execution-to-mockbin-like-site.txt  []  Chromium Browser Headless Execution To Mockbin Like Site
  T1059.001_cmd-exe-missing-space-characters-execution-anomaly.txt  [T1059.001]  Cmd.EXE Missing Space Characters Execution Anomaly
  T1090_communication-to-ngrok-tunneling-service-linux.txt  [T1090,T1102,T1567,T1568.002,T1572]  Communication To Ngrok Tunneling Service - Linux
  T1090_communication-to-ngrok-tunneling-service-initiated.txt  [T1090,T1102,T1567,T1568.002,T1572]  Communication To Ngrok Tunneling Service Initiated
  T1190_commvault-qlogin-argument-injection-authentication-bypass-cv.txt  [T1190]  Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)
  T1505.003_commvault-qoperation-path-traversal-webshell-drop-cve-2025-5.txt  [T1505.003]  Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)
  T1059.003_conhost-exe-commandline-path-traversal.txt  [T1059.003]  Conhost.exe CommandLine Path Traversal
  T1560_conti-ntds-exfiltration-command.txt  [T1560]  Conti NTDS Exfiltration Command
  T1587.001_conti-volume-shadow-listing.txt  [T1587.001]  Conti Volume Shadow Listing
  T1490_copy-from-volumeshadowcopy-via-cmd-exe.txt  [T1490]  Copy From VolumeShadowCopy Via Cmd.EXE
  T1552.001_copy-passwd-or-shadow-from-tmp-path.txt  [T1552.001]  Copy Passwd Or Shadow From TMP Path
  T1547.009_creation-exe-for-service-with-unquoted-path.txt  [T1547.009]  Creation Exe for Service with Unquoted Path
  T1136.001_creation-of-a-local-hidden-user-account-by-registry.txt  [T1136.001]  Creation of a Local Hidden User Account by Registry
  T1003.001_cred-dump-tools-dropped-files.txt  [T1003.001,T1003.002,T1003.003,T1003.004,T1003.005]  Cred Dump Tools Dropped Files
  T1552.001_credentials-in-files.txt  [T1552.001]  Credentials In Files
  T1105_curl-download-and-execute-combination.txt  [T1105,T1218]  Curl Download And Execute Combination
  T1202_custom-file-open-handler-executes-powershell.txt  [T1202]  Custom File Open Handler Executes PowerShell
  T1112_dhcp-callout-dll-installation.txt  [T1112,T1574.001]  DHCP Callout DLL Installation
  T1547.008_dll-load-via-lsass.txt  [T1547.008]  DLL Load via LSASS
  T1218.003_dll-loaded-from-suspicious-location-via-cmspt-exe.txt  [T1218.003]  DLL Loaded From Suspicious Location Via Cmspt.EXE
  T1574.001_dll-search-order-hijackig-via-additional-space-in-path.txt  [T1574.001]  DLL Search Order Hijackig Via Additional Space in Path
  T1574.001_dll-sideloading-of-shellchromeapi-dll.txt  [T1574.001]  DLL Sideloading Of ShellChromeAPI.DLL
  T1574.001_dll-sideloading-by-vmware-xfer-utility.txt  [T1574.001]  DLL Sideloading by VMware Xfer Utility
  T1048.001_dns-exfiltration-and-tunneling-tools-execution.txt  [T1048.001,T1071.004,T1132.001]  DNS Exfiltration and Tunneling Tools Execution
  T1552.004_dpapi-backup-keys-and-certificate-export-activity-ioc.txt  [T1552.004,T1555]  DPAPI Backup Keys And Certificate Export Activity IOC
  T1059.001_dsinternals-suspicious-powershell-cmdlets.txt  [T1059.001]  DSInternals Suspicious PowerShell Cmdlets
  T1136.001_darkgate-user-created-via-net-exe.txt  [T1136.001]  DarkGate - User Created Via Net.EXE
  T1547.010_default-rdp-port-changed-to-non-standard-port.txt  [T1547.010]  Default RDP Port Changed to Non Standard Port
  T1489_delete-all-scheduled-tasks.txt  [T1489]  Delete All Scheduled Tasks
  T1490_deletion-of-volume-shadow-copies-via-wmi-with-powershell.txt  [T1490]  Deletion of Volume Shadow Copies via WMI with PowerShell
  T1218_devtoolslauncher-exe-executes-specified-binary.txt  [T1218]  Devtoolslauncher.exe Executes Specified Binary
  T1202_diagnostic-library-sdiageng-dll-loaded-by-msdt-exe.txt  [T1202]  Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
  T1574.001_diamond-sleet-apt-dll-sideloading-indicators.txt  [T1574.001]  Diamond Sleet APT DLL Sideloading Indicators
  diamond-sleet-apt-file-creation-indicators.txt  []  Diamond Sleet APT File Creation Indicators
  diamond-sleet-apt-process-activity-indicators.txt  []  Diamond Sleet APT Process Activity Indicators
  T1685_diamond-sleet-apt-scheduled-task-creation-registry.txt  [T1685]  Diamond Sleet APT Scheduled Task Creation - Registry
  T1556_directory-service-restore-mode-dsrm-registry-value-tampering.txt  [T1556]  Directory Service Restore Mode(DSRM) Registry Value Tampering
  disable-macro-runtime-scan-scope.txt  []  Disable Macro Runtime Scan Scope
  T1685_disable-pua-protection-on-windows-defender.txt  [T1685]  Disable PUA Protection on Windows Defender
  T1685_disable-windows-defender-functionalities-via-registry-keys.txt  [T1685]  Disable Windows Defender Functionalities Via Registry Keys
  T1685_disabled-ie-security-features.txt  [T1685]  Disabled IE Security Features
  T1685_disabled-volume-snapshots.txt  [T1685]  Disabled Volume Snapshots
  T1685_disabled-windows-defender-eventlog.txt  [T1685]  Disabled Windows Defender Eventlog
  T1055_dotnet-clr-dll-loaded-by-scripting-applications.txt  [T1055]  DotNet CLR DLL Loaded By Scripting Applications
  driver-added-to-disallowed-images-in-hvci-registry.txt  []  Driver Added To Disallowed Images In HVCI - Registry
  T1059.012_esxi-admin-permission-assigned-to-account-via-esxcli.txt  [T1059.012,T1098]  ESXi Admin Permission Assigned To Account Via ESXCLI
  T1112_etw-logging-disabled-in-net-processes-sysmon-registry.txt  [T1112,T1685]  ETW Logging Disabled In .NET Processes - Sysmon Registry
  T1685_etw-logging-tamper-in-net-processes-via-commandline.txt  [T1685]  ETW Logging Tamper In .NET Processes Via CommandLine
  T1070_etw-trace-evasion-activity.txt  [T1070,T1685]  ETW Trace Evasion Activity
  email-exifiltration-via-powershell.txt  []  Email Exifiltration Via Powershell
  T1059.006_emotet-loader-execution-via-lnk-file.txt  [T1059.006]  Emotet Loader Execution Via .LNK File
  T1112_enable-lm-hash-storage.txt  [T1112]  Enable LM Hash Storage
  T1112_enable-lm-hash-storage-proccreation.txt  [T1112]  Enable LM Hash Storage - ProcCreation
  T1041_equation-group-c2-communication.txt  [T1041]  Equation Group C2 Communication
  T1003.002_esentutl-volume-shadow-copy-service-keys.txt  [T1003.002]  Esentutl Volume Shadow Copy Service Keys
  T1070_exchange-powershell-cmdlet-history-deleted.txt  [T1070]  Exchange PowerShell Cmdlet History Deleted
  T1218_execute-pcwrun-exe-to-leverage-follina.txt  [T1218]  Execute Pcwrun.EXE To Leverage Follina
  T1218_execution-dll-of-choice-using-wab-exe.txt  [T1218]  Execution DLL of Choice Using WAB.EXE
  T1059.001_execution-of-powershell-script-in-public-folder.txt  [T1059.001]  Execution of Powershell Script in Public Folder
  T1218_execution-via-workfolders-exe.txt  [T1218]  Execution via WorkFolders.exe
  T1218_execution-via-stordiag-exe.txt  [T1218]  Execution via stordiag.exe
  T1190_exploitation-activity-of-cve-2025-59287-wsus-suspicious-chil.txt  [T1190,T1203]  Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process
  T1210_exploitation-attempt-of-cve-2020-1472-execution-of-zerologon.txt  [T1210]  Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC
  T1059.001_exploited-cve-2020-10189-zoho-manageengine.txt  [T1059.001,T1059.003,T1190]  Exploited CVE-2020-10189 Zoho ManageEngine
  T1059.003_exploiting-setupcomplete-cmd-cve-2019-1378.txt  [T1059.003,T1068,T1574]  Exploiting SetupComplete.cmd CVE-2019-1378
  T1548.002_explorer-nouaccheck-flag.txt  [T1548.002]  Explorer NOUACCHECK Flag
  T1059.001_fakeupdates-socgholish-activity.txt  [T1059.001]  FakeUpdates/SocGholish Activity
  T1574.001_fax-service-dll-search-order-hijack.txt  [T1574.001]  Fax Service DLL Search Order Hijack
  T1547.001_file-creation-in-suspicious-directory-by-msdt-exe.txt  [T1547.001]  File Creation In Suspicious Directory By Msdt.EXE
  file-creation-related-to-rat-clients.txt  []  File Creation Related To RAT Clients
  T1105_file-download-with-headless-browser.txt  [T1105,T1564.003]  File Download with Headless Browser
  T1135_file-explorer-folder-opened-using-explorer-folder-shortcut-v.txt  [T1135]  File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
  T1204.002_file-with-uncommon-extension-created-by-an-office-applicatio.txt  [T1204.002]  File With Uncommon Extension Created By An Office Application
  T1204.004_filefix-command-evidence-in-typedpaths.txt  [T1204.004]  FileFix - Command Evidence in TypedPaths
  T1218.011_fireball-archer-install.txt  [T1218.011]  Fireball Archer Install
  T1547.001_forest-blizzard-apt-custom-protocol-handler-creation.txt  [T1547.001]  Forest Blizzard APT - Custom Protocol Handler Creation
  T1547.001_forest-blizzard-apt-custom-protocol-handler-dll-registry-set.txt  [T1547.001]  Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
  T1685.001_forest-blizzard-apt-file-creation-activity.txt  [T1685.001]  Forest Blizzard APT - File Creation Activity
  T1036_forfiles-exe-child-process-masquerading.txt  [T1036]  Forfiles.EXE Child Process Masquerading
  T1587.001_formbook-process-creation.txt  [T1587.001]  Formbook Process Creation
  T1486_funklocker-ransomware-file-creation.txt  [T1486]  FunkLocker Ransomware File Creation
  T1204.002_gac-dll-loaded-via-office-applications.txt  [T1204.002]  GAC DLL Loaded Via Office Applications
  goofy-guineapig-backdoor-ioc.txt  []  Goofy Guineapig Backdoor IOC
  T1046_grixba-malware-reconnaissance-activity.txt  [T1046,T1595.001]  Grixba Malware Reconnaissance Activity
  T1047_html-help-hh-exe-suspicious-child-process.txt  [T1047,T1059.001,T1059.003,T1059.005,T1059.007,T1218,T1218.001,T1218.010,T1218.011,T1566,T1566.001]  HTML Help HH.EXE Suspicious Child Process
  T1557.001_hacktool-adcspwn-execution.txt  [T1557.001]  HackTool - ADCSPwn Execution
  T1059.001_hacktool-covenant-powershell-launcher.txt  [T1059.001,T1564.003]  HackTool - Covenant PowerShell Launcher
  T1047_hacktool-crackmapexec-execution.txt  [T1047,T1053,T1059.001,T1059.003,T1110,T1201]  HackTool - CrackMapExec Execution
  T1047_hacktool-crackmapexec-execution-patterns.txt  [T1047,T1053,T1059.001,T1059.003]  HackTool - CrackMapExec Execution Patterns
  T1003.001_hacktool-crackmapexec-file-indicators.txt  [T1003.001]  HackTool - CrackMapExec File Indicators
  T1003.001_hacktool-crackmapexec-process-patterns.txt  [T1003.001]  HackTool - CrackMapExec Process Patterns
  T1053.005_hacktool-default-powersploit-empire-scheduled-task-creation.txt  [T1053.005,T1059.001]  HackTool - Default PowerSploit/Empire Scheduled Task Creation
  T1059.001_hacktool-empire-powershell-launch-parameters.txt  [T1059.001]  HackTool - Empire PowerShell Launch Parameters
  T1110.002_hacktool-hashcat-password-cracker-execution.txt  [T1110.002]  HackTool - Hashcat Password Cracker Execution
  T1055.012_hacktool-hollowreaper-execution.txt  [T1055.012]  HackTool - HollowReaper Execution
  T1090_hacktool-htran-natbypass-execution.txt  [T1090]  HackTool - Htran/NATBypass Execution
  T1110_hacktool-hydra-password-bruteforce-execution.txt  [T1110,T1110.001]  HackTool - Hydra Password Bruteforce Execution
  T1003.001_hacktool-impacket-file-indicators.txt  [T1003.001]  HackTool - Impacket File Indicators
  T1557.001_hacktool-impacket-tools-execution.txt  [T1557.001]  HackTool - Impacket Tools Execution
  T1003.001_hacktool-mimikatz-execution.txt  [T1003.001,T1003.002,T1003.004,T1003.005,T1003.006]  HackTool - Mimikatz Execution
  hacktool-nppspy-hacktool-usage.txt  []  HackTool - NPPSpy Hacktool Usage
  T1018_hacktool-netexec-execution.txt  [T1018,T1021]  HackTool - NetExec Execution
  T1021.002_hacktool-netexec-file-indicators.txt  [T1021.002,T1059.005]  HackTool - NetExec File Indicators
  T1021.003_hacktool-potential-impacket-lateral-movement-activity.txt  [T1021.003,T1047]  HackTool - Potential Impacket Lateral Movement Activity
  T1003_hacktool-potential-remote-credential-dumping-activity-via-cr.txt  [T1003]  HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
  T1574.001_hacktool-powerup-write-hijack-dll.txt  [T1574.001]  HackTool - Powerup Write Hijack DLL
  T1003.002_hacktool-pypykatz-credentials-dumping-activity.txt  [T1003.002]  HackTool - Pypykatz Credentials Dumping Activity
  T1003.002_hacktool-quarks-pwdump-execution.txt  [T1003.002]  HackTool - Quarks PwDump Execution
  T1059.003_hacktool-redmimicry-winnti-playbook-execution.txt  [T1059.003,T1106,T1218.011]  HackTool - RedMimicry Winnti Playbook Execution
  T1219.002_hacktool-remotekrbrelay-smb-relay-secrets-dump-module-indica.txt  [T1219.002]  HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
  T1087_hacktool-soaphound-execution.txt  [T1087]  HackTool - SOAPHound Execution
  T1003.001_hacktool-safetykatz-dump-indicator.txt  [T1003.001]  HackTool - SafetyKatz Dump Indicator
  T1053_hacktool-sharpersist-execution.txt  [T1053]  HackTool - SharPersist Execution
  T1090.001_hacktool-sharpchisel-execution.txt  [T1090.001]  HackTool - SharpChisel Execution
  T1210_hacktool-sharpwsus-wsuspendu-execution.txt  [T1210]  HackTool - SharpWSUS/WSUSpendu Execution
  T1552.001_hacktool-typical-hivenightmare-sam-file-export.txt  [T1552.001]  HackTool - Typical HiveNightmare SAM File Export
  T1046_hacktool-winpwn-execution.txt  [T1046,T1082,T1106,T1518,T1548.002,T1552.001,T1555,T1555.003]  HackTool - WinPwn Execution
  hacktool-wmiexec-default-powershell-command.txt  []  HackTool - Wmiexec Default Powershell Command
  T1003.001_hacktool-xordump-execution.txt  [T1003.001,T1036]  HackTool - XORDump Execution
  T1003_hacktool-execution-pe-metadata.txt  [T1003,T1588.002]  Hacktool Execution - PE Metadata
  T1021.001_hermetic-wiper-tg-process-patterns.txt  [T1021.001]  Hermetic Wiper TG Process Patterns
  T1685_hide-schedule-task-via-index-value-tamper.txt  [T1685]  Hide Schedule Task Via Index Value Tamper
  T1564.002_hiding-user-account-via-specialaccounts-registry-key.txt  [T1564.002]  Hiding User Account Via SpecialAccounts Registry Key
  T1219.002_hijack-legit-rdp-session-to-move-laterally.txt  [T1219.002]  Hijack Legit RDP Session to Move Laterally
  T1565.001_history-file-deletion.txt  [T1565.001]  History File Deletion
  T1685_hypervisor-enforced-paging-translation-disabled.txt  [T1685]  Hypervisor Enforced Paging Translation Disabled
  ie-zonemap-setting-downgraded-to-mycomputer-zone-for-http-pr.txt  []  IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
  ie-zonemap-setting-downgraded-to-mycomputer-zone-for-http-pr_2.txt  []  IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI
  T1566.001_iso-file-created-within-temp-folders.txt  [T1566.001]  ISO File Created Within Temp Folders
  T1218.011_icedid-malware-suspicious-single-digit-dll-execution-via-run.txt  [T1218.011]  IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32
  imagingdevices-unusual-parent-child-processes.txt  []  ImagingDevices Unusual Parent/Child Processes
  T1055_injected-browser-process-spawning-rundll32-guloader-activity.txt  [T1055]  Injected Browser Process Spawning Rundll32 - GuLoader Activity
  T1059_inline-python-execution-spawn-shell-via-os-system-library.txt  [T1059]  Inline Python Execution - Spawn Shell Via OS System Library
  T1053.002_interactive-at-job.txt  [T1053.002]  Interactive AT Job
  T1027_invoke-obfuscation-clip-launcher.txt  [T1027,T1059.001]  Invoke-Obfuscation CLIP+ Launcher
  T1027_invoke-obfuscation-obfuscated-iex-invocation.txt  [T1027,T1059.001]  Invoke-Obfuscation Obfuscated IEX Invocation
  T1027_invoke-obfuscation-stdin-launcher.txt  [T1027,T1059.001]  Invoke-Obfuscation STDIN+ Launcher
  T1027_invoke-obfuscation-var-launcher.txt  [T1027,T1059.001]  Invoke-Obfuscation VAR+ Launcher
  T1027_invoke-obfuscation-var-launcher-obfuscation.txt  [T1027,T1059.001]  Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
  T1027_invoke-obfuscation-via-stdin.txt  [T1027,T1059.001]  Invoke-Obfuscation Via Stdin
  T1027_invoke-obfuscation-via-use-clip.txt  [T1027,T1059.001]  Invoke-Obfuscation Via Use Clip
  T1027_invoke-obfuscation-via-use-mshta.txt  [T1027,T1059.001]  Invoke-Obfuscation Via Use MSHTA
  T1059.002_jxa-in-memory-execution-via-osascript.txt  [T1059.002,T1059.007]  JXA In-memory Execution Via OSAScript
  T1059.001_kalambur-backdoor-curl-tor-socks-proxy-execution.txt  [T1059.001,T1071.001,T1090,T1573]  Kalambur Backdoor Curl TOR SOCKS Proxy Execution
  T1547.001_kapeka-backdoor-autorun-persistence.txt  [T1547.001]  Kapeka Backdoor Autorun Persistence
  T1204.002_kapeka-backdoor-loaded-via-rundll32-exe.txt  [T1204.002,T1218.011]  Kapeka Backdoor Loaded Via Rundll32.EXE
  T1685_kaspersky-endpoint-security-stopped-via-commandline-linux.txt  [T1685]  Kaspersky Endpoint Security Stopped Via CommandLine - Linux
  T1129_katz-stealer-dll-loaded.txt  [T1129]  Katz Stealer DLL Loaded
  T1127_kavremover-dropped-binary-lolbin-usage.txt  [T1127]  Kavremover Dropped Binary LOLBIN Usage
  T1003.001_lsass-dump-keyword-in-commandline.txt  [T1003.001]  LSASS Dump Keyword In CommandLine
  T1003.001_lsass-process-dump-artefact-in-crashdumps-folder.txt  [T1003.001]  LSASS Process Dump Artefact In CrashDumps Folder
  T1003.001_lsass-process-memory-dump-creation-via-taskmgr-exe.txt  [T1003.001]  LSASS Process Memory Dump Creation Via Taskmgr.EXE
  T1003.001_lsass-process-memory-dump-files.txt  [T1003.001]  LSASS Process Memory Dump Files
  lace-tempest-cobalt-strike-download.txt  []  Lace Tempest Cobalt Strike Download
  lace-tempest-file-indicators.txt  []  Lace Tempest File Indicators
  T1574.001_lazarus-apt-dll-sideloading-activity.txt  [T1574.001]  Lazarus APT DLL Sideloading Activity
  T1036.005_lazarus-system-binary-masquerading.txt  [T1036.005]  Lazarus System Binary Masquerading
  T1218_legitimate-application-dropped-archive.txt  [T1218]  Legitimate Application Dropped Archive
  T1218_legitimate-application-dropped-executable.txt  [T1218]  Legitimate Application Dropped Executable
  T1218_legitimate-application-dropped-script.txt  [T1218]  Legitimate Application Dropped Script
  T1105_legitimate-application-writing-files-in-uncommon-location.txt  [T1105,T1218]  Legitimate Application Writing Files In Uncommon Location
  T1496_linux-crypto-mining-indicators.txt  [T1496]  Linux Crypto Mining Indicators
  T1496_linux-crypto-mining-pool-connections.txt  [T1496]  Linux Crypto Mining Pool Connections
  T1587_linux-hacktool-execution.txt  [T1587]  Linux HackTool Execution
  T1552.001_linux-recon-indicators.txt  [T1552.001,T1592.004]  Linux Recon Indicators
  T1059_linux-suspicious-child-process-from-node-js-react2shell.txt  [T1059,T1190]  Linux Suspicious Child Process from Node.js - React2Shell
  T1505.003_linux-webshell-indicators.txt  [T1505.003]  Linux Webshell Indicators
  T1195.002_litellm-teampcp-supply-chain-attack-indicators.txt  [T1195.002,T1543.002,T1560.001]  LiteLLM / TeamPCP Supply Chain Attack Indicators
  livekd-driver-creation-by-uncommon-process.txt  []  LiveKD Driver Creation By Uncommon Process
  livekd-kernel-memory-dump-file-created.txt  []  LiveKD Kernel Memory Dump File Created
  T1105_lolbas-onedrivestandaloneupdater-exe-proxy-download.txt  [T1105]  Lolbas OneDriveStandaloneUpdater.exe Proxy Download
  T1003.001_lsass-full-dump-request-via-dumptype-registry-settings.txt  [T1003.001]  Lsass Full Dump Request Via DumpType Registry Settings
  T1059.001_mercury-apt-activity.txt  [T1059.001]  MERCURY APT Activity
