threatengine.sh Sigma export
format: generic Sigma (one .yml per rule, the raw rule)
rules: 1715

files:
  rdp-file-created-by-uncommon-application.yml  []  .RDP File Created By Uncommon Application
  aadinternals-powershell-cmdlets-execution-proccesscreation.yml  []  AADInternals PowerShell Cmdlets Execution - ProccessCreation
  aadinternals-powershell-cmdlets-execution-psscript.yml  []  AADInternals PowerShell Cmdlets Execution - PsScript
  T1087.002_ad-privileged-users-or-groups-reconnaissance.yml  [T1087.002]  AD Privileged Users or Groups Reconnaissance
  adcs-certificate-template-configuration-vulnerability-with-r.yml  []  ADCS Certificate Template Configuration Vulnerability with Risky EKU
  T1190_adselfservice-exploitation.yml  [T1190]  ADSelfService Exploitation
  T1685_amsi-bypass-pattern-assembly-gettype.yml  [T1685]  AMSI Bypass Pattern Assembly GetType
  T1685_amsi-disabled-via-registry-modification.yml  [T1685]  AMSI Disabled via Registry Modification
  T1055_apt-privatelog-image-load-pattern.yml  [T1055]  APT PRIVATELOG Image Load Pattern
  T1071.001_apt-user-agent.yml  [T1071.001]  APT User Agent
  T1071.001_apt40-dropbox-tool-user-agent.yml  [T1071.001,T1567.002]  APT40 Dropbox Tool User Agent
  T1055.009_aslr-disabled-via-sysctl-or-direct-syscall-linux.yml  [T1055.009,T1685]  ASLR Disabled Via Sysctl or Direct Syscall - Linux
  T1685.002_aws-config-disabling-channel-recorder.yml  [T1685.002]  AWS Config Disabling Channel/Recorder
  T1059.001_aws-ec2-startup-shell-script-change.yml  [T1059.001,T1059.003,T1059.004]  AWS EC2 Startup Shell Script Change
  T1685_aws-guardduty-detector-deleted-or-updated.yml  [T1685,T1685.002]  AWS GuardDuty Detector Deleted Or Updated
  T1685_aws-guardduty-important-change.yml  [T1685]  AWS GuardDuty Important Change
  T1059.009_aws-iam-s3browser-loginprofile-creation.yml  [T1059.009,T1078.004]  AWS IAM S3Browser LoginProfile Creation
  T1059.009_aws-iam-s3browser-templated-s3-bucket-policy-creation.yml  [T1059.009,T1078.004]  AWS IAM S3Browser Templated S3 Bucket Policy Creation
  T1059.009_aws-iam-s3browser-user-or-accesskey-creation.yml  [T1059.009,T1078.004]  AWS IAM S3Browser User or AccessKey Creation
  T1556_aws-identity-center-identity-provider-change.yml  [T1556]  AWS Identity Center Identity Provider Change
  T1486_aws-kms-imported-key-material-usage.yml  [T1486,T1608.003]  AWS KMS Imported Key Material Usage
  T1685_aws-securityhub-findings-evasion.yml  [T1685]  AWS SecurityHub Findings Evasion
  T1098_aws-user-login-profile-was-modified.yml  [T1098]  AWS User Login Profile Was Modified
  aws-vpc-flow-logs-deleted.yml  []  AWS VPC Flow Logs Deleted
  T1059_abusable-dll-potential-sideloading-from-suspicious-location.yml  [T1059]  Abusable DLL Potential Sideloading From Suspicious Location
  T1574.011_abuse-of-service-permissions-to-hide-services-via-set-servic.yml  [T1574.011]  Abuse of Service Permissions to Hide Services Via Set-Service
  T1574.011_abuse-of-service-permissions-to-hide-services-via-set-servic_2.yml  [T1574.011]  Abuse of Service Permissions to Hide Services Via Set-Service - PS
  T1548_abused-debug-privilege-by-arbitrary-parent-processes.yml  [T1548]  Abused Debug Privilege by Arbitrary Parent Processes
  T1078_account-created-and-deleted-within-a-close-time-frame.yml  [T1078]  Account Created And Deleted Within A Close Time Frame
  T1098_active-directory-user-backdoors.yml  [T1098]  Active Directory User Backdoors
  T1078_activity-from-anonymous-ip-address.yml  [T1078]  Activity From Anonymous IP Address
  add-debugger-entry-to-hangs-key-for-persistence.yml  []  Add Debugger Entry To Hangs Key For Persistence
  T1059_add-insecure-download-source-to-winget.yml  [T1059]  Add Insecure Download Source To Winget
  T1685_add-safeboot-keys-via-reg-utility.yml  [T1685]  Add SafeBoot Keys Via Reg Utility
  T1098.001_added-credentials-to-existing-application.yml  [T1098.001]  Added Credentials to Existing Application
  T1059.005_adwind-rat-jrat.yml  [T1059.005,T1059.007]  Adwind RAT / JRAT
  T1059.005_adwind-rat-jrat-file-artifact.yml  [T1059.005,T1059.007]  Adwind RAT / JRAT File Artifact