  T1021.003_mmc-spawning-windows-shell.txt  [T1021.003]  MMC Spawning Windows Shell
  T1021.003_mmc20-lateral-movement.txt  [T1021.003]  MMC20 Lateral Movement
  T1218_msdt-execution-via-answer-file.txt  [T1218]  MSDT Execution Via Answer File
  T1112_macro-enabled-in-a-potentially-suspicious-document.txt  [T1112]  Macro Enabled In A Potentially Suspicious Document
  T1574.001_malicious-dll-file-dropped-in-the-teams-or-onedrive-folder.txt  [T1574.001]  Malicious DLL File Dropped in the Teams or OneDrive Folder
  T1059.001_malicious-powershell-commandlets-processcreation.txt  [T1059.001,T1069,T1069.001,T1069.002,T1087,T1087.001,T1087.002,T1482]  Malicious PowerShell Commandlets - ProcessCreation
  T1059.001_malicious-powershell-scripts-filecreation.txt  [T1059.001]  Malicious PowerShell Scripts - FileCreation
  T1653_mask-system-power-settings-via-systemctl.txt  [T1653]  Mask System Power Settings Via Systemctl
  T1055.001_mavinject-inject-dll-into-running-process.txt  [T1055.001,T1218.013]  Mavinject Inject DLL Into Running Process
  T1574.001_microsoft-office-dll-sideload.txt  [T1574.001]  Microsoft Office DLL Sideload
  T1685_microsoft-office-protected-view-disabled.txt  [T1685]  Microsoft Office Protected View Disabled
  mint-sandstorm-log4j-wstomcat-process-execution.txt  []  Mint Sandstorm - Log4J Wstomcat Process Execution
  mshtml-dll-runhtmlapplication-suspicious-usage.txt  []  Mshtml.DLL RunHTMLApplication Suspicious Usage
  T1587.001_mustang-panda-dropper.txt  [T1587.001]  Mustang Panda Dropper
  T1112_net-ngenassemblyusagelog-registry-key-tamper.txt  [T1112]  NET NGenAssemblyUsageLog Registry Key Tamper
  T1003.003_ntds-exfiltration-filename-patterns.txt  [T1003.003]  NTDS Exfiltration Filename Patterns
  T1003.003_ntds-dit-creation-by-uncommon-parent-process.txt  [T1003.003]  NTDS.DIT Creation By Uncommon Parent Process
  T1003.002_ntds-dit-creation-by-uncommon-process.txt  [T1003.002,T1003.003]  NTDS.DIT Creation By Uncommon Process
  T1112_netntlm-downgrade-attack-registry.txt  [T1112,T1685]  NetNTLM Downgrade Attack - Registry
  T1496_network-communication-with-crypto-mining-pool.txt  [T1496]  Network Communication With Crypto Mining Pool
  T1203_network-connection-initiated-by-eqnedt32-exe.txt  [T1203]  Network Connection Initiated By Eqnedt32.EXE
  T1055_network-connection-initiated-via-notepad-exe.txt  [T1055]  Network Connection Initiated Via Notepad.EXE
  T1082_network-reconnaissance-activity.txt  [T1082,T1087]  Network Reconnaissance Activity
  T1546.003_new-activescripteventconsumer-created-via-wmic-exe.txt  [T1546.003]  New ActiveScriptEventConsumer Created Via Wmic.EXE
  T1112_new-dns-serverlevelplugindll-installed.txt  [T1112,T1574.001]  New DNS ServerLevelPluginDll Installed
  T1112_new-dns-serverlevelplugindll-installed-via-dnscmd-exe.txt  [T1112,T1574.001]  New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
  new-file-association-using-exefile.txt  []  New File Association Using Exefile
  T1546.007_new-netsh-helper-dll-registered-from-a-suspicious-location.txt  [T1546.007]  New Netsh Helper DLL Registered From A Suspicious Location
  T1547.001_new-run-key-pointing-to-suspicious-folder.txt  [T1547.001]  New RUN Key Pointing to Suspicious Folder
  T1547.003_new-timeproviders-registered-with-uncommon-dll-name.txt  [T1547.003]  New TimeProviders Registered With Uncommon DLL Name
  T1068_non-standard-nsswitch-conf-creation-potential-cve-2025-32463.txt  [T1068]  Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
  T1112_non-privileged-usage-of-reg-or-powershell.txt  [T1112]  Non-privileged Usage of Reg or Powershell
  ntdllpipe-like-activity-execution.txt  []  NtdllPipe Like Activity Execution
  T1068_omigod-scx-runasprovider-executescript.txt  [T1068,T1190,T1203]  OMIGOD SCX RunAsProvider ExecuteScript
  T1068_omigod-scx-runasprovider-executeshellcommand.txt  [T1068,T1190,T1203]  OMIGOD SCX RunAsProvider ExecuteShellCommand
  T1059.002_osacompile-run-only-execution.txt  [T1059.002]  OSACompile Run-Only Execution
  T1059.001_obfuscated-powershell-oneliner-execution.txt  [T1059.001,T1685]  Obfuscated PowerShell OneLiner Execution
  T1195_octopus-scanner-malware.txt  [T1195,T1195.001]  Octopus Scanner Malware
  T1566.001_office-macro-file-creation-from-suspicious-process.txt  [T1566.001]  Office Macro File Creation From Suspicious Process
  T1112_office-macros-warning-disabled.txt  [T1112]  Office Macros Warning Disabled
  T1218.001_onenote-exe-execution-of-malicious-embedded-scripts.txt  [T1218.001]  OneNote.EXE Execution of Malicious Embedded Scripts
  onyx-sleet-apt-file-creation-indicators.txt  []  Onyx Sleet APT File Creation Indicators
  T1218_openwith-exe-executes-specified-binary.txt  [T1218]  OpenWith.exe Executes Specified Binary
  T1012_operation-wocao-activity.txt  [T1012,T1027,T1036.004,T1053.005,T1059.001]  Operation Wocao Activity
  T1059_outlook-enableunsafeclientmailrules-setting-enabled.txt  [T1059,T1202]  Outlook EnableUnsafeClientMailRules Setting Enabled
  T1112_outlook-enableunsafeclientmailrules-setting-enabled-registry.txt  [T1112]  Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
  T1008_outlook-macro-execution-without-warning-setting-enabled.txt  [T1008,T1137,T1546]  Outlook Macro Execution Without Warning Setting Enabled
  T1059_pcre-net-package-image-load.txt  [T1059]  PCRE.NET Package Image Load
  T1059_pcre-net-package-temp-files.txt  [T1059]  PCRE.NET Package Temp Files
  pdf-file-created-by-regedit-exe.txt  []  PDF File Created By RegEdit.EXE
  T1136.002_psexec-remote-execution-file-artefact.txt  [T1136.002,T1543.003,T1570]  PSEXEC Remote Execution File Artefact
  T1018_pua-adfind-suspicious-execution.txt  [T1018,T1069.002,T1087.002,T1482]  PUA - AdFind Suspicious Execution
  T1134.002_pua-advancedrun-suspicious-execution.txt  [T1134.002]  PUA - AdvancedRun Suspicious Execution
  T1090.001_pua-chisel-tunneling-tool-execution.txt  [T1090.001]  PUA - Chisel Tunneling Tool Execution
  T1685_pua-cleanwipe-execution.txt  [T1685]  PUA - CleanWipe Execution
  T1003.003_pua-dit-snapshot-viewer.txt  [T1003.003]  PUA - DIT Snapshot Viewer
  T1095_pua-netcat-suspicious-execution.txt  [T1095]  PUA - Netcat Suspicious Execution
  T1572_pua-ngrok-execution.txt  [T1572]  PUA - Ngrok Execution
  T1569.002_pua-nircmd-execution-as-local-system.txt  [T1569.002]  PUA - NirCmd Execution As LOCAL SYSTEM
  T1048_pua-restic-backup-tool-execution.txt  [T1048,T1567.002]  PUA - Restic Backup Tool Execution
  T1569.002_pua-runxcmd-execution.txt  [T1569.002]  PUA - RunXCmd Execution
  T1087.002_pua-suspicious-activedirectory-enumeration-via-adfind-exe.txt  [T1087.002]  PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
  papercut-mf-ng-exploitation-related-indicators.txt  []  PaperCut MF/NG Exploitation Related Indicators
  papercut-mf-ng-potential-exploitation.txt  []  PaperCut MF/NG Potential Exploitation
  peach-sandstorm-apt-process-activity-indicators.txt  []  Peach Sandstorm APT Process Activity Indicators
  persistence-via-hhctrl-ocx.txt  []  Persistence Via Hhctrl.ocx
  T1566_phishing-pattern-iso-in-archive.txt  [T1566]  Phishing Pattern ISO in Archive
  pikabot-fake-dll-extension-execution-via-rundll32-exe.txt  []  Pikabot Fake DLL Extension Execution Via Rundll32.EXE
  T1027_ping-hex-ip.txt  [T1027,T1140]  Ping Hex IP
  T1574.001_pingback-backdoor-activity.txt  [T1574.001]  Pingback Backdoor Activity
  T1574.001_pingback-backdoor-dll-loading-activity.txt  [T1574.001]  Pingback Backdoor DLL Loading Activity
  T1574.001_pingback-backdoor-file-indicators.txt  [T1574.001]  Pingback Backdoor File Indicators
  T1574.011_possible-privilege-escalation-via-weak-service-permissions.txt  [T1574.011]  Possible Privilege Escalation via Weak Service Permissions
  T1053_potential-actinium-persistence-activity.txt  [T1053,T1053.005]  Potential ACTINIUM Persistence Activity
  T1685_potential-amsi-bypass-via-net-reflection.txt  [T1685]  Potential AMSI Bypass Via .NET Reflection
  T1685_potential-amsi-com-server-hijacking.txt  [T1685]  Potential AMSI COM Server Hijacking
  potential-apt-fin7-reconnaissance-powertrash-related-activit.txt  []  Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity
  potential-apt-fin7-related-powershell-script-created.txt  []  Potential APT FIN7 Related PowerShell Script Created
  potential-apt-mustang-panda-activity-against-australian-gov.txt  []  Potential APT Mustang Panda Activity Against Australian Gov
  T1059.005_potential-apt10-cloud-hopper-activity.txt  [T1059.005]  Potential APT10 Cloud Hopper Activity
  T1127_potential-arbitrary-code-execution-via-node-exe.txt  [T1127]  Potential Arbitrary Code Execution Via Node.EXE
  T1059_potential-atlassian-confluence-cve-2021-26084-exploitation-a.txt  [T1059,T1190]  Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt
  potential-attachment-manager-settings-associations-tamper.txt  []  Potential Attachment Manager Settings Associations Tamper
  potential-attachment-manager-settings-attachments-tamper.txt  []  Potential Attachment Manager Settings Attachments Tamper
  T1685.001_potential-autologger-sessions-tampering.txt  [T1685.001]  Potential AutoLogger Sessions Tampering
  T1012_potential-baby-shark-malware-activity.txt  [T1012,T1059.001,T1059.003,T1218.005]  Potential Baby Shark Malware Activity
  T1140_potential-base64-decoded-from-images.txt  [T1140]  Potential Base64 Decoded From Images
  T1059.001_potential-blackbyte-ransomware-activity.txt  [T1059.001,T1140,T1485,T1498]  Potential BlackByte Ransomware Activity
  potential-coldsteel-persistence-service-dll-creation.txt  []  Potential COLDSTEEL Persistence Service DLL Creation
  potential-coldsteel-persistence-service-dll-load.txt  []  Potential COLDSTEEL Persistence Service DLL Load
  potential-coldsteel-rat-file-indicators.txt  []  Potential COLDSTEEL RAT File Indicators
  potential-coldsteel-rat-windows-user-creation.txt  []  Potential COLDSTEEL RAT Windows User Creation
  T1219.002_potential-csharp-streamer-rat-loading-net-executable-image.txt  [T1219.002]  Potential CSharp Streamer RAT Loading .NET Executable Image
  T1203_potential-cve-2021-26857-exploitation-attempt.txt  [T1203]  Potential CVE-2021-26857 Exploitation Attempt
  T1059_potential-cve-2021-40444-exploitation-attempt.txt  [T1059]  Potential CVE-2021-40444 Exploitation Attempt
  T1190_potential-cve-2021-44228-exploitation-attempt-vmware-horizon.txt  [T1190]  Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon
  T1190_potential-cve-2022-26809-exploitation-attempt.txt  [T1190,T1569.002]  Potential CVE-2022-26809 Exploitation Attempt
  potential-cve-2023-21554-queuejumper-exploitation.txt  []  Potential CVE-2023-21554 QueueJumper Exploitation
  T1505.001_potential-cve-2023-27363-exploitation-hta-file-creation-by-f.txt  [T1505.001]  Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader
  potential-cve-2023-36874-exploitation-fake-wermgr-exe-creati.txt  []  Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
  T1187_potential-cve-2026-33829-exploitation-windows-snipping-tool.txt  [T1187]  Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI
  T1204.001_potential-clickfix-execution-pattern-registry.txt  [T1204.001]  Potential ClickFix Execution Pattern - Registry
  T1059_potential-cobaltstrike-process-patterns.txt  [T1059]  Potential CobaltStrike Process Patterns
  T1021.002_potential-cobaltstrike-service-installations-registry.txt  [T1021.002,T1543.003,T1569.002]  Potential CobaltStrike Service Installations - Registry
  potential-compromised-3cxdesktopapp-beaconing-activity-netco.txt  []  Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon
  T1218_potential-compromised-3cxdesktopapp-update-activity.txt  [T1218]  Potential Compromised 3CXDesktopApp Update Activity
  T1005_potential-conti-ransomware-database-dumping-activity-via-sql.txt  [T1005]  Potential Conti Ransomware Database Dumping Activity Via SQLCmd
  T1003_potential-credential-dumping-attempt-using-new-networkprovid.txt  [T1003]  Potential Credential Dumping Attempt Using New NetworkProvider - CLI
  T1496_potential-crypto-mining-activity.txt  [T1496]  Potential Crypto Mining Activity
  T1574.001_potential-dll-sideloading-via-vmware-xfer.txt  [T1574.001]  Potential DLL Sideloading Via VMware Xfer
  T1574.001_potential-dll-sideloading-via-comctl32-dll.txt  [T1574.001]  Potential DLL Sideloading Via comctl32.dll
  T1059.001_potential-data-exfiltration-activity-via-commandline-tools.txt  [T1059.001]  Potential Data Exfiltration Activity Via CommandLine Tools
  T1185_potential-data-stealing-via-chromium-headless-debugging.txt  [T1185,T1564.003]  Potential Data Stealing Via Chromium Headless Debugging
  potential-defense-evasion-activity-via-emoji-usage-in-comman.txt  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
  potential-defense-evasion-activity-via-emoji-usage-in-comman_2.txt  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2
  potential-defense-evasion-activity-via-emoji-usage-in-comman_3.txt  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
  potential-defense-evasion-activity-via-emoji-usage-in-comman_4.txt  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4
  T1036.002_potential-defense-evasion-via-right-to-left-override.txt  [T1036.002]  Potential Defense Evasion Via Right-to-Left Override
  T1218_potential-devil-bait-malware-reconnaissance.txt  [T1218]  Potential Devil Bait Malware Reconnaissance
  potential-devil-bait-related-indicator.txt  []  Potential Devil Bait Related Indicator
  T1574.001_potential-eacore-dll-sideloading.txt  [T1574.001]  Potential EACore.DLL Sideloading
  T1574.001_potential-edputil-dll-sideloading.txt  [T1574.001]  Potential Edputil.DLL Sideloading
  T1027_potential-emotet-activity.txt  [T1027,T1059.001]  Potential Emotet Activity
  T1218.010_potential-empiremonkey-activity.txt  [T1218.010]  Potential EmpireMonkey Activity
  T1685.001_potential-eventlog-file-location-tampering.txt  [T1685.001]  Potential EventLog File Location Tampering
  potential-exploitation-attempt-from-office-application.txt  []  Potential Exploitation Attempt From Office Application
  T1190_potential-exploitation-attempt-of-undocumented-windowsserver.txt  [T1190]  Potential Exploitation Attempt Of Undocumented WindowsServer RCE
  potential-exploitation-of-cve-2024-3094-suspicious-ssh-child.txt  []  Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process
  T1059.001_potential-exploitation-of-crushftp-rce-vulnerability-cve-202.txt  [T1059.001,T1059.003,T1068,T1190]  Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
  T1059.001_potential-exploitation-of-goanywhere-mft-vulnerability.txt  [T1059.001,T1133,T1190]  Potential Exploitation of GoAnywhere MFT Vulnerability
  T1105_potential-exploitation-of-rce-vulnerability-cve-2025-33053.txt  [T1105,T1218]  Potential Exploitation of RCE Vulnerability CVE-2025-33053
  T1105_potential-exploitation-of-rce-vulnerability-cve-2025-33053-i.txt  [T1105,T1218]  Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load
  T1036.002_potential-file-extension-spoofing-using-right-to-left-overri.txt  [T1036.002]  Potential File Extension Spoofing Using Right-to-Left Override
  T1082_potential-gobrat-file-discovery-via-grep.txt  [T1082]  Potential GobRAT File Discovery Via Grep
  potential-goofy-guineapig-backdoor-activity.txt  []  Potential Goofy Guineapig Backdoor Activity
  potential-goofy-guineapig-goolgeupdate-process-anomaly.txt  []  Potential Goofy Guineapig GoolgeUpdate Process Anomaly
  T1574.001_potential-iviewers-dll-sideloading.txt  [T1574.001]  Potential Iviewers.DLL Sideloading
  T1547.001_potential-kamikakabot-activity-winlogon-shell-persistence.txt  [T1547.001]  Potential KamiKakaBot Activity - Winlogon Shell Persistence
  potential-kapeka-decrypted-backdoor-indicator.txt  []  Potential Kapeka Decrypted Backdoor Indicator
  T1685_potential-ke3chang-tidepool-malware-activity.txt  [T1685]  Potential Ke3chang/TidePool Malware Activity
  T1003.001_potential-lsass-process-dump-via-procdump.txt  [T1003.001,T1036]  Potential LSASS Process Dump Via Procdump
  T1218.005_potential-lethalhta-technique-execution.txt  [T1218.005]  Potential LethalHTA Technique Execution
  T1563.002_potential-mstsc-shadowing-activity.txt  [T1563.002]  Potential MSTSC Shadowing Activity
  T1134.001_potential-meterpreter-cobaltstrike-activity.txt  [T1134.001,T1134.002]  Potential Meterpreter/CobaltStrike Activity
  T1574.001_potential-mpclient-dll-sideloading.txt  [T1574.001]  Potential Mpclient.DLL Sideloading
  T1574.001_potential-mpclient-dll-sideloading-via-defender-binaries.txt  [T1574.001]  Potential Mpclient.DLL Sideloading Via Defender Binaries
  potential-muddywater-apt-activity.txt  []  Potential MuddyWater APT Activity
  T1112_potential-netwire-rat-activity-registry.txt  [T1112]  Potential NetWire RAT Activity - Registry
  T1059_potential-netcat-reverse-shell-execution.txt  [T1059]  Potential Netcat Reverse Shell Execution
  T1574.008_potential-notepad-cve-2025-49144-exploitation.txt  [T1574.008]  Potential Notepad++ CVE-2025-49144 Exploitation
  potential-php-reverse-shell.txt  []  Potential PHP Reverse Shell
  T1546.015_potential-psfactorybuffer-com-hijacking.txt  [T1546.015]  Potential PSFactoryBuffer COM Hijacking
  potential-perl-reverse-shell-execution.txt  []  Potential Perl Reverse Shell Execution
  T1546.012_potential-persistence-via-app-paths-default-property.txt  [T1546.012]  Potential Persistence Via App Paths Default Property
  potential-persistence-via-autodialdll.txt  []  Potential Persistence Via AutodialDLL
  potential-persistence-via-chm-helper-dll.txt  []  Potential Persistence Via CHM Helper DLL
  potential-persistence-via-dllpathoverride.txt  []  Potential Persistence Via DLLPathOverride
  T1137.006_potential-persistence-via-excel-add-in-registry.txt  [T1137.006]  Potential Persistence Via Excel Add-in - Registry
  T1546.012_potential-persistence-via-globalflags.txt  [T1546.012]  Potential Persistence Via GlobalFlags
  potential-persistence-via-lsa-extensions.txt  []  Potential Persistence Via LSA Extensions
  T1037.001_potential-persistence-via-logon-scripts-commandline.txt  [T1037.001]  Potential Persistence Via Logon Scripts - CommandLine
  T1137.006_potential-persistence-via-microsoft-office-add-in.txt  [T1137.006]  Potential Persistence Via Microsoft Office Add-In
  T1137_potential-persistence-via-microsoft-office-startup-folder.txt  [T1137]  Potential Persistence Via Microsoft Office Startup Folder
  potential-persistence-via-mpnotify.txt  []  Potential Persistence Via Mpnotify
  potential-persistence-via-mycomputer-registry-keys.txt  []  Potential Persistence Via MyComputer Registry Keys
  T1137.003_potential-persistence-via-outlook-form.txt  [T1137.003]  Potential Persistence Via Outlook Form
  T1112_potential-persistence-via-outlook-home-page.txt  [T1112]  Potential Persistence Via Outlook Home Page
  T1008_potential-persistence-via-outlook-loadmacroprovideronboot-se.txt  [T1008,T1137,T1546]  Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
  T1112_potential-persistence-via-outlook-today-page.txt  [T1112]  Potential Persistence Via Outlook Today Page
  T1543.001_potential-persistence-via-plistbuddy.txt  [T1543.001,T1543.004]  Potential Persistence Via PlistBuddy
  T1053.005_potential-persistence-via-powershell-search-order-hijacking.txt  [T1053.005,T1059.001]  Potential Persistence Via Powershell Search Order Hijacking - Task
  T1546.011_potential-persistence-via-shim-database-in-uncommon-location.txt  [T1546.011]  Potential Persistence Via Shim Database In Uncommon Location
  potential-persistence-via-typedpaths.txt  []  Potential Persistence Via TypedPaths
  T1055.012_potential-pikabot-hollowing-activity.txt  [T1055.012]  Potential Pikabot Hollowing Activity
  T1574.001_potential-plugx-activity.txt  [T1574.001]  Potential PlugX Activity
  potential-powershell-execution-policy-tampering-proccreation.txt  []  Potential PowerShell Execution Policy Tampering - ProcCreation
  T1027_potential-powershell-obfuscation-via-wchar-char.txt  [T1027,T1059.001]  Potential PowerShell Obfuscation Via WCHAR/CHAR
  T1574_potential-printnightmare-exploitation-attempt.txt  [T1574]  Potential PrintNightmare Exploitation Attempt
  potential-privilege-escalation-attempt-via-exe-local-techniq.txt  []  Potential Privilege Escalation Attempt Via .Exe.Local Technique
  T1587.001_potential-privilege-escalation-to-local-system.txt  [T1587.001]  Potential Privilege Escalation To LOCAL SYSTEM
  T1574.011_potential-privilege-escalation-via-service-permissions-weakn.txt  [T1574.011]  Potential Privilege Escalation via Service Permissions Weakness
  T1055_potential-process-injection-via-msra-exe.txt  [T1055]  Potential Process Injection Via Msra.EXE
  T1218_potential-provisioning-registry-key-abuse-for-binary-proxy-e.txt  [T1218]  Potential Provisioning Registry Key Abuse For Binary Proxy Execution
  T1218_potential-provisioning-registry-key-abuse-for-binary-proxy-e_2.txt  [T1218]  Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
  T1587.001_potential-psexec-remote-execution.txt  [T1587.001]  Potential PsExec Remote Execution
  T1112_potential-qakbot-registry-activity.txt  [T1112]  Potential Qakbot Registry Activity
  potential-qakbot-rundll32-execution.txt  []  Potential Qakbot Rundll32 Execution
  T1572_potential-rdp-tunneling-via-plink.txt  [T1572]  Potential RDP Tunneling Via Plink
  T1572_potential-rdp-tunneling-via-ssh.txt  [T1572]  Potential RDP Tunneling Via SSH
  T1491.001_potential-ransomware-activity-using-legalnotice-message.txt  [T1491.001]  Potential Ransomware Activity Using LegalNotice Message
  potential-raspberry-robin-dot-ending-file.txt  []  Potential Raspberry Robin Dot Ending File
  T1574.001_potential-rcdll-dll-sideloading.txt  [T1574.001]  Potential Rcdll.DLL Sideloading
  T1053.005_potential-registry-persistence-attempt-via-windows-telemetry.txt  [T1053.005]  Potential Registry Persistence Attempt Via Windows Telemetry
  potential-renamed-rundll32-execution.txt  []  Potential Renamed Rundll32 Execution
  T1547_potential-ripzip-attack-on-startup-folder.txt  [T1547]  Potential RipZip Attack on Startup Folder
  T1574.001_potential-rjvplatform-dll-sideloading-from-non-default-locat.txt  [T1574.001]  Potential RjvPlatform.DLL Sideloading From Non-Default Location
  T1547.001_potential-ryuk-ransomware-activity.txt  [T1547.001]  Potential Ryuk Ransomware Activity
  T1003.002_potential-sam-database-dump.txt  [T1003.002]  Potential SAM Database Dump
  potential-snake-malware-installation-cli-arguments-indicator.txt  []  Potential SNAKE Malware Installation CLI Arguments Indicator
  potential-snake-malware-persistence-service-execution.txt  []  Potential SNAKE Malware Persistence Service Execution
  T1190_potential-sharepoint-toolshell-cve-2025-53770-exploitation-i.txt  [T1190]  Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators
  potential-signing-bypass-via-windows-developer-features-regi.txt  []  Potential Signing Bypass Via Windows Developer Features - Registry
  T1574.001_potential-smadhook-dll-sideloading.txt  [T1574.001]  Potential SmadHook.DLL Sideloading
  T1204_potential-snatch-ransomware-activity.txt  [T1204]  Potential Snatch Ransomware Activity
  T1547.001_potential-startup-shortcut-persistence-via-powershell-exe.txt  [T1547.001]  Potential Startup Shortcut Persistence Via PowerShell.EXE
  T1218_potential-suspicious-child-process-of-3cxdesktopapp.txt  [T1218]  Potential Suspicious Child Process Of 3CXDesktopApp
  T1003.001_potential-sysinternals-procdump-evasion.txt  [T1003.001,T1036]  Potential SysInternals ProcDump Evasion
  T1574.001_potential-system-dll-sideloading-from-non-system-locations.txt  [T1574.001]  Potential System DLL Sideloading From Non System Locations
  T1685_potential-tampering-with-security-products-via-wmic.txt  [T1685]  Potential Tampering With Security Products Via WMIC
  T1112_potential-ursnif-malware-activity-registry.txt  [T1112]  Potential Ursnif Malware Activity - Registry
  T1574.001_potential-waveedit-dll-sideloading.txt  [T1574.001]  Potential Waveedit.DLL Sideloading
  T1036.003_potential-werfault-reflectdebugger-registry-value-abuse.txt  [T1036.003]  Potential WerFault ReflectDebugger Registry Value Abuse
  T1106_potential-winapi-calls-via-commandline.txt  [T1106]  Potential WinAPI Calls Via CommandLine
  T1027_potential-winnti-dropper-activity.txt  [T1027]  Potential Winnti Dropper Activity
  potential-wizardupdate-malware-infection.txt  []  Potential WizardUpdate Malware Infection
  T1574.001_potential-appverifui-dll-sideloading.txt  [T1574.001]  Potential appverifUI.DLL Sideloading
  T1127_potentially-suspicious-asp-net-compilation-via-aspnetcompile.txt  [T1127]  Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
  potentially-suspicious-call-to-win32-nteventlogfile-class.txt  []  Potentially Suspicious Call To Win32_NTEventlogFile Class
  T1218.010_potentially-suspicious-child-process-of-regsvr32.txt  [T1218.010]  Potentially Suspicious Child Process Of Regsvr32
  T1059.001_potentially-suspicious-command-executed-via-run-dialog-box-r.txt  [T1059.001]  Potentially Suspicious Command Executed Via Run Dialog Box - Registry
  T1548.002_potentially-suspicious-event-viewer-child-process.txt  [T1548.002]  Potentially Suspicious Event Viewer Child Process
  T1059_potentially-suspicious-execution-from-parent-process-in-publ.txt  [T1059,T1564]  Potentially Suspicious Execution From Parent Process In Public Folder
  T1003_potentially-suspicious-odbc-driver-registered.txt  [T1003]  Potentially Suspicious ODBC Driver Registered
  T1059.001_powershell-base64-encoded-frombase64string-cmdlet.txt  [T1059.001,T1140]  PowerShell Base64 Encoded FromBase64String Cmdlet
  T1059.001_powershell-base64-encoded-iex-cmdlet.txt  [T1059.001]  PowerShell Base64 Encoded IEX Cmdlet
  T1027_powershell-base64-encoded-reflective-assembly-load.txt  [T1027,T1059.001,T1620]  PowerShell Base64 Encoded Reflective Assembly Load
  T1685_powershell-defender-threat-severity-default-action-set-to-al.txt  [T1685]  PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'
  T1059_powershell-download-and-execution-cradles.txt  [T1059]  PowerShell Download and Execution Cradles
  T1552.004_powershell-get-process-lsass.txt  [T1552.004]  PowerShell Get-Process LSASS
  T1112_powershell-logging-disabled-via-registry-key-tampering.txt  [T1112,T1564.001]  PowerShell Logging Disabled Via Registry Key Tampering
  T1003.002_powershell-sam-copy.txt  [T1003.002]  PowerShell SAM Copy
  T1569.002_powershell-as-a-service-in-registry.txt  [T1569.002]  PowerShell as a Service in Registry
  T1685_powershell-base64-encoded-mppreference-cmdlet.txt  [T1685]  Powershell Base64 Encoded MpPreference Cmdlet
  T1685_powershell-defender-disable-scan-feature.txt  [T1685]  Powershell Defender Disable Scan Feature
  T1027.009_powershell-token-obfuscation-process-creation.txt  [T1027.009]  Powershell Token Obfuscation - Process Creation
  T1070.004_prefetch-file-deleted.txt  [T1070.004]  Prefetch File Deleted
  T1105_printbrm-zip-creation-of-extraction.txt  [T1105,T1564.004]  PrintBrm ZIP Creation of Extraction
  T1036_process-execution-from-a-potentially-suspicious-folder.txt  [T1036]  Process Execution From A Potentially Suspicious Folder
  T1068_process-explorer-driver-creation-by-non-sysinternals-binary.txt  [T1068]  Process Explorer Driver Creation By Non-Sysinternals Binary
  T1036.003_ps-exe-renamed-sysinternals-tool.txt  [T1036.003]  Ps.exe Renamed SysInternals Tool
  psexec-service-child-process-execution-as-local-system.txt  []  PsExec Service Child Process Execution as LOCAL SYSTEM
  T1587.001_psexec-paexec-escalation-to-local-system.txt  [T1587.001]  PsExec/PAExec Escalation to LOCAL SYSTEM
  T1685_python-function-execution-security-warning-disabled-in-excel.txt  [T1685]  Python Function Execution Security Warning Disabled In Excel
  T1685_python-function-execution-security-warning-disabled-in-excel_2.txt  [T1685]  Python Function Execution Security Warning Disabled In Excel - Registry
  T1027.010_python-one-liners-with-base64-decoding-linux.txt  [T1027.010,T1059.006]  Python One-Liners with Base64 Decoding - Linux
  python-reverse-shell-execution-via-pty-and-socket-modules.txt  []  Python Reverse Shell Execution Via PTY And Socket Modules
  T1059_python-spawning-pretty-tty-on-windows.txt  [T1059]  Python Spawning Pretty TTY on Windows
  qakbot-regsvr32-calc-pattern.txt  []  Qakbot Regsvr32 Calc Pattern
  T1112_rdp-sensitive-settings-changed.txt  [T1112]  RDP Sensitive Settings Changed
  T1685_raccine-uninstall.txt  [T1685]  Raccine Uninstall
  T1560.001_rar-usage-with-password-and-compression-level.txt  [T1560.001]  Rar Usage with Password and Compression Level
  T1059.001_raspberry-robin-initial-execution-from-external-drive.txt  [T1059.001]  Raspberry Robin Initial Execution From External Drive
  T1059.001_raspberry-robin-subsequent-execution-of-commands.txt  [T1059.001]  Raspberry Robin Subsequent Execution of Commands
  T1112_redmimicry-winnti-playbook-registry-manipulation.txt  [T1112]  RedMimicry Winnti Playbook Registry Manipulation
  T1548_regedit-as-trusted-installer.txt  [T1548]  Regedit as Trusted Installer
  T1490_registry-disable-system-restore.txt  [T1490]  Registry Disable System Restore
  T1112_registry-modification-for-oci-dll-redirection.txt  [T1112,T1574.001]  Registry Modification for OCI DLL Redirection
  T1547.001_registry-persistence-via-explorer-run-key.txt  [T1547.001]  Registry Persistence via Explorer Run Key
  T1564.001_registry-persistence-via-service-in-safe-mode.txt  [T1564.001]  Registry Persistence via Service in Safe Mode
  T1219.002_remote-access-tool-anydesk-silent-installation.txt  [T1219.002]  Remote Access Tool - AnyDesk Silent Installation
  T1190_remote-access-tool-screenconnect-server-web-shell-execution.txt  [T1190]  Remote Access Tool - ScreenConnect Server Web Shell Execution
  T1220_remote-xsl-execution-via-msxsl-exe.txt  [T1220]  Remote XSL Execution Via Msxsl.EXE
  T1218_remotefxvgpudisablement-abuse-via-atomictestharnesses.txt  [T1218]  RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses
  T1685_removal-of-amsi-provider-registry-keys.txt  [T1685]  Removal Of AMSI Provider Registry Keys
  renamed-vscode-code-tunnel-execution-file-indicator.txt  []  Renamed VsCode Code Tunnel Execution - File Indicator
  T1112_restrictedadminmode-registry-value-tampering.txt  [T1112]  RestrictedAdminMode Registry Value Tampering
  T1112_restrictedadminmode-registry-value-tampering-proccreation.txt  [T1112]  RestrictedAdminMode Registry Value Tampering - ProcCreation
  T1553.004_root-certificate-installed-from-susp-locations.txt  [T1553.004]  Root Certificate Installed From Susp Locations
  T1564.004_run-powershell-script-from-ads.txt  [T1564.004]  Run PowerShell Script from ADS
  T1059_run-powershell-script-from-redirected-input-stream.txt  [T1059]  Run PowerShell Script from Redirected Input Stream
  T1218.011_rundll32-spawning-explorer.txt  [T1218.011]  RunDLL32 Spawning Explorer
  T1070.003_runmru-registry-key-deletion-registry.txt  [T1070.003]  RunMRU Registry Key Deletion - Registry
  T1202_rundll32-execution-without-commandline-parameters.txt  [T1202]  Rundll32 Execution Without CommandLine Parameters
  T1021.002_rundll32-execution-without-parameters.txt  [T1021.002,T1569.002,T1570]  Rundll32 Execution Without Parameters
  T1133_running-chrome-vpn-extensions-via-the-registry-2-vpn-extensi.txt  [T1133]  Running Chrome VPN Extensions via the Registry 2 VPN Extension
  snake-malware-covert-store-registry-key.txt  []  SNAKE Malware Covert Store Registry Key
  snake-malware-werfault-persistence-file-creation.txt  []  SNAKE Malware WerFault Persistence File Creation
  T1546_sourgum-actor-behaviours.txt  [T1546,T1546.015]  SOURGUM Actor Behaviours
  T1005_sqlite-chromium-profile-data-db-access.txt  [T1005,T1539,T1555.003]  SQLite Chromium Profile Data DB Access
  T1005_sqlite-firefox-profile-data-db-access.txt  [T1005,T1539]  SQLite Firefox Profile Data DB Access
  T1053.005_schtasks-creation-or-modification-with-system-privileges.txt  [T1053.005]  Schtasks Creation Or Modification With SYSTEM Privileges
  screenconnect-slashandgrab-exploitation-indicators.txt  []  ScreenConnect - SlashAndGrab Exploitation Indicators
  T1047_script-event-consumer-spawning-process.txt  [T1047]  Script Event Consumer Spawning Process
  T1005_script-interpreter-spawning-credential-scanner-linux.txt  [T1005,T1059.004,T1552]  Script Interpreter Spawning Credential Scanner - Linux
  T1005_script-interpreter-spawning-credential-scanner-windows.txt  [T1005,T1059.007,T1552]  Script Interpreter Spawning Credential Scanner - Windows
  T1036_sdiagnhost-calling-suspicious-child-process.txt  [T1036,T1218]  Sdiagnhost Calling Suspicious Child Process
  T1112_security-event-logging-disabled-via-minint-registry-key-regi.txt  [T1112,T1685.001]  Security Event Logging Disabled via MiniNt Registry Key - Registry Set
  T1685_security-service-disabled-via-reg-exe.txt  [T1685]  Security Service Disabled Via Reg.EXE
  T1490_sensitive-file-access-via-volume-shadow-copy-backup.txt  [T1490]  Sensitive File Access Via Volume Shadow Copy Backup
  T1053.005_serpent-backdoor-payload-execution-via-scheduled-task.txt  [T1053.005,T1059.006]  Serpent Backdoor Payload Execution Via Scheduled Task
  T1112_service-binary-in-suspicious-folder.txt  [T1112]  Service Binary in Suspicious Folder
  T1195.002_shai-hulud-2-0-malicious-npm-package-installation.txt  [T1195.002]  Shai-Hulud 2.0 Malicious NPM Package Installation
  T1195.002_shai-hulud-2-0-malicious-npm-package-installation-linux.txt  [T1195.002]  Shai-Hulud 2.0 Malicious NPM Package Installation - Linux
  T1195.002_shai-hulud-malicious-bun-execution.txt  [T1195.002,T1203]  Shai-Hulud Malicious Bun Execution
  T1195.002_shai-hulud-malicious-bun-execution-linux.txt  [T1195.002,T1203]  Shai-Hulud Malicious Bun Execution - Linux
  T1119_shai-hulud-malicious-github-workflow-creation.txt  [T1119,T1552.001]  Shai-Hulud Malicious GitHub Workflow Creation
  T1059_shai-hulud-malware-indicators-linux.txt  [T1059]  Shai-Hulud Malware Indicators - Linux
  T1059_shai-hulud-malware-indicators-windows.txt  [T1059]  Shai-Hulud Malware Indicators - Windows
  T1005_shai-hulud-npm-package-malicious-exfiltration-via-curl.txt  [T1005,T1041]  Shai-Hulud NPM Package Malicious Exfiltration via Curl
  T1083_shell-execution-gcc-linux.txt  [T1083]  Shell Execution GCC  - Linux
  shell-execution-of-process-located-in-tmp-directory.txt  []  Shell Execution Of Process Located In Tmp Directory
  T1083_shell-execution-via-find-linux.txt  [T1083]  Shell Execution via Find - Linux
  T1083_shell-execution-via-flock-linux.txt  [T1083]  Shell Execution via Flock - Linux
  T1059_shell-execution-via-git-linux.txt  [T1059]  Shell Execution via Git - Linux
  T1083_shell-execution-via-nice-linux.txt  [T1083]  Shell Execution via Nice - Linux
  T1059_shell-execution-via-rsync-linux.txt  [T1059]  Shell Execution via Rsync - Linux
  T1059_shell-invocation-via-ssh-linux.txt  [T1059]  Shell Invocation Via Ssh - Linux
  T1059.004_shell-invocation-via-env-command-linux.txt  [T1059.004]  Shell Invocation via Env Command - Linux
  T1112_shimcache-flush.txt  [T1112]  ShimCache Flush
  T1574.001_small-sieve-malware-commandline-indicator.txt  [T1574.001]  Small Sieve Malware CommandLine Indicator
  T1036.005_small-sieve-malware-file-indicator-creation.txt  [T1036.005]  Small Sieve Malware File Indicator Creation
  small-sieve-malware-registry-persistence.txt  []  Small Sieve Malware Registry Persistence
  T1059.003_sofacy-trojan-loader-activity.txt  [T1059.003,T1218.011]  Sofacy Trojan Loader Activity
  T1068_sudo-privilege-escalation-cve-2019-14287.txt  [T1068,T1548.003]  Sudo Privilege Escalation CVE-2019-14287
  T1505.003_suspicious-aspx-file-drop-by-exchange.txt  [T1505.003]  Suspicious ASPX File Drop by Exchange
  T1685_suspicious-application-allowed-through-exploit-guard.txt  [T1685]  Suspicious Application Allowed Through Exploit Guard
  T1059_suspicious-arcsoc-exe-child-process.txt  [T1059,T1203]  Suspicious ArcSOC.exe Child Process
  T1204_suspicious-binaries-and-scripts-in-public-folder.txt  [T1204]  Suspicious Binaries and Scripts in Public Folder
  T1204.002_suspicious-binary-in-user-directory-spawned-from-office-appl.txt  [T1204.002]  Suspicious Binary In User Directory Spawned From Office Application
  T1219.002_suspicious-binary-writes-via-anydesk.txt  [T1219.002]  Suspicious Binary Writes Via AnyDesk
  T1021.003_suspicious-bitlocker-access-agent-update-utility-execution.txt  [T1021.003,T1218]  Suspicious BitLocker Access Agent Update Utility Execution
  T1036_suspicious-calculator-usage.txt  [T1036]  Suspicious Calculator Usage
  T1123_suspicious-camera-and-microphone-access.txt  [T1123,T1125]  Suspicious Camera and Microphone Access
  T1134.002_suspicious-child-process-created-as-system.txt  [T1134.002]  Suspicious Child Process Created as System
  T1059.005_suspicious-child-process-of-bginfo-exe.txt  [T1059.005,T1202,T1218]  Suspicious Child Process Of BgInfo.EXE
  T1102_suspicious-child-process-of-manage-engine-servicedesk.txt  [T1102]  Suspicious Child Process Of Manage Engine ServiceDesk
  T1190_suspicious-child-process-of-sql-server.txt  [T1190,T1505.003]  Suspicious Child Process Of SQL Server
  T1036_suspicious-child-process-of-wermgr-exe.txt  [T1036,T1055]  Suspicious Child Process Of Wermgr.EXE
  T1127_suspicious-child-process-of-aspnetcompiler.txt  [T1127]  Suspicious Child Process of AspNetCompiler
  T1195.002_suspicious-child-process-of-notepad-updater-gup-exe.txt  [T1195.002,T1557]  Suspicious Child Process of Notepad++ Updater - GUP.Exe
  T1190_suspicious-child-process-of-solarwinds-webhelpdesk.txt  [T1190]  Suspicious Child Process of SolarWinds WebHelpDesk
  T1176.001_suspicious-chromium-browser-instance-executed-with-custom-ex.txt  [T1176.001]  Suspicious Chromium Browser Instance Executed With Custom Extension
  T1204.001_suspicious-clickfix-filefix-execution-pattern.txt  [T1204.001,T1204.004]  Suspicious ClickFix/FileFix Execution Pattern
  T1053.005_suspicious-command-patterns-in-scheduled-task-creation.txt  [T1053.005]  Suspicious Command Patterns In Scheduled Task Creation
  T1564_suspicious-creation-with-colorcpl.txt  [T1564]  Suspicious Creation with Colorcpl
  T1105_suspicious-curl-exe-download.txt  [T1105]  Suspicious Curl.EXE Download
  T1216_suspicious-customshellhost-execution.txt  [T1216]  Suspicious CustomShellHost Execution
  T1546.008_suspicious-debugger-registration-cmdline.txt  [T1546.008]  Suspicious Debugger Registration Cmdline
  T1105_suspicious-desktopimgdownldr-command.txt  [T1105]  Suspicious Desktopimgdownldr Command
  T1105_suspicious-desktopimgdownldr-target-file.txt  [T1105]  Suspicious Desktopimgdownldr Target File
  T1218_suspicious-dotnet-clr-usage-log-artifact.txt  [T1218]  Suspicious DotNET CLR Usage Log Artifact
  T1566.001_suspicious-double-extension-file-execution.txt  [T1566.001]  Suspicious Double Extension File Execution
  T1036.007_suspicious-double-extension-files.txt  [T1036.007]  Suspicious Double Extension Files
  T1059.004_suspicious-download-and-execute-pattern-via-curl-wget.txt  [T1059.004,T1203]  Suspicious Download and Execute Pattern via Curl/Wget
  T1105_suspicious-download-from-office-domain.txt  [T1105,T1608]  Suspicious Download from Office Domain
  T1027_suspicious-encoded-and-obfuscated-reflection-assembly-load-f.txt  [T1027,T1059.001]  Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
  suspicious-environment-variable-has-been-registered.txt  []  Suspicious Environment Variable Has Been Registered
  T1564_suspicious-executable-file-creation.txt  [T1564]  Suspicious Executable File Creation
  T1566.001_suspicious-execution-from-outlook-temporary-folder.txt  [T1566.001]  Suspicious Execution From Outlook Temporary Folder
  suspicious-execution-location-of-wermgr-exe.txt  []  Suspicious Execution Location Of Wermgr.EXE
  T1588.002_suspicious-execution-of-renamed-sysinternals-tools-registry.txt  [T1588.002]  Suspicious Execution Of Renamed Sysinternals Tools - Registry
  T1027.010_suspicious-explorer-process-with-whitespace-padding-clickfix.txt  [T1027.010,T1204.004]  Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
  suspicious-file-created-via-onenote-application.txt  []  Suspicious File Created Via OneNote Application
  T1105_suspicious-file-created-by-arcsoc-exe.txt  [T1105,T1127,T1133]  Suspicious File Created by ArcSOC.exe
  T1566.001_suspicious-file-created-in-outlook-temporary-directory.txt  [T1566.001]  Suspicious File Created in Outlook Temporary Directory
  suspicious-file-creation-activity-from-fake-recycle-bin-fold.txt  []  Suspicious File Creation Activity From Fake Recycle.Bin Folder
  suspicious-file-creation-in-uncommon-appdata-folder.txt  []  Suspicious File Creation In Uncommon AppData Folder
  T1190_suspicious-file-write-to-sharepoint-layouts-directory.txt  [T1190,T1505.003]  Suspicious File Write to SharePoint Layouts Directory
  T1204.004_suspicious-filefix-execution-pattern.txt  [T1204.004]  Suspicious FileFix Execution Pattern
  T1027_suspicious-filename-with-embedded-base64-commands.txt  [T1027,T1059.004]  Suspicious Filename with Embedded Base64 Commands
  T1574.001_suspicious-gup-usage.txt  [T1574.001]  Suspicious GUP Usage
  T1027_suspicious-get-variable-exe-creation.txt  [T1027,T1546]  Suspicious Get-Variable.exe Creation
  T1547_suspicious-grpconv-execution.txt  [T1547]  Suspicious GrpConv Execution
  T1059.003_suspicious-hwp-sub-processes.txt  [T1059.003,T1203,T1566.001]  Suspicious HWP Sub Processes
  T1505.004_suspicious-iis-module-registration.txt  [T1505.004]  Suspicious IIS Module Registration
  T1059.001_suspicious-interactive-powershell-as-system.txt  [T1059.001]  Suspicious Interactive PowerShell as SYSTEM
  T1059_suspicious-invocation-of-shell-via-awk-linux.txt  [T1059]  Suspicious Invocation of Shell via AWK - Linux
  T1059_suspicious-invocation-of-shell-via-rsync.txt  [T1059,T1203]  Suspicious Invocation of Shell via Rsync
  T1059_suspicious-java-children-processes.txt  [T1059]  Suspicious Java Children Processes
  T1082_suspicious-kernel-dump-using-dtrace.txt  [T1082]  Suspicious Kernel Dump Using Dtrace
  T1204.002_suspicious-lnk-command-line-padding-with-whitespace-characte.txt  [T1204.002]  Suspicious LNK Command-Line Padding with Whitespace Characters
  T1003_suspicious-loading-of-dbgcore-dbghelp-dlls-from-uncommon-loc.txt  [T1003,T1685]  Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
  T1190_suspicious-msexchangemailboxreplication-aspx-write.txt  [T1190,T1505.003]  Suspicious MSExchangeMailboxReplication ASPX Write
  T1059.002_suspicious-microsoft-office-child-process-macos.txt  [T1059.002,T1137.002,T1204.002]  Suspicious Microsoft Office Child Process - MacOS
  T1053.005_suspicious-modification-of-scheduled-tasks.txt  [T1053.005]  Suspicious Modification Of Scheduled Tasks
  T1543.003_suspicious-new-service-creation.txt  [T1543.003]  Suspicious New Service Creation
  suspicious-nohup-execution.txt  []  Suspicious Nohup Execution
  suspicious-obfuscated-powershell-code.txt  []  Suspicious Obfuscated PowerShell Code
  T1204.002_suspicious-outlook-child-process.txt  [T1204.002]  Suspicious Outlook Child Process
  T1008_suspicious-outlook-macro-created.txt  [T1008,T1137,T1546]  Suspicious Outlook Macro Created
  T1036.007_suspicious-parent-double-extension-file-execution.txt  [T1036.007]  Suspicious Parent Double Extension File Execution
  T1685_suspicious-path-in-keyboard-layout-ime-file-registry-value.txt  [T1685]  Suspicious Path In Keyboard Layout IME File Registry Value
  T1070.004_suspicious-ping-del-command-combination.txt  [T1070.004]  Suspicious Ping/Del Command Combination
  T1059.001_suspicious-powershell-download-and-execute-pattern.txt  [T1059.001]  Suspicious PowerShell Download and Execute Pattern
  T1059.001_suspicious-powershell-iex-execution-patterns.txt  [T1059.001]  Suspicious PowerShell IEX Execution Patterns
  T1059.001_suspicious-powershell-parameter-substring.txt  [T1059.001]  Suspicious PowerShell Parameter Substring
  T1574_suspicious-printer-driver-empty-manufacturer.txt  [T1574]  Suspicious Printer Driver Empty Manufacturer
  T1059.001_suspicious-printerports-creation-cve-2020-1048.txt  [T1059.001]  Suspicious PrinterPorts Creation (CVE-2020-1048)
  T1190_suspicious-process-by-web-server-process.txt  [T1190,T1505.003]  Suspicious Process By Web Server Process
  T1047_suspicious-process-created-via-wmic-exe.txt  [T1047]  Suspicious Process Created Via Wmic.EXE
  suspicious-process-execution-from-fake-recycle-bin-folder.txt  []  Suspicious Process Execution From Fake Recycle.Bin Folder
  T1003.003_suspicious-process-patterns-ntds-dit-exfil.txt  [T1003.003]  Suspicious Process Patterns NTDS.DIT Exfil
  T1059.003_suspicious-process-spawned-by-centrestack-portal-apppool.txt  [T1059.003,T1505.003]  Suspicious Process Spawned by CentreStack Portal AppPool
  suspicious-processes-spawned-by-java-exe.txt  []  Suspicious Processes Spawned by Java.EXE
  T1190_suspicious-processes-spawned-by-winrm.txt  [T1190]  Suspicious Processes Spawned by WinRM
  T1059_suspicious-program-names.txt  [T1059]  Suspicious Program Names
  T1218_suspicious-provlaunch-exe-child-process.txt  [T1218]  Suspicious Provlaunch.EXE Child Process
  T1021.001_suspicious-rdp-redirect-using-tscon.txt  [T1021.001,T1563.002]  Suspicious RDP Redirect Using TSCON
  T1553_suspicious-razerinstaller-explorer-subprocess.txt  [T1553]  Suspicious RazerInstaller Explorer Subprocess
  T1059.005_suspicious-reconnaissance-activity-via-gathernetworkinfo-vbs.txt  [T1059.005,T1615]  Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
  T1048_suspicious-redirection-to-local-admin-share.txt  [T1048]  Suspicious Redirection to Local Admin Share
  T1486_suspicious-reg-add-bitlocker.txt  [T1486]  Suspicious Reg Add BitLocker
  T1059_suspicious-remote-child-process-from-outlook.txt  [T1059,T1202]  Suspicious Remote Child Process From Outlook
  T1547.001_suspicious-run-key-from-download.txt  [T1547.001]  Suspicious Run Key from Download
  T1218.011_suspicious-rundll32-activity-invoking-sys-file.txt  [T1218.011]  Suspicious Rundll32 Activity Invoking Sys File
  T1055_suspicious-rundll32-invoking-inline-vbscript.txt  [T1055]  Suspicious Rundll32 Invoking Inline VBScript
  T1003_suspicious-system-user-process-creation.txt  [T1003,T1027,T1134]  Suspicious SYSTEM User Process Creation
  T1053.005_suspicious-scheduled-task-creation-involving-temp-folder.txt  [T1053.005]  Suspicious Scheduled Task Creation Involving Temp Folder
  T1053_suspicious-scheduled-task-write-to-system32-tasks.txt  [T1053]  Suspicious Scheduled Task Write to System32 Tasks
  T1053.005_suspicious-schtasks-execution-appdata-folder.txt  [T1053.005,T1059.001]  Suspicious Schtasks Execution AppData Folder
  T1555_suspicious-serv-u-process-pattern.txt  [T1555]  Suspicious Serv-U Process Pattern
  T1202_suspicious-service-binary-directory.txt  [T1202]  Suspicious Service Binary Directory
  T1543.003_suspicious-service-path-modification.txt  [T1543.003]  Suspicious Service Path Modification
  T1218.011_suspicious-shellexec-rundll-call-via-ordinal.txt  [T1218.011]  Suspicious ShellExec_RunDLL Call Via Ordinal
  suspicious-shells-spawn-by-java-utility-keytool.txt  []  Suspicious Shells Spawn by Java Utility Keytool
  T1546.011_suspicious-shim-database-patching-activity.txt  [T1546.011]  Suspicious Shim Database Patching Activity
  T1027.010_suspicious-space-characters-in-runmru-registry-path-clickfix.txt  [T1027.010,T1204.004]  Suspicious Space Characters in RunMRU Registry Path - ClickFix
  T1027.010_suspicious-space-characters-in-typedpaths-registry-path-file.txt  [T1027.010,T1204.004]  Suspicious Space Characters in TypedPaths Registry Path - FileFix
  T1021.003_suspicious-speech-runtime-binary-child-process.txt  [T1021.003,T1218]  Suspicious Speech Runtime Binary Child Process
  T1202_suspicious-splwow64-without-params.txt  [T1202]  Suspicious Splwow64 Without Params
  T1204.002_suspicious-startup-folder-persistence.txt  [T1204.002,T1547.001]  Suspicious Startup Folder Persistence
  T1219.002_suspicious-tscon-start-as-system.txt  [T1219.002]  Suspicious TSCON Start as SYSTEM
  T1021.005_suspicious-ultravnc-execution.txt  [T1021.005]  Suspicious UltraVNC Execution
  suspicious-usage-of-shellexec-rundll.txt  []  Suspicious Usage Of ShellExec_RunDLL
  T1547.001_suspicious-vbscript-un2452-pattern.txt  [T1547.001]  Suspicious VBScript UN2452 Pattern
  T1219_suspicious-velociraptor-child-process.txt  [T1219]  Suspicious Velociraptor Child Process
  T1048.003_suspicious-webdav-client-execution-via-rundll32-exe.txt  [T1048.003]  Suspicious WebDav Client Execution Via Rundll32.EXE
  T1047_suspicious-wmiprvse-child-process.txt  [T1047,T1204.002,T1218.010]  Suspicious WmiPrvSE Child Process
  T1587_suspicious-word-cab-file-write-cve-2021-40444.txt  [T1587]  Suspicious Word Cab File Write CVE-2021-40444
  T1685.006_syslog-clearing-or-removal-via-system-utilities.txt  [T1685.006]  Syslog Clearing or Removal Via System Utilities
  T1685_sysmon-driver-altitude-change.txt  [T1685]  Sysmon Driver Altitude Change
  T1574.001_system-control-panel-item-loaded-from-uncommon-location.txt  [T1574.001]  System Control Panel Item Loaded From Uncommon Location
  T1036_system-file-execution-location-anomaly.txt  [T1036]  System File Execution Location Anomaly
  T1055.001_taidoor-rat-dll-load.txt  [T1055.001]  TAIDOOR RAT DLL Load
  T1685_tamper-windows-defender-remove-mppreference.txt  [T1685]  Tamper Windows Defender Remove-MpPreference
  T1685_tamper-with-sophos-av-registry-keys.txt  [T1685]  Tamper With Sophos AV Registry Keys
  T1685_taskkill-symantec-endpoint-protection.txt  [T1685]  Taskkill Symantec Endpoint Protection
  T1036_taskmgr-as-local-system.txt  [T1036]  Taskmgr as LOCAL_SYSTEM
  T1574.001_tasks-folder-evasion.txt  [T1574.001]  Tasks Folder Evasion
  T1195.002_teampcp-litellm-supply-chain-attack-persistence-indicators.txt  [T1195.002,T1543.002]  TeamPCP LiteLLM Supply Chain Attack Persistence Indicators
  T1003.001_time-travel-debugging-utility-usage.txt  [T1003.001,T1218]  Time Travel Debugging Utility Usage
  T1003.001_time-travel-debugging-utility-usage-image.txt  [T1003.001,T1218]  Time Travel Debugging Utility Usage - Image
  T1559_trickbot-malware-activity.txt  [T1559]  Trickbot Malware Activity
  triple-cross-ebpf-rootkit-default-lockfile.txt  []  Triple Cross eBPF Rootkit Default LockFile
  T1053.003_triple-cross-ebpf-rootkit-default-persistence.txt  [T1053.003]  Triple Cross eBPF Rootkit Default Persistence
  triple-cross-ebpf-rootkit-execve-hijack.txt  []  Triple Cross eBPF Rootkit Execve Hijack
  T1014_triple-cross-ebpf-rootkit-install-commands.txt  [T1014]  Triple Cross eBPF Rootkit Install Commands
  T1059.001_tropictrooper-campaign-november-2018.txt  [T1059.001]  TropicTrooper Campaign November 2018
  T1112_trust-access-disable-for-vbapplications.txt  [T1112]  Trust Access Disable For VBApplications
  T1548.002_trusted-path-bypass-via-windows-directory-spoofing.txt  [T1548.002,T1574.007]  Trusted Path Bypass via Windows Directory Spoofing
  T1548.002_uac-bypass-abusing-winsat-path-parsing-file.txt  [T1548.002]  UAC Bypass Abusing Winsat Path Parsing - File
  T1548.002_uac-bypass-abusing-winsat-path-parsing-process.txt  [T1548.002]  UAC Bypass Abusing Winsat Path Parsing - Process
  T1548.002_uac-bypass-abusing-winsat-path-parsing-registry.txt  [T1548.002]  UAC Bypass Abusing Winsat Path Parsing - Registry
  T1548.002_uac-bypass-tools-using-computerdefaults.txt  [T1548.002]  UAC Bypass Tools Using ComputerDefaults
  T1548.002_uac-bypass-using-net-code-profiler-on-mmc.txt  [T1548.002]  UAC Bypass Using .NET Code Profiler on MMC
  T1548.002_uac-bypass-using-changepk-and-slui.txt  [T1548.002]  UAC Bypass Using ChangePK and SLUI
  T1548.002_uac-bypass-using-consent-and-comctl32-file.txt  [T1548.002]  UAC Bypass Using Consent and Comctl32 - File
  T1548.002_uac-bypass-using-consent-and-comctl32-process.txt  [T1548.002]  UAC Bypass Using Consent and Comctl32 - Process
  T1548.002_uac-bypass-using-disk-cleanup.txt  [T1548.002]  UAC Bypass Using Disk Cleanup
  T1548.002_uac-bypass-using-dismhost.txt  [T1548.002]  UAC Bypass Using DismHost
  uac-bypass-using-event-viewer-recentviews.txt  []  UAC Bypass Using Event Viewer RecentViews
  uac-bypass-using-eventvwr.txt  []  UAC Bypass Using EventVwr
  T1548.002_uac-bypass-using-idiagnostic-profile.txt  [T1548.002]  UAC Bypass Using IDiagnostic Profile
  T1548.002_uac-bypass-using-idiagnostic-profile-file.txt  [T1548.002]  UAC Bypass Using IDiagnostic Profile - File
  T1548.002_uac-bypass-using-ieinstal-file.txt  [T1548.002]  UAC Bypass Using IEInstal - File
  T1548.002_uac-bypass-using-ieinstal-process.txt  [T1548.002]  UAC Bypass Using IEInstal - Process
  T1548.002_uac-bypass-using-iscsicpl-imageload.txt  [T1548.002]  UAC Bypass Using Iscsicpl - ImageLoad
  T1548.002_uac-bypass-using-msconfig-token-modification-file.txt  [T1548.002]  UAC Bypass Using MSConfig Token Modification - File
  T1548.002_uac-bypass-using-msconfig-token-modification-process.txt  [T1548.002]  UAC Bypass Using MSConfig Token Modification - Process
  T1548.002_uac-bypass-using-ntfs-reparse-point-file.txt  [T1548.002]  UAC Bypass Using NTFS Reparse Point - File
  T1548.002_uac-bypass-using-ntfs-reparse-point-process.txt  [T1548.002]  UAC Bypass Using NTFS Reparse Point - Process
  T1548.002_uac-bypass-using-pkgmgr-and-dism.txt  [T1548.002]  UAC Bypass Using PkgMgr and DISM
  T1548.002_uac-bypass-using-windows-media-player-file.txt  [T1548.002]  UAC Bypass Using Windows Media Player - File
  T1548.002_uac-bypass-using-windows-media-player-process.txt  [T1548.002]  UAC Bypass Using Windows Media Player - Process
  T1548.002_uac-bypass-using-windows-media-player-registry.txt  [T1548.002]  UAC Bypass Using Windows Media Player - Registry
  T1548.002_uac-bypass-via-wsreset.txt  [T1548.002]  UAC Bypass Via Wsreset
  T1548.002_uac-bypass-wsreset.txt  [T1548.002]  UAC Bypass WSReset
  T1548.002_uac-bypass-with-fake-dll.txt  [T1548.002,T1574.001]  UAC Bypass With Fake DLL
  T1548.002_uac-bypass-via-event-viewer.txt  [T1548.002]  UAC Bypass via Event Viewer
  T1548.002_uac-bypass-via-sdclt.txt  [T1548.002]  UAC Bypass via Sdclt
  T1542.001_uefi-persistence-via-wpbbin-filecreation.txt  [T1542.001]  UEFI Persistence Via Wpbbin - FileCreation
  T1542.001_uefi-persistence-via-wpbbin-processcreation.txt  [T1542.001]  UEFI Persistence Via Wpbbin - ProcessCreation
  T1059.001_unc2452-process-creation-patterns.txt  [T1059.001]  UNC2452 Process Creation Patterns
  unc4841-barracuda-esg-exploitation-indicators.txt  []  UNC4841 - Barracuda ESG Exploitation Indicators
  T1140_unc4841-download-compressed-files-from-temp-sh-using-wget.txt  [T1140]  UNC4841 - Download Compressed Files From Temp.sh Using Wget
  T1140_unc4841-download-tar-file-from-untrusted-direct-ip-via-wget.txt  [T1140]  UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
  unc4841-email-exfiltration-file-pattern.txt  []  UNC4841 - Email Exfiltration File Pattern
  T1140_unc4841-ssl-certificate-exfiltration-via-openssl.txt  [T1140]  UNC4841 - SSL Certificate Exfiltration Via Openssl
  T1202_uncommon-child-process-of-setres-exe.txt  [T1202,T1218]  Uncommon Child Process Of Setres.EXE
  T1685_uncommon-extension-in-keyboard-layout-ime-file-registry-valu.txt  [T1685]  Uncommon Extension In Keyboard Layout IME File Registry Value
  T1587.001_uncommon-file-created-in-office-startup-folder.txt  [T1587.001]  Uncommon File Created In Office Startup Folder
  T1195.002_uncommon-file-created-by-notepad-updater-gup-exe.txt  [T1195.002,T1557]  Uncommon File Created by Notepad++ Updater Gup.EXE
  uncommon-file-creation-by-mysql-daemon-process.txt  []  Uncommon File Creation By Mysql Daemon Process
  uncommon-filesystem-load-attempt-by-format-com.txt  []  Uncommon FileSystem Load Attempt By Format.com
  T1112_uncommon-microsoft-office-trusted-location-added.txt  [T1112]  Uncommon Microsoft Office Trusted Location Added
  T1685_uninstall-crowdstrike-falcon-sensor.txt  [T1685]  Uninstall Crowdstrike Falcon Sensor
  T1133_unusual-child-process-of-dns-exe.txt  [T1133]  Unusual Child Process of dns.exe
  T1133_unusual-file-deletion-by-dns-exe.txt  [T1133]  Unusual File Deletion by Dns.exe
  T1133_unusual-file-modification-by-dns-exe.txt  [T1133]  Unusual File Modification by dns.exe
  T1059_ursnif-redirection-of-discovery-commands.txt  [T1059]  Ursnif Redirection Of Discovery Commands
  T1098_user-added-to-highly-privileged-group.txt  [T1098]  User Added To Highly Privileged Group
  T1021.001_user-added-to-remote-desktop-users-group.txt  [T1021.001,T1133,T1136.001]  User Added to Remote Desktop Users Group
  T1574.008_using-settingsynchost-exe-as-lolbin.txt  [T1574.008]  Using SettingSyncHost.exe as LOLBin
  T1204.002_vba-dll-loaded-via-office-application.txt  [T1204.002]  VBA DLL Loaded Via Office Application
  T1547.001_vbscript-payload-stored-in-registry.txt  [T1547.001]  VBScript Payload Stored in Registry
  T1005_veeambackup-database-credentials-dump-via-sqlcmd-exe.txt  [T1005]  VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
  T1059_vim-gtfobin-abuse-linux.txt  [T1059,T1083]  Vim GTFOBin Abuse - Linux
  T1027.004_visual-basic-command-line-compiler-usage.txt  [T1027.004]  Visual Basic Command Line Compiler Usage
  T1003.002_volumeshadowcopy-symlink-creation-via-mklink.txt  [T1003.002,T1003.003]  VolumeShadowCopy Symlink Creation Via Mklink
  T1547_winekey-registry-modification.txt  [T1547]  WINEKEY Registry Modification
  T1546.003_wmi-persistence-command-line-event-consumer.txt  [T1546.003]  WMI Persistence - Command Line Event Consumer
  T1546.003_wmi-persistence-script-event-consumer-file-write.txt  [T1546.003]  WMI Persistence - Script Event Consumer File Write
  T1202_wsl-kali-linux-usage.txt  [T1202]  WSL Kali-Linux Usage
  T1059.005_wscript-or-cscript-dropper-file.txt  [T1059.005,T1059.007]  WScript or CScript Dropper - File
  wab-execution-from-non-default-location.txt  []  Wab Execution From Non Default Location
  wab-wabmig-unusual-parent-or-child-processes.txt  []  Wab/Wabmig Unusual Parent Or Child Processes
  T1112_wdigest-credguard-registry-modification.txt  [T1112]  Wdigest CredGuard Registry Modification
  T1112_wdigest-enable-uselogoncredential.txt  [T1112]  Wdigest Enable UseLogonCredential
  T1018_webshell-hacking-activity-patterns.txt  [T1018,T1033,T1087,T1505.003]  Webshell Hacking Activity Patterns
  T1505.003_webshell-tool-reconnaissance-activity.txt  [T1505.003]  Webshell Tool Reconnaissance Activity
  T1003.001_werfault-lsass-process-memory-dump.txt  [T1003.001]  WerFault LSASS Process Memory Dump
  T1033_whoami-as-parameter.txt  [T1033]  WhoAmI as Parameter
  T1547.001_winrar-creating-files-in-startup-locations.txt  [T1547.001]  WinRAR Creating Files in Startup Locations
  T1036_windows-binaries-write-suspicious-extensions.txt  [T1036]  Windows Binaries Write Suspicious Extensions
  T1685_windows-credential-guard-disabled-registry.txt  [T1685]  Windows Credential Guard Disabled - Registry
  T1685_windows-credential-guard-related-registry-value-deleted-regi.txt  [T1685]  Windows Credential Guard Related Registry Value Deleted - Registry
  T1685_windows-defender-service-disabled-registry.txt  [T1685]  Windows Defender Service Disabled - Registry
  T1685_windows-defender-threat-severity-default-action-modified.txt  [T1685]  Windows Defender Threat Severity Default Action Modified
  T1685_windows-hypervisor-enforced-code-integrity-disabled.txt  [T1685]  Windows Hypervisor Enforced Code Integrity Disabled
  T1059_windows-shell-scripting-application-file-write-to-suspicious.txt  [T1059]  Windows Shell/Scripting Application File Write to Suspicious Folder
  T1059.001_windows-shell-scripting-processes-spawning-suspicious-progra.txt  [T1059.001,T1059.005,T1218]  Windows Shell/Scripting Processes Spawning Suspicious Programs
  T1059_windows-suspicious-child-process-from-node-js-react2shell.txt  [T1059,T1190]  Windows Suspicious Child Process from Node.js - React2Shell
  T1685_windows-vulnerable-driver-blocklist-disabled.txt  [T1685]  Windows Vulnerable Driver Blocklist Disabled
  T1547.004_winlogon-notify-key-logon-persistence.txt  [T1547.004]  Winlogon Notify Key Logon Persistence
  T1021.002_wmiprvse-wbemcomn-dll-hijack.txt  [T1021.002,T1047]  Wmiprvse Wbemcomn DLL Hijack
  wusa-exe-executed-by-parent-process-located-in-suspicious-lo.txt  []  Wusa.EXE Executed By Parent Process Located In Suspicious Location
  T1069.002_adexplorer-writing-complete-ad-snapshot-into-dat-file.txt  [T1069.002,T1087.002,T1482]  ADExplorer Writing Complete AD Snapshot Into .dat File
  T1070.004_ads-zone-identifier-deleted-by-uncommon-application.txt  [T1070.004]  ADS Zone.Identifier Deleted By Uncommon Application
  T1001.003_adsi-cache-file-creation-by-uncommon-tool.txt  [T1001.003]  ADSI-Cache File Creation By Uncommon Tool
  T1216_awl-bypass-with-winrm-vbs-and-malicious-wsmpty-xsl-wsmtxt-xs.txt  [T1216]  AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl
  T1216_awl-bypass-with-winrm-vbs-and-malicious-wsmpty-xsl-wsmtxt-xs_2.txt  [T1216]  AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
  T1218_abusing-print-executable.txt  [T1218]  Abusing Print Executable
  T1592.004_access-of-sudoers-file-content.txt  [T1592.004]  Access of Sudoers File Content
  T1112_activate-suppression-of-windows-security-center-notification.txt  [T1112]  Activate Suppression of Windows Security Center Notifications
  add-debugger-entry-to-aedebug-for-persistence.txt  []  Add Debugger Entry To AeDebug For Persistence
  T1112_add-disallowrun-execution-to-registry.txt  [T1112]  Add DisallowRun Execution to Registry
  T1547.010_add-port-monitor-persistence-in-registry.txt  [T1547.010]  Add Port Monitor Persistence in Registry
  T1046_advanced-ip-scanner-file-event.txt  [T1046]  Advanced IP Scanner - File Event
  T1112_allow-rdp-remote-assistance-feature.txt  [T1112]  Allow RDP Remote Assistance Feature
  T1548.002_always-install-elevated-windows-installer.txt  [T1548.002]  Always Install Elevated Windows Installer
  amsi-dll-loaded-via-lolbin-process.txt  []  Amsi.DLL Loaded Via LOLBIN Process
  T1219.002_anydesk-temporary-artefact.txt  [T1219.002]  Anydesk Temporary Artefact
  T1105_arbitrary-file-download-via-gfxdownloadwrapper-exe.txt  [T1105]  Arbitrary File Download Via GfxDownloadWrapper.EXE
  T1218_arbitrary-file-download-via-squirrel-exe.txt  [T1218]  Arbitrary File Download Via Squirrel.EXE
  T1218_arbitrary-msi-download-via-devinit-exe.txt  [T1218]  Arbitrary MSI Download Via Devinit.EXE
  T1204_arbitrary-shell-command-execution-via-settingcontent-ms.txt  [T1204,T1566.001]  Arbitrary Shell Command Execution Via Settingcontent-Ms
  T1127_aspnetcompiler-execution.txt  [T1127]  AspNetCompiler Execution
  assembly-dll-creation-via-aspnetcompiler.txt  []  Assembly DLL Creation Via AspNetCompiler
  T1216_assembly-loading-via-cl-loadassembly-ps1.txt  [T1216]  Assembly Loading Via CL_LoadAssembly.ps1
  T1218_atbroker-registry-change.txt  [T1218,T1547]  Atbroker Registry Change
  T1123_audio-capture-via-powershell.txt  [T1123]  Audio Capture via PowerShell
  T1123_audio-capture-via-soundrecorder.txt  [T1123]  Audio Capture via SoundRecorder
  T1059.004_bpftrace-unsafe-option-usage.txt  [T1059.004]  BPFtrace Unsafe Option Usage
  T1490_backup-files-deleted.txt  [T1490]  Backup Files Deleted
  T1185_browser-started-with-remote-debugging.txt  [T1185]  Browser Started with Remote Debugging
  T1204.002_clr-dll-loaded-via-office-applications.txt  [T1204.002]  CLR DLL Loaded Via Office Applications
  T1546.015_com-hijacking-via-treatas.txt  [T1546.015]  COM Hijacking via TreatAs
  T1218_com-object-execution-via-xwizard-exe.txt  [T1218]  COM Object Execution via Xwizard.EXE
  T1569.002_csexec-service-file-creation.txt  [T1569.002]  CSExec Service File Creation
  cve-2024-1708-screenconnect-path-traversal-exploitation.txt  []  CVE-2024-1708 - ScreenConnect Path Traversal Exploitation
  cab-file-extraction-via-wusa-exe.txt  []  Cab File Extraction Via Wusa.EXE
  T1059.001_certificate-exported-via-powershell.txt  [T1059.001,T1552.004]  Certificate Exported Via PowerShell
  T1574.011_changing-existing-service-imagepath-value-via-reg-exe.txt  [T1574.011]  Changing Existing Service ImagePath Value Via Reg.EXE
  T1222.002_chmod-targeting-sensitive-directories.txt  [T1222.002]  Chmod Targeting Sensitive Directories
  T1176.001_chromium-browser-instance-executed-with-custom-extension.txt  [T1176.001]  Chromium Browser Instance Executed With Custom Extension
  T1059_clfs-sys-loaded-by-process-located-in-a-potential-suspicious.txt  [T1059]  Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
  clickonce-deployment-execution-dfsvc-exe-child-process.txt  []  ClickOnce Deployment Execution - Dfsvc.EXE Child Process
  T1112_clickonce-trust-prompt-tampering.txt  [T1112]  ClickOnce Trust Prompt Tampering
  T1059.002_clipboard-access-via-osascript.txt  [T1059.002,T1115]  Clipboard Access Via OSAScript
  T1115_clipboard-data-collection-via-pbpaste.txt  [T1115]  Clipboard Data Collection Via Pbpaste
  T1090.001_cloudflared-portable-execution.txt  [T1090.001]  Cloudflared Portable Execution
  T1090_cloudflared-tunnel-connections-cleanup.txt  [T1090,T1102,T1572]  Cloudflared Tunnel Connections Cleanup
  T1090_cloudflared-tunnel-execution.txt  [T1090,T1102,T1572]  Cloudflared Tunnel Execution
  T1059.001_command-line-execution-with-suspicious-url-and-appdata-strin.txt  [T1059.001,T1059.003,T1105]  Command Line Execution with Suspicious URL and AppData Strings
  T1078.001_commvault-qlogin-with-publicsharinguser-and-guid-password-cv.txt  [T1078.001]  Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
  T1560.001_compress-data-and-lock-with-password-for-exfiltration-with-w.txt  [T1560.001]  Compress Data and Lock With Password for Exfiltration With WINZIP
  T1059_conhost-spawned-by-uncommon-parent-process.txt  [T1059]  Conhost Spawned By Uncommon Parent Process
  T1614.001_console-codepage-lookup-via-chcp.txt  [T1614.001]  Console CodePage Lookup Via CHCP
  T1112_crashcontrol-crashdump-disabled.txt  [T1112,T1564]  CrashControl CrashDump Disabled
  T1055_created-files-by-microsoft-sync-center.txt  [T1055,T1218]  Created Files by Microsoft Sync Center
  T1574.001_creation-of-non-existent-system-dll.txt  [T1574.001]  Creation Of Non-Existent System DLL
  T1574.001_creation-of-werfault-exe-wer-dll-in-unusual-folder.txt  [T1574.001]  Creation of WerFault.exe/Wer.dll in Unusual Folder
  creation-of-a-diagcab.txt  []  Creation of a Diagcab
  T1555.001_credentials-from-password-stores-keychain.txt  [T1555.001]  Credentials from Password Stores - Keychain
  cscript-wscript-potentially-suspicious-child-process.txt  []  Cscript/Wscript Potentially Suspicious Child Process
  T1071.001_curl-exe-execution-with-custom-useragent.txt  [T1071.001]  Curl.EXE Execution With Custom UserAgent
  T1547.001_currentcontrolset-autorun-keys-modification.txt  [T1547.001]  CurrentControlSet Autorun Keys Modification
  T1574_dll-execution-via-register-cimprovider-exe.txt  [T1574]  DLL Execution Via Register-cimprovider.exe
  T1070_dll-load-by-system-process-from-suspicious-locations.txt  [T1070]  DLL Load By System Process From Suspicious Locations
  T1574.001_dll-names-used-by-svr-for-graphicalproton-backdoor.txt  [T1574.001]  DLL Names Used By SVR For GraphicalProton Backdoor
  T1112_dns-over-https-enabled-by-registry.txt  [T1112,T1140]  DNS-over-HTTPS Enabled by Registry
  T1059_darkgate-autoit3-exe-file-creation-by-uncommon-process.txt  [T1059,T1105]  DarkGate - Autoit3.EXE File Creation By Uncommon Process
  T1059_darkgate-drop-darkgate-loader-in-c-temp-directory.txt  [T1059]  DarkGate - Drop DarkGate Loader In C:\Temp Directory
  T1003.001_dbghelp-dbgcore-dll-loaded-by-uncommon-suspicious-process.txt  [T1003.001]  Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process
  T1053.005_defrag-deactivation.txt  [T1053.005]  Defrag Deactivation
  delete-defender-scan-shellex-context-menu-registry-key.txt  []  Delete Defender Scan ShellEx Context Menu Registry Key
  T1547.009_desktop-ini-created-by-uncommon-process.txt  [T1547.009]  Desktop.INI Created by Uncommon Process
  T1518_detected-windows-software-discovery.txt  [T1518]  Detected Windows Software Discovery
  T1218_devicecredentialdeployment-execution.txt  [T1218]  DeviceCredentialDeployment Execution
  T1070.005_disable-administrative-share-creation-at-startup.txt  [T1070.005]  Disable Administrative Share Creation at Startup
  T1685_disable-exploit-guard-network-protection-on-windows-defender.txt  [T1685]  Disable Exploit Guard Network Protection on Windows Defender
  T1112_disable-internal-tools-or-feature-in-registry.txt  [T1112]  Disable Internal Tools or Feature in Registry
  T1686.003_disable-microsoft-defender-firewall-via-registry.txt  [T1686.003]  Disable Microsoft Defender Firewall via Registry
  T1489_disable-or-stop-services.txt  [T1489,T1685]  Disable Or Stop Services
  T1685_disable-privacy-settings-experience-in-registry.txt  [T1685]  Disable Privacy Settings Experience in Registry
  T1685_disable-security-tools.txt  [T1685]  Disable Security Tools
  T1685_disable-tamper-protection-on-windows-defender.txt  [T1685]  Disable Tamper Protection on Windows Defender
  T1686.003_disable-windows-firewall-by-registry.txt  [T1686.003]  Disable Windows Firewall by Registry
  T1112_disable-windows-security-center-notifications.txt  [T1112]  Disable Windows Security Center Notifications
  T1686_disabling-security-tools.txt  [T1686]  Disabling Security Tools
  disk-image-creation-via-hdiutil-macos.txt  []  Disk Image Creation Via Hdiutil - MacOS
  T1560.001_disk-image-mounting-via-hdiutil-macos.txt  [T1560.001,T1566.001]  Disk Image Mounting Via Hdiutil - MacOS
  T1218_diskshadow-child-process-spawned.txt  [T1218]  Diskshadow Child Process Spawned
  T1685_dism-remove-online-package.txt  [T1685]  Dism Remove Online Package
  T1564.001_displaying-hidden-files-feature-disabled.txt  [T1564.001]  Displaying Hidden Files Feature Disabled
  T1204.002_dotnet-assembly-dll-loaded-via-office-application.txt  [T1204.002]  DotNET Assembly DLL Loaded Via Office Application
  T1105_download-file-to-potentially-suspicious-directory-via-wget.txt  [T1105]  Download File To Potentially Suspicious Directory Via Wget
  drop-binaries-into-spool-drivers-color-folder.txt  []  Drop Binaries Into Spool Drivers Color Folder
  T1556.002_dropping-of-password-filter-dll.txt  [T1556.002]  Dropping Of Password Filter DLL
  T1003.001_dumping-process-via-sqldumper-exe.txt  [T1003.001]  Dumping Process via Sqldumper.exe
  T1027.004_dynamic-net-compilation-via-csc-exe.txt  [T1027.004]  Dynamic .NET Compilation Via Csc.EXE
  T1027.004_dynamic-net-compilation-via-csc-exe-hunting.txt  [T1027.004]  Dynamic .NET Compilation Via Csc.EXE - Hunting
  T1059.012_esxi-account-creation-via-esxcli.txt  [T1059.012,T1136]  ESXi Account Creation Via ESXCLI
  T1007_esxi-network-configuration-discovery-via-esxcli.txt  [T1007,T1033,T1059.012]  ESXi Network Configuration Discovery Via ESXCLI
  T1007_esxi-storage-information-discovery-via-esxcli.txt  [T1007,T1033,T1059.012]  ESXi Storage Information Discovery Via ESXCLI
  T1059.012_esxi-syslog-configuration-change-via-esxcli.txt  [T1059.012,T1685,T1690]  ESXi Syslog Configuration Change Via ESXCLI
  T1007_esxi-system-information-discovery-via-esxcli.txt  [T1007,T1033,T1059.012]  ESXi System Information Discovery Via ESXCLI
  T1059.012_esxi-vm-kill-via-esxcli.txt  [T1059.012,T1529]  ESXi VM Kill Via ESXCLI
  T1007_esxi-vm-list-discovery-via-esxcli.txt  [T1007,T1033,T1059.012]  ESXi VM List Discovery Via ESXCLI
  T1007_esxi-vsan-information-discovery-via-esxcli.txt  [T1007,T1033,T1059.012]  ESXi VSAN Information Discovery Via ESXCLI
  T1685.001_evtx-created-in-uncommon-location.txt  [T1685.001]  EVTX Created In Uncommon Location
  enable-bpf-kprobes-tracing.txt  []  Enable BPF Kprobes Tracing
  enable-local-manifest-installation-with-winget.txt  []  Enable Local Manifest Installation With Winget
  T1559.002_enable-microsoft-dynamic-data-exchange.txt  [T1559.002]  Enable Microsoft Dynamic Data Exchange
  T1685_enable-remote-connection-between-anonymous-computer-allowano.txt  [T1685]  Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
  T1574.012_enabling-cor-profiler-environment-variables.txt  [T1574.012]  Enabling COR Profiler Environment Variables
  T1552.002_enumeration-for-3rd-party-creds-from-cli.txt  [T1552.002]  Enumeration for 3rd Party Creds From CLI
  T1552.002_enumeration-for-credentials-in-registry.txt  [T1552.002]  Enumeration for Credentials in Registry
  T1003_esentutl-gather-credentials.txt  [T1003,T1003.003]  Esentutl Gather Credentials
  T1070_eventlog-evtx-file-deleted.txt  [T1070]  EventLog EVTX File Deleted
  T1059.001_execute-code-with-pester-bat.txt  [T1059.001,T1216]  Execute Code with Pester.bat
  T1059.001_execute-code-with-pester-bat-as-parent.txt  [T1059.001,T1216]  Execute Code with Pester.bat as Parent
  T1218_execute-files-with-msdeploy-exe.txt  [T1218]  Execute Files with Msdeploy.exe
  T1564.004_execute-from-alternate-data-streams.txt  [T1564.004]  Execute From Alternate Data Streams
  T1505.003_execution-from-webserver-root-folder.txt  [T1505.003]  Execution From Webserver Root Folder
  execution-of-script-located-in-potentially-suspicious-direct.txt  []  Execution Of Script Located In Potentially Suspicious Directory
  T1203_exploit-for-cve-2017-0261.txt  [T1203,T1204.002,T1566.001]  Exploit for CVE-2017-0261
  T1036_explorer-process-tree-break.txt  [T1036]  Explorer Process Tree Break
  T1070.004_file-deleted-via-sysinternals-sdelete.txt  [T1070.004]  File Deleted Via Sysinternals SDelete
  T1105_file-download-from-browser-process-via-inline-url.txt  [T1105]  File Download From Browser Process Via Inline URL
  T1105_file-download-via-curl-exe.txt  [T1105]  File Download Via Curl.EXE
  T1105_file-download-via-nscurl-macos.txt  [T1105]  File Download Via Nscurl - MacOS
  T1070.006_file-time-attribute-change.txt  [T1070.006]  File Time Attribute Change
  T1222.001_file-or-folder-permissions-modifications.txt  [T1222.001]  File or Folder Permissions Modifications
  T1036.005_files-with-system-dll-name-in-unsuspected-locations.txt  [T1036.005]  Files With System DLL Name In Unsuspected Locations
  T1036.005_files-with-system-process-name-in-unsuspected-locations.txt  [T1036.005]  Files With System Process Name In Unsuspected Locations
  T1686_flush-iptables-ufw-chain.txt  [T1686]  Flush Iptables Ufw Chain
  T1074.001_folder-compress-to-potentially-suspicious-output-via-compres.txt  [T1074.001]  Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
  T1685.001_forest-blizzard-apt-javascript-constrained-file-creation.txt  [T1685.001]  Forest Blizzard APT - JavaScript Constrained File Creation
  gathernetworkinfo-vbs-reconnaissance-script-output.txt  []  GatherNetworkInfo.VBS Reconnaissance Script Output
  T1219.002_gotoassist-temporary-installation-artefact.txt  [T1219.002]  GoToAssist Temporary Installation Artefact
  T1615_gpresult-display-group-policy-information.txt  [T1615]  Gpresult Display Group Policy Information
  T1531_group-has-been-deleted-via-groupdel.txt  [T1531]  Group Has Been Deleted Via Groupdel
  T1132.001_gzip-archive-decode-via-powershell.txt  [T1132.001]  Gzip Archive Decode Via PowerShell
  T1059.003_hacktool-jlaive-in-memory-assembly-execution.txt  [T1059.003]  HackTool - Jlaive In-Memory Assembly Execution
  hacktool-lazagne-execution.txt  []  HackTool - LaZagne Execution
  T1021.006_hacktool-winrm-access-via-evil-winrm.txt  [T1021.006]  HackTool - WinRM Access Via Evil-WinRM
  T1059.001_headless-process-launched-via-conhost-exe.txt  [T1059.001,T1059.003]  Headless Process Launched Via Conhost.EXE
  T1105_hidden-flag-set-on-file-directory-via-chflags-macos.txt  [T1105,T1218,T1552.001,T1564.004]  Hidden Flag Set On File/Directory Via Chflags - MacOS
  T1059.001_hidden-powershell-in-link-file-pattern.txt  [T1059.001]  Hidden Powershell in Link File Pattern
  T1564.002_hidden-user-creation.txt  [T1564.002]  Hidden User Creation
  T1564.002_hiding-user-account-via-specialaccounts-registry-key-command.txt  [T1564.002]  Hiding User Account Via SpecialAccounts Registry Key - CommandLine
  T1137_ie-change-domain-zone.txt  [T1137]  IE Change Domain Zone
  T1070_iis-webserver-access-logs-deleted.txt  [T1070]  IIS WebServer Access Logs Deleted
  T1566.001_iso-or-image-mount-indicator-in-recent-files.txt  [T1566.001]  ISO or Image Mount Indicator in Recent Files
  T1059.001_import-powershell-modules-from-suspicious-directories-proccr.txt  [T1059.001]  Import PowerShell Modules From Suspicious Directories - ProcCreation
  T1685.006_indicator-removal-on-host-clear-mac-system-logs.txt  [T1685.006]  Indicator Removal on Host - Clear Mac System Logs
  T1202_indirect-command-execution-via-sftp-proxycommand.txt  [T1202]  Indirect Command Execution via SFTP ProxyCommand
  T1218_infdefaultinstall-exe-inf-execution.txt  [T1218]  InfDefaultInstall.exe .inf Execution
  T1219.002_installation-of-teamviewer-desktop.txt  [T1219.002]  Installation of TeamViewer Desktop
  T1036_interactive-bash-suspicious-children.txt  [T1036,T1059.004]  Interactive Bash Suspicious Children
  T1547.001_internet-explorer-autorun-keys-modification.txt  [T1547.001]  Internet Explorer Autorun Keys Modification
  internet-explorer-disablefirstruncustomize-enabled.txt  []  Internet Explorer DisableFirstRunCustomize Enabled
  T1003.003_invocation-of-active-directory-diagnostic-tool-ntdsutil-exe.txt  [T1003.003]  Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
  T1027_invoke-obfuscation-compress-obfuscation.txt  [T1027,T1059.001]  Invoke-Obfuscation COMPRESS OBFUSCATION
  jamf-mdm-potential-suspicious-child-process.txt  []  JAMF MDM Potential Suspicious Child Process
  T1203_java-running-with-remote-debugging.txt  [T1203]  Java Running with Remote Debugging
  T1553.003_kapeka-backdoor-configuration-persistence.txt  [T1553.003]  Kapeka Backdoor Configuration Persistence
  T1543.001_launch-agent-daemon-execution-via-launchctl.txt  [T1543.001,T1543.004,T1569.001]  Launch Agent/Daemon Execution Via Launchctl
  T1216.001_launch-vsdevshell-ps1-proxy-execution.txt  [T1216.001]  Launch-VsDevShell.PS1 Proxy Execution
  T1140_linux-base64-encoded-pipe-to-shell.txt  [T1140]  Linux Base64 Encoded Pipe to Shell
  T1140_linux-base64-encoded-shebang-in-cli.txt  [T1140]  Linux Base64 Encoded Shebang In CLI
  T1548_linux-doas-conf-file-creation.txt  [T1548]  Linux Doas Conf File Creation
  T1685.006_linux-logs-clearing-attempts.txt  [T1685.006]  Linux Logs Clearing Attempts
  T1140_linux-shell-pipe-to-shell.txt  [T1140]  Linux Shell Pipe to Shell
  livekd-driver-creation.txt  []  LiveKD Driver Creation
  T1218_lolbin-runexehelper-use-as-proxy.txt  [T1218]  Lolbin Runexehelper Use As Proxy
  T1059.005_mmc-loading-script-engines-dlls.txt  [T1059.005,T1218.014]  MMC Loading Script Engines DLLs
  T1505.002_msexchange-transport-agent-installation.txt  [T1505.002]  MSExchange Transport Agent Installation
  T1546.014_macos-emond-launch-daemon.txt  [T1546.014]  MacOS Emond Launch Daemon
  T1059.002_macos-scripting-interpreter-applescript.txt  [T1059.002]  MacOS Scripting Interpreter AppleScript
  T1218_malicious-pe-execution-by-microsoft-visual-studio-debugger.txt  [T1218]  Malicious PE Execution by Microsoft Visual Studio Debugger
  T1059_manual-execution-of-script-inside-of-a-compressed-file.txt  [T1059]  Manual Execution of Script Inside of a Compressed File
  T1204.002_microsoft-excel-add-in-loaded-from-uncommon-location.txt  [T1204.002]  Microsoft Excel Add-In Loaded From Uncommon Location
  T1112_microsoft-office-trusted-location-updated.txt  [T1112]  Microsoft Office Trusted Location Updated
  T1055_microsoft-sync-center-suspicious-network-connections.txt  [T1055,T1218]  Microsoft Sync Center Suspicious Network Connections
  T1204.002_microsoft-vba-for-outlook-addin-loaded-via-outlook.txt  [T1204.002]  Microsoft VBA For Outlook Addin Loaded Via Outlook
  T1564_mount-execution-with-hidepid-parameter.txt  [T1564]  Mount Execution With Hidepid Parameter
  T1105_msiexec-web-install.txt  [T1105,T1218.007]  MsiExec Web Install
  T1220_msxsl-exe-execution.txt  [T1220]  Msxsl.EXE Execution
  T1112_new-bginfo-exe-custom-db-path-registry-configuration.txt  [T1112]  New BgInfo.EXE Custom DB Path Registry Configuration
  T1112_new-bginfo-exe-custom-vbscript-registry-configuration.txt  [T1112]  New BgInfo.EXE Custom VBScript Registry Configuration
  T1112_new-bginfo-exe-custom-wmi-query-registry-configuration.txt  [T1112]  New BgInfo.EXE Custom WMI Query Registry Configuration
  T1547.009_new-custom-shim-database-created.txt  [T1547.009]  New Custom Shim Database Created
  T1490_new-file-exclusion-added-to-time-machine-via-tmutil-macos.txt  [T1490]  New File Exclusion Added To Time Machine Via Tmutil - MacOS
  T1543.003_new-kernel-driver-via-sc-exe.txt  [T1543.003]  New Kernel Driver Via SC.EXE
  T1008_new-outlook-macro-created.txt  [T1008,T1137,T1546]  New Outlook Macro Created
  T1090_new-portproxy-registry-entry-added.txt  [T1090]  New PortProxy Registry Entry Added
  T1490_new-root-or-ca-or-authroot-certificate-to-store.txt  [T1490]  New Root or CA or AuthRoot Certificate to Store
  T1059.007_node-process-executions.txt  [T1059.007,T1127]  Node Process Executions
  T1059.004_nohup-execution.txt  [T1059.004]  Nohup Execution
  obfuscated-ip-download-activity.txt  []  Obfuscated IP Download Activity
  obfuscated-ip-via-cli.txt  []  Obfuscated IP Via CLI
  T1137.002_office-application-startup-office-test.txt  [T1137.002]  Office Application Startup - Office Test
  old-tls1-0-tls1-1-protocol-version-enabled.txt  []  Old TLS1.0/TLS1.1 Protocol Version Enabled
  onenote-attachment-file-dropped-in-suspicious-location.txt  []  OneNote Attachment File Dropped In Suspicious Location
  T1021.004_openedr-spawning-command-shell.txt  [T1021.004,T1059.003,T1219]  OpenEDR Spawning Command Shell
  T1059.002_osacompile-execution-by-potentially-suspicious-applet-osascr.txt  [T1059.002]  Osacompile Execution By Potentially Suspicious Applet/Osascript
  T1137_outlook-security-settings-updated-registry.txt  [T1137]  Outlook Security Settings Updated - Registry
  psscriptpolicytest-creation-by-uncommon-process.txt  []  PSScriptPolicyTest Creation By Uncommon Process
  T1056.002_pua-mouse-lock-execution.txt  [T1056.002]  PUA - Mouse Lock Execution
  T1588.002_pua-sysinternals-tools-execution-registry.txt  [T1588.002]  PUA - Sysinternals Tools Execution - Registry
  T1083_pua-trufflehog-execution.txt  [T1083,T1552.001]  PUA - TruffleHog Execution
  T1083_pua-trufflehog-execution-linux.txt  [T1083,T1552.001]  PUA - TruffleHog Execution - Linux
  T1546.002_path-to-screensaver-binary-modified.txt  [T1546.002]  Path To Screensaver Binary Modified
  T1059_payload-decoded-and-decrypted-via-built-in-utilities.txt  [T1059,T1140,T1204]  Payload Decoded and Decrypted via Built-in Utilities
  T1113_periodic-backup-for-system-registry-hives-enabled.txt  [T1113]  Periodic Backup For System Registry Hives Enabled
  persistence-via-disk-cleanup-handler-autorun.txt  []  Persistence Via Disk Cleanup Handler - Autorun
  T1553.003_persistence-via-new-sip-provider.txt  [T1553.003]  Persistence Via New SIP Provider
  T1548.003_persistence-via-sudoers-d-files.txt  [T1548.003]  Persistence Via Sudoers.d Files
  persistence-via-typedpaths-commandline.txt  []  Persistence Via TypedPaths - CommandLine
  T1046_pnscan-binary-data-transmission-activity.txt  [T1046]  Pnscan Binary Data Transmission Activity
  T1021.001_port-forwarding-activity-via-ssh-exe.txt  [T1021.001,T1021.004,T1572]  Port Forwarding Activity Via SSH.EXE
  T1685_potential-amsi-bypass-using-null-bits.txt  [T1685]  Potential AMSI Bypass Using NULL Bits
  T1059.001_potential-apt-fin7-exploitation-activity.txt  [T1059.001,T1059.003]  Potential APT FIN7 Exploitation Activity
  T1218.010_potential-apt-c-12-bluemushroom-dll-load-activity-via-regsvr.txt  [T1218.010]  Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32
  T1574.001_potential-avkkid-dll-sideloading.txt  [T1574.001]  Potential AVKkid.DLL Sideloading
  T1219.002_potential-amazon-ssm-agent-hijacking.txt  [T1219.002]  Potential Amazon SSM Agent Hijacking
  T1574.001_potential-antivirus-software-dll-sideloading.txt  [T1574.001]  Potential Antivirus Software DLL Sideloading
  T1027.004_potential-application-whitelisting-bypass-via-dnx-exe.txt  [T1027.004,T1218]  Potential Application Whitelisting Bypass via Dnx.EXE
  potential-binary-or-script-dropper-via-powershell.txt  []  Potential Binary Or Script Dropper Via PowerShell
  T1574.001_potential-ccleanerdu-dll-sideloading.txt  [T1574.001]  Potential CCleanerDU.DLL Sideloading
  T1574.001_potential-ccleanerreactivator-dll-sideloading.txt  [T1574.001]  Potential CCleanerReactivator.DLL Sideloading
  T1546.015_potential-com-object-hijacking-via-treatas-subkey-registry.txt  [T1546.015]  Potential COM Object Hijacking Via TreatAs Subkey - Registry
  T1105_potential-com-objects-download-cradles-usage-process-creatio.txt  [T1105]  Potential COM Objects Download Cradles Usage - Process Creation
  T1059.006_potential-cve-2022-22954-exploitation-attempt-vmware-workspa.txt  [T1059.006,T1190]  Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution
  potential-cve-2023-36874-exploitation-uncommon-report-wer-lo.txt  []  Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location
  potential-cve-2023-36884-exploitation-dropped-file.txt  []  Potential CVE-2023-36884 Exploitation Dropped File
  potential-cve-2024-3400-exploitation-palo-alto-globalprotect.txt  []  Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation
  T1068_potential-cve-2024-35250-exploitation-activity.txt  [T1068]  Potential CVE-2024-35250 Exploitation Activity
  T1574.001_potential-chrome-frame-helper-dll-sideloading.txt  [T1574.001]  Potential Chrome Frame Helper DLL Sideloading
  T1036_potential-command-line-path-traversal-evasion-attempt.txt  [T1036]  Potential Command Line Path Traversal Evasion Attempt
  T1027_potential-commandline-obfuscation-using-unicode-characters.txt  [T1027]  Potential CommandLine Obfuscation Using Unicode Characters
  T1140_potential-commandline-obfuscation-using-escape-characters.txt  [T1140]  Potential Commandline Obfuscation Using Escape Characters
  T1003_potential-credential-dumping-attempt-using-new-networkprovid_2.txt  [T1003]  Potential Credential Dumping Attempt Using New NetworkProvider - REG
  T1059.001_potential-dll-file-download-via-powershell-invoke-webrequest.txt  [T1059.001,T1105]  Potential DLL File Download Via PowerShell Invoke-WebRequest
  T1574.001_potential-dll-sideloading-of-dbgcore-dll.txt  [T1574.001]  Potential DLL Sideloading Of DBGCORE.DLL
  T1574.001_potential-dll-sideloading-of-dbghelp-dll.txt  [T1574.001]  Potential DLL Sideloading Of DBGHELP.DLL
  T1574.001_potential-dll-sideloading-of-dbgmodel-dll.txt  [T1574.001]  Potential DLL Sideloading Of DbgModel.DLL
  T1574.001_potential-dll-sideloading-of-libcurl-dll-via-gup-exe.txt  [T1574.001]  Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
  T1574.001_potential-dll-sideloading-of-mpsvc-dll.txt  [T1574.001]  Potential DLL Sideloading Of MpSvc.DLL
  T1574.001_potential-dll-sideloading-of-mscorsvc-dll.txt  [T1574.001]  Potential DLL Sideloading Of MsCorSvc.DLL
  T1055_potential-dll-sideloading-using-coregen-exe.txt  [T1055,T1218]  Potential DLL Sideloading Using Coregen.exe
  T1574.001_potential-dll-sideloading-via-classicexplorer32-dll.txt  [T1574.001]  Potential DLL Sideloading Via ClassicExplorer32.dll
  T1574.001_potential-dll-sideloading-via-jsschhlp.txt  [T1574.001]  Potential DLL Sideloading Via JsSchHlp
  T1105_potential-data-exfiltration-via-curl-exe.txt  [T1105,T1567]  Potential Data Exfiltration Via Curl.EXE
  T1083_potential-discovery-activity-using-find-linux.txt  [T1083]  Potential Discovery Activity Using Find - Linux
  T1083_potential-discovery-activity-using-find-macos.txt  [T1083]  Potential Discovery Activity Using Find - MacOS
  potential-discovery-activity-via-dnscmd-exe.txt  []  Potential Discovery Activity Via Dnscmd.EXE
  T1059_potential-dosfuscation-activity.txt  [T1059]  Potential Dosfuscation Activity
  T1105_potential-download-upload-activity-using-type-command.txt  [T1105]  Potential Download/Upload Activity Using Type Command
  T1059.005_potential-dropper-script-execution-via-wscript-cscript-mshta.txt  [T1059.005,T1059.007]  Potential Dropper Script Execution Via WScript/CScript/MSHTA
  potential-encrypted-registry-blob-related-to-snake-malware.txt  []  Potential Encrypted Registry Blob Related To SNAKE Malware
  T1003_potential-exploitation-of-cve-2025-5054-or-cve-2025-4598.txt  [T1003,T1548]  Potential Exploitation of CVE-2025-5054 or CVE-2025-4598
  T1036_potential-fake-instance-of-hxtsr-exe-executed.txt  [T1036]  Potential Fake Instance Of Hxtsr.EXE Executed
  T1218_potential-file-download-via-ms-appinstaller-protocol-handler.txt  [T1218]  Potential File Download Via MS-AppInstaller Protocol Handler
  T1574.001_potential-goopdate-dll-sideloading.txt  [T1574.001]  Potential Goopdate.DLL Sideloading
  T1564.004_potential-hidden-directory-creation-via-ntfs-index-allocatio.txt  [T1564.004]  Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream
  T1564.004_potential-hidden-directory-creation-via-ntfs-index-allocatio_2.txt  [T1564.004]  Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
  T1036_potential-homoglyph-attack-using-lookalike-characters.txt  [T1036,T1036.003]  Potential Homoglyph Attack Using Lookalike Characters
  T1036_potential-homoglyph-attack-using-lookalike-characters-in-fil.txt  [T1036,T1036.003]  Potential Homoglyph Attack Using Lookalike Characters in Filename
  T1059.007_potential-in-memory-download-and-compile-of-payloads.txt  [T1059.007,T1105]  Potential In-Memory Download And Compile Of Payloads
  T1566_potential-initial-access-via-dll-search-order-hijacking.txt  [T1566,T1566.001,T1574,T1574.001]  Potential Initial Access via DLL Search Order Hijacking
  T1059_potential-kamikakabot-activity-lure-document-execution.txt  [T1059]  Potential KamiKakaBot Activity - Lure Document Execution
  potential-kamikakabot-activity-shutdown-schedule-task-creati.txt  []  Potential KamiKakaBot Activity - Shutdown Schedule Task Creation
  T1021.006_potential-lateral-movement-via-windows-remote-shell.txt  [T1021.006]  Potential Lateral Movement via Windows Remote Shell
  T1574.001_potential-libvlc-dll-sideloading.txt  [T1574.001]  Potential Libvlc.DLL Sideloading
  T1219.002_potential-linux-amazon-ssm-agent-hijacking.txt  [T1219.002]  Potential Linux Amazon SSM Agent Hijacking
  T1055.009_potential-linux-process-code-injection-via-dd-utility.txt  [T1055.009]  Potential Linux Process Code Injection Via DD Utility
  T1059_potential-moveit-transfer-cve-2023-34362-exploitation-dynami.txt  [T1059]  Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE
  T1574.001_potential-mfdetours-dll-sideloading.txt  [T1574.001]  Potential Mfdetours.DLL Sideloading
  T1127_potential-mftrace-exe-abuse.txt  [T1127]  Potential Mftrace.EXE Abuse
  T1040_potential-network-sniffing-activity-using-network-tools.txt  [T1040]  Potential Network Sniffing Activity Using Network Tools
  T1036.003_potential-pendingfilerenameoperations-tampering.txt  [T1036.003]  Potential PendingFileRenameOperations Tampering
  potential-persistence-attempt-via-errorhandler-cmd.txt  []  Potential Persistence Attempt Via ErrorHandler.Cmd
  T1543.003_potential-persistence-attempt-via-existing-service-tampering.txt  [T1543.003,T1574.011]  Potential Persistence Attempt Via Existing Service Tampering
  T1547.001_potential-persistence-attempt-via-run-keys-using-reg-exe.txt  [T1547.001]  Potential Persistence Attempt Via Run Keys Using Reg.EXE
  T1546.015_potential-persistence-using-debugpath.txt  [T1546.015]  Potential Persistence Using DebugPath
  T1546.011_potential-persistence-via-appcompat-registerapprestart-layer.txt  [T1546.011]  Potential Persistence Via AppCompat RegisterAppRestart Layer
  T1112_potential-persistence-via-custom-protocol-handler.txt  [T1112]  Potential Persistence Via Custom Protocol Handler
  T1112_potential-persistence-via-event-viewer-events-asp.txt  [T1112]  Potential Persistence Via Event Viewer Events.asp
  T1037.001_potential-persistence-via-logon-scripts-registry.txt  [T1037.001]  Potential Persistence Via Logon Scripts - Registry
  T1546.007_potential-persistence-via-netsh-helper-dll-registry.txt  [T1546.007]  Potential Persistence Via Netsh Helper DLL - Registry
  potential-persistence-via-new-amsi-providers-registry.txt  []  Potential Persistence Via New AMSI Providers - Registry
  potential-persistence-via-notepad-plugins.txt  []  Potential Persistence Via Notepad++ Plugins
  T1546.015_potential-persistence-via-scrobj-dll-com-hijacking.txt  [T1546.015]  Potential Persistence Via Scrobj.dll COM Hijacking
  T1137.006_potential-persistence-via-visual-studio-tools-for-office.txt  [T1137.006]  Potential Persistence Via Visual Studio Tools for Office
  T1059.003_potential-pikabot-infection-suspicious-command-combinations.txt  [T1059.003,T1105,T1218]  Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE
  T1552.001_potential-powershell-console-history-access-attempt-via-hist.txt  [T1552.001]  Potential PowerShell Console History Access Attempt via History File
  T1059.001_potential-powershell-downgrade-attack.txt  [T1059.001]  Potential PowerShell Downgrade Attack
  potential-powershell-execution-policy-tampering.txt  []  Potential PowerShell Execution Policy Tampering
  T1216_potential-process-execution-proxy-via-cl-invocation-ps1.txt  [T1216]  Potential Process Execution Proxy Via CL_Invocation.ps1
  T1218_potential-provlaunch-exe-binary-proxy-execution-abuse.txt  [T1218]  Potential Provlaunch.EXE Binary Proxy Execution Abuse
  T1574_potential-registry-persistence-attempt-via-dbgmanageddebugge.txt  [T1574]  Potential Registry Persistence Attempt Via DbgManagedDebugger
  T1218.010_potential-regsvr32-commandline-flag-anomaly.txt  [T1218.010]  Potential Regsvr32 Commandline Flag Anomaly
  T1021_potential-remote-desktop-tunneling.txt  [T1021]  Potential Remote Desktop Tunneling
  T1574.001_potential-rjvplatform-dll-sideloading-from-default-location.txt  [T1574.001]  Potential RjvPlatform.DLL Sideloading From Default Location
  T1574.001_potential-roboform-dll-sideloading.txt  [T1574.001]  Potential RoboForm.DLL Sideloading
  potential-ruby-reverse-shell.txt  []  Potential Ruby Reverse Shell
  T1059.003_potential-sap-netweaver-webshell-creation.txt  [T1059.003,T1190]  Potential SAP NetWeaver Webshell Creation
  T1059.003_potential-sap-netweaver-webshell-creation-linux.txt  [T1059.003,T1190]  Potential SAP NetWeaver Webshell Creation - Linux
  T1216_potential-script-proxy-execution-via-cl-mutexverifiers-ps1.txt  [T1216]  Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
  potential-sentinelone-shell-context-menu-scan-command-tamper.txt  []  Potential SentinelOne Shell Context Menu Scan Command Tampering
  T1574.001_potential-shelldispatch-dll-sideloading.txt  [T1574.001]  Potential ShellDispatch.DLL Sideloading
  T1574.001_potential-solidpdfcreator-dll-sideloading.txt  [T1574.001]  Potential SolidPDFCreator.DLL Sideloading
  T1204.002_potential-suspicious-browser-launch-from-document-reader-pro.txt  [T1204.002]  Potential Suspicious Browser Launch From Document Reader Process
  T1565.001_potential-suspicious-change-to-sensitive-critical-files.txt  [T1565.001]  Potential Suspicious Change To Sensitive/Critical Files
  potential-suspicious-powershell-module-file-created.txt  []  Potential Suspicious PowerShell Module File Created
  potential-suspicious-windows-feature-enabled-proccreation.txt  []  Potential Suspicious Windows Feature Enabled - ProcCreation
  T1548.002_potential-uac-bypass-via-sdclt-exe.txt  [T1548.002]  Potential UAC Bypass Via Sdclt.EXE
  T1574.001_potential-vivaldi-elf-dll-sideloading.txt  [T1574.001]  Potential Vivaldi_elf.DLL Sideloading
  T1574.001_potential-wwlib-dll-sideloading.txt  [T1574.001]  Potential WWlib.DLL Sideloading
  T1574.001_potential-wazuh-security-platform-dll-sideloading.txt  [T1574.001]  Potential Wazuh Security Platform DLL Sideloading
  T1505.003_potential-webshell-creation-on-static-website.txt  [T1505.003]  Potential Webshell Creation On Static Website
  potential-xcsset-malware-infection.txt  []  Potential XCSSET Malware Infection
  T1059_potential-xterm-reverse-shell.txt  [T1059]  Potential Xterm Reverse Shell
  T1090.004_potentially-suspicious-azure-front-door-connection.txt  [T1090.004,T1102.002]  Potentially Suspicious Azure Front Door Connection
  T1218_potentially-suspicious-cabinet-file-expansion.txt  [T1218]  Potentially Suspicious Cabinet File Expansion
  potentially-suspicious-child-process-of-clickonce-applicatio.txt  []  Potentially Suspicious Child Process Of ClickOnce Application
  T1218_potentially-suspicious-child-process-of-diskshadow-exe.txt  [T1218]  Potentially Suspicious Child Process Of DiskShadow.EXE
  T1202_potentially-suspicious-child-process-of-vscode.txt  [T1202,T1218]  Potentially Suspicious Child Process Of VsCode
  T1528_potentially-suspicious-command-targeting-teams-sensitive-fil.txt  [T1528]  Potentially Suspicious Command Targeting Teams Sensitive Files
  potentially-suspicious-dmp-hdmp-file-creation.txt  []  Potentially Suspicious DMP/HDMP File Creation
  T1112_potentially-suspicious-desktop-background-change-via-registr.txt  [T1112,T1491.001]  Potentially Suspicious Desktop Background Change Via Registry
  T1036_potentially-suspicious-execution-from-tmp-folder.txt  [T1036]  Potentially Suspicious Execution From Tmp Folder
  potentially-suspicious-execution-of-pdqdeployrunner.txt  []  Potentially Suspicious Execution Of PDQDeployRunner
  T1105_potentially-suspicious-file-creation-by-openedr-s-itsmservic.txt  [T1105,T1219,T1570]  Potentially Suspicious File Creation by OpenEDR's ITSMService
  T1528_potentially-suspicious-jwt-token-search-via-cli.txt  [T1528,T1552.001]  Potentially Suspicious JWT Token Search Via CLI
  potentially-suspicious-named-pipe-created-via-mkfifo.txt  []  Potentially Suspicious Named Pipe Created Via Mkfifo
  T1059.001_potentially-suspicious-powershell-child-processes.txt  [T1059.001]  Potentially Suspicious PowerShell Child Processes
  T1059.001_potentially-suspicious-powershell-script-execution-from-temp.txt  [T1059.001]  Potentially Suspicious Powershell Script Execution From Temp Folder
  T1218.011_potentially-suspicious-rundll32-activity.txt  [T1218.011]  Potentially Suspicious Rundll32 Activity
  T1090_potentially-suspicious-usage-of-qemu.txt  [T1090,T1572]  Potentially Suspicious Usage Of Qemu
  potentially-suspicious-wdac-policy-file-creation.txt  []  Potentially Suspicious WDAC Policy File Creation
  T1059.001_potentially-suspicious-webdav-lnk-execution.txt  [T1059.001,T1204]  Potentially Suspicious WebDAV LNK Execution
  potentially-suspicious-windows-app-activity.txt  []  Potentially Suspicious Windows App Activity
  T1070_powershell-console-history-logs-deleted.txt  [T1070]  PowerShell Console History Logs Deleted
  powershell-core-dll-loaded-via-office-application.txt  []  PowerShell Core DLL Loaded Via Office Application
  T1115_powershell-get-clipboard-cmdlet-via-cli.txt  [T1115]  PowerShell Get-Clipboard Cmdlet Via CLI
  powershell-module-file-created-by-non-powershell-process.txt  []  PowerShell Module File Created By Non-PowerShell Process
  T1546.013_powershell-profile-modification.txt  [T1546.013]  PowerShell Profile Modification
  T1059.001_powershell-script-run-in-appdata.txt  [T1059.001]  PowerShell Script Run in AppData
  T1685_powershell-defender-exclusion.txt  [T1685]  Powershell Defender Exclusion
  T1059.001_powershell-inline-execution-from-a-file.txt  [T1059.001]  Powershell Inline Execution From A File
  T1592.004_print-history-file-contents.txt  [T1592.004]  Print History File Contents
  T1003.001_procdump-execution.txt  [T1003.001,T1036]  Procdump Execution
  T1055_process-creation-using-sysnative-folder.txt  [T1055]  Process Creation Using Sysnative Folder
  process-launched-without-image-name.txt  []  Process Launched Without Image Name
  T1068_process-monitor-driver-creation-by-non-sysinternals-binary.txt  [T1068]  Process Monitor Driver Creation By Non-Sysinternals Binary
  T1218_process-proxy-execution-via-squirrel-exe.txt  [T1218]  Process Proxy Execution Via Squirrel.EXE
  publisher-attachment-file-dropped-in-suspicious-location.txt  []  Publisher Attachment File Dropped In Suspicious Location
  T1216.001_pubprn-vbs-proxy-execution.txt  [T1216.001]  Pubprn.vbs Proxy Execution
  T1059.006_python-path-configuration-file-creation-linux.txt  [T1059.006]  Python Path Configuration File Creation - Linux
  T1059.006_python-path-configuration-file-creation-macos.txt  [T1059.006]  Python Path Configuration File Creation - MacOS
  T1059.006_python-path-configuration-file-creation-windows.txt  [T1059.006]  Python Path Configuration File Creation - Windows
  T1059_python-spawning-pretty-tty-via-pty-module.txt  [T1059]  Python Spawning Pretty TTY Via PTY Module
  T1048.003_python-webserver-execution-linux.txt  [T1048.003]  Python WebServer Execution - Linux
  query-usage-to-exfil-data.txt  []  Query Usage To Exfil Data
  T1112_rdp-sensitive-settings-changed-to-zero.txt  [T1112]  RDP Sensitive Settings Changed to Zero
  T1218_register-app-vbs-proxy-execution.txt  [T1218]  REGISTER_APP.VBS Proxy Execution
  T1567.002_rclone-config-file-creation.txt  [T1567.002]  Rclone Config File Creation
  T1057_recon-command-output-piped-to-findstr-exe.txt  [T1057]  Recon Command Output Piped To Findstr.EXE
  register-new-ifiltre-for-persistence.txt  []  Register New IFiltre For Persistence
  T1112_registry-explorer-policy-modification.txt  [T1112]  Registry Explorer Policy Modification
  T1112_registry-hide-function-from-user.txt  [T1112]  Registry Hide Function from User
  T1059.005_registry-modification-attempt-via-vbscript.txt  [T1059.005,T1112]  Registry Modification Attempt Via VBScript
  T1137_registry-modification-to-hidden-file-extension.txt  [T1137]  Registry Modification to Hidden File Extension
  T1027.010_registry-set-with-crypto-classes-from-the-cryptography-power.txt  [T1027.010,T1059.001,T1547.001]  Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
  T1569.002_remcom-service-file-creation.txt  [T1569.002]  RemCom Service File Creation
  T1219.002_remote-access-tool-action1-arbitrary-code-execution-and-remo.txt  [T1219.002]  Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions
  remote-access-tool-ammy-admin-agent-execution.txt  []  Remote Access Tool - Ammy Admin Agent Execution
  T1219.002_remote-access-tool-anydesk-piped-password-via-cli.txt  [T1219.002]  Remote Access Tool - AnyDesk Piped Password Via CLI
  remote-access-tool-cmd-exe-execution-via-anyviewer.txt  []  Remote Access Tool - Cmd.EXE Execution via AnyViewer
  T1219.002_remote-access-tool-meshagent-command-execution-via-meshcentr.txt  [T1219.002]  Remote Access Tool - MeshAgent Command Execution via MeshCentral
  T1219.002_remote-access-tool-potential-meshagent-execution-macos.txt  [T1219.002]  Remote Access Tool - Potential MeshAgent Execution - MacOS
  T1219.002_remote-access-tool-potential-meshagent-execution-windows.txt  [T1219.002]  Remote Access Tool - Potential MeshAgent Execution - Windows
  remote-access-tool-rurat-execution-from-unusual-location.txt  []  Remote Access Tool - RURAT Execution From Unusual Location
  T1133_remote-access-tool-screenconnect-installation-execution.txt  [T1133]  Remote Access Tool - ScreenConnect Installation Execution
  T1219.002_remote-access-tool-screenconnect-potential-suspicious-remote.txt  [T1219.002]  Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
  remote-access-tool-screenconnect-remote-command-execution-hu.txt  []  Remote Access Tool - ScreenConnect Remote Command Execution - Hunting
  T1219.002_remote-access-tool-simple-help-execution.txt  [T1219.002]  Remote Access Tool - Simple Help Execution
  T1105_remote-access-tool-tacticalrmm-agent-registration-to-potenti.txt  [T1105,T1219]  Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
  T1204.002_remote-dll-load-via-rundll32-exe.txt  [T1204.002]  Remote DLL Load Via Rundll32.EXE
  T1105_remote-file-download-via-desktopimgdownldr-utility.txt  [T1105]  Remote File Download Via Desktopimgdownldr Utility
  T1021.006_remote-powershell-session-host-process-winrm.txt  [T1021.006,T1059.001]  Remote PowerShell Session Host Process (WinRM)
  T1685_removal-of-index-value-to-hide-schedule-task-registry.txt  [T1685]  Removal Of Index Value to Hide Schedule Task - Registry
  T1685_removal-of-sd-value-to-hide-schedule-task-registry.txt  [T1685]  Removal Of SD Value to Hide Schedule Task - Registry
  T1112_removal-of-potential-com-hijacking-registry-keys.txt  [T1112]  Removal of Potential COM Hijacking Registry Keys
  T1222.002_remove-immutable-file-attribute.txt  [T1222.002]  Remove Immutable File Attribute
  remove-scheduled-cron-task-job.txt  []  Remove Scheduled Cron Task/Job
  renamed-remote-utilities-rat-rurat-execution.txt  []  Renamed Remote Utilities RAT (RURAT) Execution
  T1105_replace-exe-usage.txt  [T1105]  Replace.exe Usage
  T1078_root-account-enable-via-dsenableroot.txt  [T1078,T1078.001,T1078.003]  Root Account Enable Via Dsenableroot
  T1112_run-once-task-configuration-in-registry.txt  [T1112]  Run Once Task Configuration in Registry
  T1218.011_scr-file-write-event.txt  [T1218.011]  SCR File Write Event
  T1053.005_schedule-task-creation-from-env-variable-or-potentially-susp.txt  [T1053.005]  Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
  T1053.003_scheduled-cron-task-job-linux.txt  [T1053.003]  Scheduled Cron Task/Job - Linux
  T1053.003_scheduled-cron-task-job-macos.txt  [T1053.003]  Scheduled Cron Task/Job - MacOs
  T1053.005_scheduled-task-creation-from-potential-suspicious-parent-loc.txt  [T1053.005]  Scheduled Task Creation From Potential Suspicious Parent Location
  T1053.005_scheduled-task-creation-with-curl-and-powershell-execution-c.txt  [T1053.005,T1105,T1218]  Scheduled Task Creation with Curl and PowerShell Execution Combo
  T1113_screen-capture-activity-via-psr-exe.txt  [T1113]  Screen Capture Activity Via Psr.EXE
  T1219.002_screenconnect-temporary-installation-artefact.txt  [T1219.002]  ScreenConnect Temporary Installation Artefact
  screenconnect-user-database-modification.txt  []  ScreenConnect User Database Modification
  T1218.011_screensaver-registry-key-set.txt  [T1218.011]  ScreenSaver Registry Key Set
  T1685_scripted-diagnostics-turn-off-check-enabled-registry.txt  [T1685]  Scripted Diagnostics Turn Off Check Enabled - Registry
  T1218.010_scripting-commandline-process-spawned-regsvr32.txt  [T1218.010]  Scripting/CommandLine Process Spawned Regsvr32
  T1548.002_sdclt-child-processes.txt  [T1548.002]  Sdclt Child Processes
  T1518.001_security-software-discovery-macos.txt  [T1518.001]  Security Software Discovery - MacOs
  T1218_self-extraction-directive-file-created-in-potentially-suspic.txt  [T1218]  Self Extraction Directive File Created In Potentially Suspicious Location
  T1112_service-binary-in-user-controlled-folder.txt  [T1112]  Service Binary in User Controlled Folder
  T1543.003_servicedll-hijack.txt  [T1543.003]  ServiceDll Hijack
  T1546.009_session-manager-autorun-keys-modification.txt  [T1546.009,T1547.001]  Session Manager Autorun Keys Modification
  T1574.005_setup16-exe-execution-with-custom-lst-file.txt  [T1574.005]  Setup16.EXE Execution With Custom .Lst File
  T1083_shell-invocation-via-apt-linux.txt  [T1083]  Shell Invocation via Apt - Linux
  shell-process-spawned-by-java-exe.txt  []  Shell Process Spawned by Java.EXE
  start-of-nt-virtual-dos-machine.txt  []  Start of NT Virtual DOS Machine
  T1547.001_startup-folder-file-write.txt  [T1547.001]  Startup Folder File Write
  T1486_suspicious-appended-extension.txt  [T1486]  Suspicious Appended Extension
  T1059.003_suspicious-child-process-of-sap-netweaver.txt  [T1059.003,T1190]  Suspicious Child Process of SAP NetWeaver
  T1059.003_suspicious-child-process-of-sap-netweaver-linux.txt  [T1059.003,T1190]  Suspicious Child Process of SAP NetWeaver - Linux
  T1036_suspicious-codepage-switch-via-chcp.txt  [T1036]  Suspicious CodePage Switch Via CHCP
  T1486_suspicious-creation-txt-file-in-user-desktop.txt  [T1486]  Suspicious Creation TXT File in User Desktop
  T1187_suspicious-creation-of-library-ms-file-potential-cve-2025-24.txt  [T1187]  Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit
  T1059.001_suspicious-crushftp-child-process.txt  [T1059.001,T1059.003,T1190]  Suspicious CrushFTP Child Process
  T1071.001_suspicious-curl-change-user-agents-linux.txt  [T1071.001]  Suspicious Curl Change User Agents - Linux
  T1105_suspicious-curl-file-upload-linux.txt  [T1105,T1567]  Suspicious Curl File Upload - Linux
  T1564.004_suspicious-diantz-alternate-data-stream-execution.txt  [T1564.004]  Suspicious Diantz Alternate Data Stream Execution
  T1105_suspicious-diantz-download-and-compress-into-a-cab-file.txt  [T1105]  Suspicious Diantz Download and Compress Into a CAB File
  T1547_suspicious-driver-install-by-pnputil-exe.txt  [T1547]  Suspicious Driver Install by pnputil.exe
  suspicious-electron-application-child-processes.txt  []  Suspicious Electron Application Child Processes
  suspicious-execution-of-installutil-without-log.txt  []  Suspicious Execution of InstallUtil Without Log
  T1059.001_suspicious-execution-of-powershell-with-base64.txt  [T1059.001]  Suspicious Execution of Powershell with Base64
  T1529_suspicious-execution-of-shutdown.txt  [T1529]  Suspicious Execution of Shutdown
  T1529_suspicious-execution-of-shutdown-to-log-out.txt  [T1529]  Suspicious Execution of Shutdown to Log Out
  T1059_suspicious-execution-via-macos-script-editor.txt  [T1059,T1059.002,T1204,T1204.001,T1553,T1566,T1566.002]  Suspicious Execution via macOS Script Editor
  T1564.004_suspicious-extrac32-alternate-data-stream-execution.txt  [T1564.004]  Suspicious Extrac32 Alternate Data Stream Execution
  T1059_suspicious-file-created-in-perflogs.txt  [T1059]  Suspicious File Created In PerfLogs
  T1190_suspicious-file-drop-by-exchange.txt  [T1190,T1505.003]  Suspicious File Drop by Exchange
  T1190_suspicious-file-write-to-webapps-root-directory.txt  [T1190,T1505.003]  Suspicious File Write to Webapps Root Directory
  T1036.005_suspicious-files-in-default-gpo-folder.txt  [T1036.005]  Suspicious Files in Default GPO Folder
  T1132.001_suspicious-frombase64string-usage-on-gzip-archive-process-cr.txt  [T1132.001]  Suspicious FromBase64String Usage On Gzip Archive - Process Creation
  T1593.003_suspicious-git-clone-linux.txt  [T1593.003]  Suspicious Git Clone - Linux
  T1552.003_suspicious-history-file-operations.txt  [T1552.003]  Suspicious History File Operations
  T1059_suspicious-installer-package-child-process.txt  [T1059,T1059.007,T1071,T1071.001]  Suspicious Installer Package Child Process
  T1588.002_suspicious-keyboard-layout-load.txt  [T1588.002]  Suspicious Keyboard Layout Load
  T1036.007_suspicious-lnk-double-extension-file-created.txt  [T1036.007]  Suspicious LNK Double Extension File Created
  suspicious-macos-firmware-activity.txt  []  Suspicious MacOS Firmware Activity
  T1218.007_suspicious-msiexec-embedding-parent.txt  [T1218.007]  Suspicious MsiExec Embedding Parent
  T1218.007_suspicious-msiexec-execute-arbitrary-dll.txt  [T1218.007]  Suspicious Msiexec Execute Arbitrary DLL
  T1016_suspicious-network-connection-to-ip-lookup-service-apis.txt  [T1016]  Suspicious Network Connection to IP Lookup Service APIs
  suspicious-new-instance-of-an-office-com-object.txt  []  Suspicious New Instance Of An Office COM Object
  T1102_suspicious-non-browser-network-communication-with-telegram-a.txt  [T1102,T1105,T1567]  Suspicious Non-Browser Network Communication With Telegram API
  T1685_suspicious-procexp152-sys-file-created-in-tmp.txt  [T1685]  Suspicious PROCEXP152.sys File Created In TMP
  T1553.004_suspicious-package-installed-linux.txt  [T1553.004]  Suspicious Package Installed - Linux
  T1547.001_suspicious-powershell-in-registry-run-keys.txt  [T1547.001]  Suspicious PowerShell In Registry Run Keys
  T1059.001_suspicious-powershell-invocation-from-script-engines.txt  [T1059.001]  Suspicious PowerShell Invocation From Script Engines
  suspicious-powershell-invocations-specific-processcreation.txt  []  Suspicious PowerShell Invocations - Specific - ProcessCreation
  T1036_suspicious-process-start-locations.txt  [T1036]  Suspicious Process Start Locations
  T1059_suspicious-rasdial-activity.txt  [T1059]  Suspicious RASdial Activity
  T1087.001_suspicious-reconnaissance-activity-using-get-localgroupmembe.txt  [T1087.001]  Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
  T1222.001_suspicious-recursive-takeown.txt  [T1222.001]  Suspicious Recursive Takeown
  suspicious-runas-like-flag-combination.txt  []  Suspicious RunAs-Like Flag Combination
  T1218.011_suspicious-rundll32-setupapi-dll-activity.txt  [T1218.011]  Suspicious Rundll32 Setupapi.dll Activity
  T1059_suspicious-runscripthelper-exe.txt  [T1059,T1202]  Suspicious Runscripthelper.exe
  T1552.006_suspicious-sysvol-domain-group-policy-access.txt  [T1552.006]  Suspicious SYSVOL Domain Group Policy Access
  T1018_suspicious-scan-loop-network.txt  [T1018,T1059]  Suspicious Scan Loop Network
  T1053.005_suspicious-scheduled-task-name-as-guid.txt  [T1053.005]  Suspicious Scheduled Task Name As GUID
  T1546.002_suspicious-screensave-change-by-reg-exe.txt  [T1546.002]  Suspicious ScreenSave Change by Reg.exe
  T1546.002_suspicious-screensaver-binary-file-creation.txt  [T1546.002]  Suspicious Screensaver Binary File Creation
  T1685_suspicious-service-installed.txt  [T1685]  Suspicious Service Installed
  T1221_suspicious-set-value-of-msdt-in-registry-cve-2022-30190.txt  [T1221]  Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
  T1546.001_suspicious-shell-open-command-registry-modification.txt  [T1546.001,T1548.002]  Suspicious Shell Open Command Registry Modification
  T1210_suspicious-sysaidserver-child.txt  [T1210]  Suspicious SysAidServer Child
  T1027.010_suspicious-usage-of-for-loop-with-recursive-directory-search.txt  [T1027.010,T1059.003]  Suspicious Usage of For Loop with Recursive Directory Search in CMD
  T1112_suspicious-vboxdrvinst-exe-parameters.txt  [T1112]  Suspicious VBoxDrvInst.exe Parameters
  T1218_suspicious-vsls-agent-command-with-agentextensionpath-load.txt  [T1218]  Suspicious Vsls-Agent Command With AgentExtensionPath Load
  T1685_suspicious-windows-defender-folder-exclusion-added-via-reg-e.txt  [T1685]  Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
  suspicious-windowsterminal-child-processes.txt  []  Suspicious WindowsTerminal Child Processes
  T1553.004_suspicious-x509enrollment-process-creation.txt  [T1553.004]  Suspicious X509Enrollment - Process Creation
  T1202_suspicious-zipexec-execution.txt  [T1202,T1218]  Suspicious ZipExec Execution
  T1216_syncappvpublishingserver-vbs-execute-arbitrary-powershell-co.txt  [T1216,T1218]  SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
  T1059_sysprep-on-appdata-folder.txt  [T1059]  Sysprep on AppData Folder
  T1082_system-information-discovery-using-ioreg.txt  [T1082]  System Information Discovery Using Ioreg
  T1082_system-information-discovery-using-system-profiler.txt  [T1082,T1497.001]  System Information Discovery Using System_Profiler
  T1082_system-information-discovery-using-sw-vers.txt  [T1082]  System Information Discovery Using sw_vers
  T1082_system-information-discovery-via-sysctl-macos.txt  [T1082,T1497.001]  System Information Discovery Via Sysctl - MacOS
  T1518.001_system-integrity-protection-sip-disabled.txt  [T1518.001]  System Integrity Protection (SIP) Disabled
  T1547.001_system-scripts-autorun-keys-modification.txt  [T1547.001]  System Scripts Autorun Keys Modification
  T1048_tap-installer-execution.txt  [T1048]  Tap Installer Execution
  T1219.002_teamviewer-remote-session.txt  [T1219.002]  TeamViewer Remote Session
  T1685_terminate-linux-process-via-kill.txt  [T1685]  Terminate Linux Process Via Kill
  T1574.001_third-party-software-dll-sideloading.txt  [T1574.001]  Third Party Software DLL Sideloading
  T1490_time-machine-backup-deletion-attempt-via-tmutil-macos.txt  [T1490]  Time Machine Backup Deletion Attempt Via Tmutil - MacOS
  T1490_time-machine-backup-disabled-via-tmutil-macos.txt  [T1490]  Time Machine Backup Disabled Via Tmutil - MacOS
  T1070_tomcat-webserver-logs-deleted.txt  [T1070]  Tomcat WebServer Logs Deleted
  T1070.006_touch-suspicious-service-file.txt  [T1070.006]  Touch Suspicious Service File
  T1041_tunneling-tool-execution.txt  [T1041,T1071.001,T1572]  Tunneling Tool Execution
  T1548_uac-bypass-via-windows-firewall-snap-in-hijack.txt  [T1548]  UAC Bypass via Windows Firewall Snap-In Hijack
  T1548.002_uac-disabled.txt  [T1548.002]  UAC Disabled
  T1548.002_uac-notification-disabled.txt  [T1548.002]  UAC Notification Disabled
  T1548.002_uac-secure-desktop-prompt-disabled.txt  [T1548.002]  UAC Secure Desktop Prompt Disabled
  T1686_ufw-disable-attempt.txt  [T1686]  UFW Disable Attempt
  T1218_uncommon-child-process-of-addinutil-exe.txt  [T1218]  Uncommon Child Process Of AddinUtil.EXE
  T1218_uncommon-child-process-of-appvlp-exe.txt  [T1218]  Uncommon Child Process Of Appvlp.EXE
  T1059.005_uncommon-child-process-of-bginfo-exe.txt  [T1059.005,T1202,T1218]  Uncommon Child Process Of BgInfo.EXE
  T1218_uncommon-child-process-of-defaultpack-exe.txt  [T1218]  Uncommon Child Process Of Defaultpack.EXE
  T1218.008_uncommon-child-process-spawned-by-odbcconf-exe.txt  [T1218.008]  Uncommon Child Process Spawned By Odbcconf.EXE
  uncommon-child-processes-of-sndvol-exe.txt  []  Uncommon Child Processes Of SndVol.exe
  T1218_uncommon-link-exe-parent-process.txt  [T1218]  Uncommon Link.EXE Parent Process
  T1216_uncommon-sigverif-exe-child-process.txt  [T1216]  Uncommon Sigverif.EXE Child Process
  T1059_unusual-parent-process-for-cmd-exe.txt  [T1059]  Unusual Parent Process For Cmd.EXE
  T1059.001_usage-of-web-request-commands-and-cmdlets.txt  [T1059.001]  Usage Of Web Request Commands And Cmdlets
  T1564.004_use-ntfs-short-name-in-command-line.txt  [T1564.004]  Use NTFS Short Name in Command Line
  T1564.004_use-ntfs-short-name-in-image.txt  [T1564.004]  Use NTFS Short Name in Image
  T1218_use-of-the-sftp-exe-binary-as-a-lolbin.txt  [T1218]  Use Of The SFTP.EXE Binary As A LOLBIN
  T1564.004_use-short-name-path-in-command-line.txt  [T1564.004]  Use Short Name Path in Command Line
  T1059_use-of-pcalua-for-execution.txt  [T1059]  Use of Pcalua For Execution
  T1078.003_user-added-to-admin-group-via-dscl.txt  [T1078.003]  User Added To Admin Group Via Dscl
  T1078.003_user-added-to-admin-group-via-dseditgroup.txt  [T1078.003]  User Added To Admin Group Via DseditGroup
  T1078.003_user-added-to-admin-group-via-sysadminctl.txt  [T1078.003]  User Added To Admin Group Via Sysadminctl
  user-added-to-root-sudoers-group-using-usermod.txt  []  User Added To Root/Sudoers Group Using Usermod
  T1098_user-added-to-local-administrators-group.txt  [T1098]  User Added to Local Administrators Group
  T1531_user-has-been-deleted-via-userdel.txt  [T1531]  User Has Been Deleted Via Userdel
  T1216_utilityfunctions-ps1-proxy-dll.txt  [T1216]  UtilityFunctions.ps1 Proxy Dll
  T1587.001_vhd-image-download-via-browser.txt  [T1587.001]  VHD Image Download Via Browser
  T1005_veeam-backup-database-suspicious-query.txt  [T1005]  Veeam Backup Database Suspicious Query
  visual-studio-code-tunnel-remote-file-creation.txt  []  Visual Studio Code Tunnel Remote File Creation
  T1071.001_visual-studio-code-tunnel-service-installation.txt  [T1071.001]  Visual Studio Code Tunnel Service Installation
  T1071.001_visual-studio-code-tunnel-shell-execution.txt  [T1071.001]  Visual Studio Code Tunnel Shell Execution
  T1218_visual-studio-nodejstools-pressanykey-arbitrary-binary-execu.txt  [T1218]  Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
  vscode-code-tunnel-execution-file-indicator.txt  []  VsCode Code Tunnel Execution File Indicator
  T1546.013_vscode-powershell-profile-modification.txt  [T1546.013]  VsCode Powershell Profile Modification
  T1685_wdac-policy-file-creation-in-codeintegrity-folder.txt  [T1685]  WDAC Policy File Creation In CodeIntegrity Folder
  T1569.002_wfp-filter-added-via-registry.txt  [T1569.002,T1685]  WFP Filter Added via Registry
  T1546.003_wmi-activescripteventconsumers-activity-via-scrcons-exe-dll.txt  [T1546.003]  WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
  T1546.003_wmi-persistence-script-event-consumer.txt  [T1546.003]  WMI Persistence - Script Event Consumer
  T1220_wmic-loading-scripting-libraries.txt  [T1220]  WMIC Loading Scripting Libraries
  T1202_wsl-child-process-anomaly.txt  [T1202,T1218]  WSL Child Process Anomaly
  weak-or-abused-passwords-in-cli.txt  []  Weak or Abused Passwords In CLI
  T1566_webdav-temporary-local-file-creation.txt  [T1566,T1584]  WebDAV Temporary Local File Creation
  T1685_werfaultsecure-loading-dbgcore-or-dbghelp-edr-freeze.txt  [T1685]  WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze
  T1105_wget-creating-files-in-tmp-directory.txt  [T1105]  Wget Creating Files in Tmp Directory
  T1547.001_winsock2-autorun-keys-modification.txt  [T1547.001]  WinSock2 Autorun Keys Modification
  winsxs-executable-file-creation-by-non-system-process.txt  []  WinSxS Executable File Creation By Non-System Process
  T1202_windows-binary-executed-from-wsl.txt  [T1202]  Windows Binary Executed From WSL
  T1685_windows-defender-exclusions-added-registry.txt  [T1685]  Windows Defender Exclusions Added - Registry
  T1113_windows-recall-feature-enabled-registry.txt  [T1113]  Windows Recall Feature Enabled - Registry
  T1566.001_windows-registry-trust-record-modification.txt  [T1566.001]  Windows Registry Trust Record Modification
  T1547.015_windows-terminal-profile-settings-modification-by-uncommon-p.txt  [T1547.015]  Windows Terminal Profile Settings Modification By Uncommon Process
  T1112_winlogon-allowmultipletssessions-enable.txt  [T1112]  Winlogon AllowMultipleTSSessions Enable
  T1547.001_wow6432node-classes-autorun-keys-modification.txt  [T1547.001]  Wow6432Node Classes Autorun Keys Modification
  T1685_write-protect-for-storage-disabled.txt  [T1685]  Write Protect For Storage Disabled
  T1546.002_writing-local-admin-share.txt  [T1546.002]  Writing Local Admin Share
  T1059_writing-of-malicious-files-to-the-fonts-folder.txt  [T1059,T1211]  Writing Of Malicious Files To The Fonts Folder
  T1059_wscript-shell-run-in-commandline.txt  [T1059]  Wscript Shell Run In CommandLine
  T1070.004_ads-zone-identifier-deleted.txt  [T1070.004]  ADS Zone.Identifier Deleted
  T1197_bits-client-bitsproxy-dll-loaded-by-uncommon-process.txt  [T1197]  BITS Client BitsProxy DLL Loaded By Uncommon Process
  bash-interactive-shell.txt  []  Bash Interactive Shell
  T1218_bitlockertogo-exe-execution.txt  [T1218]  BitLockerTogo.EXE Execution
  T1105_browser-execution-in-headless-mode.txt  [T1105,T1564.003]  Browser Execution In Headless Mode
  cve-2023-40477-potential-exploitation-rev-file-creation.txt  []  CVE-2023-40477 Potential Exploitation - .REV File Creation
  T1083_capabilities-discovery-linux.txt  [T1083]  Capabilities Discovery - Linux
  T1115_clipboard-collection-with-xclip-tool.txt  [T1115]  Clipboard Collection with Xclip Tool
  command-executed-via-run-dialog-box-registry.txt  []  Command Executed Via Run Dialog Box - Registry
  T1090_connection-proxy.txt  [T1090]  Connection Proxy
  T1082_container-residence-discovery-via-proc-virtual-fs.txt  [T1082]  Container Residence Discovery Via Proc Virtual FS
  T1136.001_creation-of-a-local-user-account.txt  [T1136.001]  Creation Of A Local User Account
  T1587.001_creation-of-an-executable-by-an-executable.txt  [T1587.001]  Creation of an Executable by an Executable
  T1007_crontab-enumeration.txt  [T1007]  Crontab Enumeration
  T1105_curl-usage-on-linux.txt  [T1105]  Curl Usage on Linux
  T1105_curl-exe-execution.txt  [T1105]  Curl.EXE Execution
  T1485_dd-file-overwrite.txt  [T1485]  DD File Overwrite
  dmp-hdmp-file-creation.txt  []  DMP/HDMP File Creation
  T1027_decode-base64-encoded-text.txt  [T1027]  Decode Base64 Encoded Text
  T1027_decode-base64-encoded-text-macos.txt  [T1027]  Decode Base64 Encoded Text -MacOs
  T1124_discovery-of-a-system-time.txt  [T1124]  Discovery of a System Time
  T1082_docker-container-discovery-via-dockerenv-listing.txt  [T1082]  Docker Container Discovery Via Dockerenv Listing
  T1027.004_dynamic-csharp-compile-artefact.txt  [T1027.004]  Dynamic CSharp Compile Artefact
  T1112_etw-logging-disabled-for-scm.txt  [T1112,T1685]  ETW Logging Disabled For SCM
  T1112_etw-logging-disabled-for-rpcrt4-dll.txt  [T1112,T1685]  ETW Logging Disabled For rpcrt4.dll
  T1560.001_files-added-to-an-archive-using-rar-exe.txt  [T1560.001]  Files Added To An Archive Using Rar.EXE
  T1056.002_gui-input-capture-macos.txt  [T1056.002]  GUI Input Capture - macOS
  T1553.001_gatekeeper-bypass-via-xattr.txt  [T1553.001]  Gatekeeper Bypass via Xattr
  T1078_guest-account-enabled-via-sysadminctl.txt  [T1078,T1078.001]  Guest Account Enabled Via Sysadminctl
  T1566.001_html-file-opened-from-download-folder.txt  [T1566.001,T1598.002]  HTML File Opened From Download Folder
  T1218_indirect-command-execution-by-program-compatibility-wizard.txt  [T1218]  Indirect Command Execution By Program Compatibility Wizard
  T1553.004_install-root-certificate.txt  [T1553.004]  Install Root Certificate
  jamf-mdm-execution.txt  []  JAMF MDM Execution
  T1548_linux-doas-tool-execution.txt  [T1548]  Linux Doas Tool Execution
  T1046_linux-network-service-scanning-tools-execution.txt  [T1046]  Linux Network Service Scanning Tools Execution
  T1070_linux-package-uninstall.txt  [T1070]  Linux Package Uninstall
  T1018_linux-remote-system-discovery.txt  [T1018]  Linux Remote System Discovery
  T1548_linux-setgid-capability-set-on-a-binary-via-setcap-utility.txt  [T1548,T1554]  Linux Setgid Capability Set on a Binary via Setcap Utility
  T1548_linux-setuid-capability-set-on-a-binary-via-setcap-utility.txt  [T1548,T1554]  Linux Setuid Capability Set on a Binary via Setcap Utility
  T1068_linux-sudo-chroot-execution.txt  [T1068]  Linux Sudo Chroot Execution
  T1069.001_local-groups-discovery-linux.txt  [T1069.001]  Local Groups Discovery - Linux
  T1087.001_local-system-accounts-discovery-linux.txt  [T1087.001]  Local System Accounts Discovery - Linux
  T1087.001_local-system-accounts-discovery-macos.txt  [T1087.001]  Local System Accounts Discovery - MacOs
  T1046_macos-network-service-scanning.txt  [T1046]  MacOS Network Service Scanning
  T1070.005_maxmpxct-registry-value-changed.txt  [T1070.005]  MaxMpxCt Registry Value Changed
  T1204.002_microsoft-excel-add-in-loaded.txt  [T1204.002]  Microsoft Excel Add-In Loaded
  T1204.002_microsoft-word-add-in-loaded.txt  [T1204.002]  Microsoft Word Add-In Loaded
  T1003.003_ntds-dit-created.txt  [T1003.003]  NTDS.DIT Created
  named-pipe-created-via-mkfifo.txt  []  Named Pipe Created Via Mkfifo
  T1053.003_new-cron-file-created.txt  [T1053.003]  New Cron File Created
  new-odbc-driver-registered.txt  []  New ODBC Driver Registered
  T1036_new-process-created-via-taskmgr-exe.txt  [T1036]  New Process Created Via Taskmgr.EXE
  T1543.003_new-service-creation-using-powershell.txt  [T1543.003]  New Service Creation Using PowerShell
  T1543.003_new-service-creation-using-sc-exe.txt  [T1543.003]  New Service Creation Using Sc.EXE
  T1083_notepad-password-files-discovery.txt  [T1083]  Notepad Password Files Discovery
  T1082_os-architecture-discovery-via-grep.txt  [T1082]  OS Architecture Discovery Via Grep
  T1566.001_office-macro-file-creation.txt  [T1566.001]  Office Macro File Creation
  T1566.001_office-macro-file-download.txt  [T1566.001]  Office Macro File Download
  T1137_outlook-task-note-reminder-received.txt  [T1137]  Outlook Task/Note Reminder Received
  T1552.004_pfx-file-creation.txt  [T1552.004]  PFX File Creation
  T1018_pua-adidnsdump-execution.txt  [T1018]  PUA - Adidnsdump Execution
  T1588.002_pua-sysinternal-tool-execution-registry.txt  [T1588.002]  PUA - Sysinternal Tool Execution - Registry
  T1574.001_potential-7za-dll-sideloading.txt  [T1574.001]  Potential 7za.DLL Sideloading
  T1082_potential-container-discovery-via-inodes-listing.txt  [T1082]  Potential Container Discovery Via Inodes Listing
  T1588.002_potential-execution-of-sysinternals-tools.txt  [T1588.002]  Potential Execution of Sysinternals Tools
  T1218_potential-proxy-execution-via-explorer-exe-from-shell-proces.txt  [T1218]  Potential Proxy Execution Via Explorer.EXE From Shell Process
  T1112_potential-raspberry-robin-registry-set-internet-settings-zon.txt  [T1112]  Potential Raspberry Robin Registry Set Internet Settings ZoneMap
  T1027_potentially-suspicious-long-filename-pattern-linux.txt  [T1027,T1059.004]  Potentially Suspicious Long Filename Pattern - Linux
  T1102_potentially-suspicious-network-connection-to-notion-api.txt  [T1102]  Potentially Suspicious Network Connection To Notion API
  potentially-suspicious-shell-script-creation-in-profile-fold.txt  []  Potentially Suspicious Shell Script Creation in Profile Folder
  powershell-module-file-created.txt  []  PowerShell Module File Created
  powershell-script-dropped-via-powershell-exe.txt  []  PowerShell Script Dropped Via PowerShell.EXE
  powershell-script-execution-policy-enabled.txt  []  PowerShell Script Execution Policy Enabled
  T1057_process-discovery.txt  [T1057]  Process Discovery
  T1105_process-execution-from-webdav-share.txt  [T1105]  Process Execution From WebDAV Share
  T1569.002_psexec-service-file-creation.txt  [T1569.002]  PsExec Service File Creation
  T1219.002_quickassist-execution.txt  [T1219.002]  QuickAssist Execution
  T1059.003_remote-access-tool-screenconnect-temporary-file.txt  [T1059.003]  Remote Access Tool - ScreenConnect Temporary File
  T1133_remote-access-tool-team-viewer-session-started-on-linux-host.txt  [T1133]  Remote Access Tool - Team Viewer Session Started On Linux Host
  T1133_remote-access-tool-team-viewer-session-started-on-macos-host.txt  [T1133]  Remote Access Tool - Team Viewer Session Started On MacOS Host
  T1133_remote-access-tool-team-viewer-session-started-on-windows-ho.txt  [T1133]  Remote Access Tool - Team Viewer Session Started On Windows Host
  snake-malware-installer-name-indicators.txt  []  SNAKE Malware Installer Name Indicators
  T1053.005_scheduled-task-created-filecreation.txt  [T1053.005]  Scheduled Task Created - FileCreation
  T1053.005_scheduled-task-created-registry.txt  [T1053.005]  Scheduled Task Created - Registry
  T1053.005_scheduled-task-creation-via-schtasks-exe.txt  [T1053.005]  Scheduled Task Creation Via Schtasks.EXE
  T1053.002_scheduled-task-job-at.txt  [T1053.002]  Scheduled Task/Job At
  T1113_screen-capture-macos.txt  [T1113]  Screen Capture - macOS
  T1518.001_security-software-discovery-linux.txt  [T1518.001]  Security Software Discovery - Linux
  T1548.001_setuid-and-setgid.txt  [T1548.001]  Setuid and Setgid
  shell-context-menu-command-tampering.txt  []  Shell Context Menu Command Tampering
  T1036.006_space-after-filename-macos.txt  [T1036.006]  Space After Filename - macOS
  T1030_split-a-file-into-pieces.txt  [T1030]  Split A File Into Pieces
  T1037.005_startup-item-file-created-macos.txt  [T1037.005]  Startup Item File Created - MacOS
  T1059.007_suspicious-deno-file-written-from-remote-source.txt  [T1059.007,T1105,T1204]  Suspicious Deno File Written from Remote Source
  T1082_suspicious-execution-of-hostname.txt  [T1082]  Suspicious Execution of Hostname
  T1016_suspicious-network-command.txt  [T1016]  Suspicious Network Command
  T1082_suspicious-query-of-machineguid.txt  [T1082]  Suspicious Query of MachineGUID
  T1113_system-drawing-dll-load.txt  [T1113]  System Drawing DLL Load
  T1082_system-information-discovery-via-registry-queries.txt  [T1082]  System Information Discovery via Registry Queries
  T1518.001_system-integrity-protection-sip-enumeration.txt  [T1518.001]  System Integrity Protection (SIP) Enumeration
  T1049_system-network-connections-discovery-linux.txt  [T1049]  System Network Connections Discovery - Linux
  T1070.004_teamviewer-log-file-deleted.txt  [T1070.004]  TeamViewer Log File Deleted
  T1564_virtualbox-driver-installation-or-starting-of-vms.txt  [T1564,T1564.006]  Virtualbox Driver Installation or Starting of VMs
  T1047_wmi-module-loaded-by-uncommon-process.txt  [T1047]  WMI Module Loaded By Uncommon Process
  winget-admin-settings-modification.txt  []  Winget Admin Settings Modification
  T1070.004_file-deletion.txt  [T1070.004]  File Deletion
  T1083_file-and-directory-discovery-linux.txt  [T1083]  File and Directory Discovery - Linux
  T1083_file-and-directory-discovery-macos.txt  [T1083]  File and Directory Discovery - MacOS
  T1069.001_local-groups-discovery-macos.txt  [T1069.001]  Local Groups Discovery - MacOs
  T1018_macos-remote-system-discovery.txt  [T1018]  Macos Remote System Discovery
  T1040_network-sniffing-macos.txt  [T1040]  Network Sniffing - MacOs
  T1204.002_new-application-in-appcompat.txt  [T1204.002]  New Application in AppCompat
  T1202_suspicious-high-integritylevel-conhost-legacy-option.txt  [T1202]  Suspicious High IntegrityLevel Conhost Legacy Option
  T1082_system-information-discovery.txt  [T1082]  System Information Discovery
  T1049_system-network-connections-discovery-macos.txt  [T1049]  System Network Connections Discovery - MacOs
  T1016_system-network-discovery-linux.txt  [T1016]  System Network Discovery - Linux
  T1016_system-network-discovery-macos.txt  [T1016]  System Network Discovery - macOS
  T1529_system-shutdown-reboot-macos.txt  [T1529]  System Shutdown/Reboot - MacOs
  T1574_windows-spooler-service-suspicious-binary-load.txt  [T1574]  Windows Spooler Service Suspicious Binary Load