  T1490_all-backups-deleted-via-wbadmin-exe.yml  [T1490]  All Backups Deleted Via Wbadmin.EXE
  T1686.003_all-rules-have-been-deleted-from-the-windows-firewall-config.yml  [T1686.003]  All Rules Have Been Deleted From The Windows Firewall Configuration
  T1543.003_allow-service-access-using-security-descriptor-tampering-via.yml  [T1543.003]  Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
  T1528_anomalous-token.yml  [T1528]  Anomalous Token
  T1098_anomalous-user-activity.yml  [T1098]  Anomalous User Activity
  T1528_anonymous-ip-address.yml  [T1528]  Anonymous IP Address
  T1685_antivirus-filter-driver-disallowed-on-dev-drive-registry.yml  [T1685]  Antivirus Filter Driver Disallowed On Dev Drive - Registry
  T1204_antivirus-hacktool-detection.yml  [T1204]  Antivirus Hacktool Detection
  T1588_antivirus-relevant-file-paths-alerts.yml  [T1588]  Antivirus Relevant File Paths Alerts
  T1505.003_antivirus-web-shell-detection.yml  [T1505.003]  Antivirus Web Shell Detection
  T1499.004_apache-segmentation-fault.yml  [T1499.004]  Apache Segmentation Fault
  T1190_apache-spark-shell-command-injection-processcreation.yml  [T1190]  Apache Spark Shell Command Injection - ProcessCreation
  T1190_apache-spark-shell-command-injection-weblogs.yml  [T1190]  Apache Spark Shell Command Injection - Weblogs
  T1528_app-granted-microsoft-permissions.yml  [T1528]  App Granted Microsoft Permissions
  T1098.003_app-granted-privileged-delegated-or-app-permissions.yml  [T1098.003]  App Granted Privileged Delegated Or App Permissions
  appx-located-in-known-staging-directory-added-to-deployment.yml  []  AppX Located in Known Staging Directory Added to Deployment Pipeline
  T1078.004_application-appid-uri-configuration-changes.yml  [T1078.004,T1552]  Application AppID Uri Configuration Changes
  T1078.004_application-uri-configuration-changes.yml  [T1078.004,T1528]  Application URI Configuration Changes
  T1218_arbitrary-file-download-via-imewdbld-exe.yml  [T1218]  Arbitrary File Download Via IMEWDBLD.EXE
  T1574.001_aruba-network-service-potential-dll-sideloading.yml  [T1574.001]  Aruba Network Service Potential DLL Sideloading
  T1219.002_atera-agent-installation.yml  [T1219.002]  Atera Agent Installation
  T1190_atlassian-bitbucket-command-injection-via-archive-api.yml  [T1190]  Atlassian Bitbucket Command Injection Via Archive API
  T1059_atlassian-confluence-cve-2022-26134.yml  [T1059,T1190]  Atlassian Confluence CVE-2022-26134
  T1059.002_atomic-macos-stealer-filegrabber-activity.yml  [T1059.002]  Atomic MacOS Stealer - FileGrabber Activity
  T1543.004_atomic-macos-stealer-persistence-indicators.yml  [T1543.004,T1564.001]  Atomic MacOS Stealer - Persistence Indicators
  T1187_attempts-of-kerberos-coercion-via-dns-spn-spoofing.yml  [T1187,T1557.001]  Attempts of Kerberos Coercion Via DNS SPN Spoofing
  T1078_atypical-travel.yml  [T1078]  Atypical Travel
  T1685.001_audit-policy-tampering-via-auditpol.yml  [T1685.001]  Audit Policy Tampering Via Auditpol
  T1685.001_audit-policy-tampering-via-nt-resource-kit-auditpol.yml  [T1685.001]  Audit Policy Tampering Via NT Resource Kit Auditpol
  T1685.004_audit-rules-deleted-via-auditctl.yml  [T1685.004]  Audit Rules Deleted Via Auditctl
  T1685_auditing-configuration-changes-on-linux-host.yml  [T1685]  Auditing Configuration Changes on Linux Host
  T1105_axios-npm-compromise-file-creation-indicators-linux.yml  [T1105,T1195.002]  Axios NPM Compromise File Creation Indicators - Linux
  T1105_axios-npm-compromise-file-creation-indicators-macos.yml  [T1105,T1195.002]  Axios NPM Compromise File Creation Indicators - MacOS
  T1195.002_axios-npm-compromise-file-creation-indicators-windows.yml  [T1195.002]  Axios NPM Compromise File Creation Indicators - Windows
  T1059.004_axios-npm-compromise-indicators-linux.yml  [T1059.004,T1059.006,T1105,T1195.002]  Axios NPM Compromise Indicators - Linux
  T1059.003_axios-npm-compromise-indicators-windows.yml  [T1059.003,T1059.005,T1105,T1195.002]  Axios NPM Compromise Indicators - Windows
  T1059.002_axios-npm-compromise-indicators-macos.yml  [T1059.002,T1059.004,T1105,T1195.002]  Axios NPM Compromise Indicators - macOS
  T1071.001_axios-npm-compromise-malicious-c2-domain-dns-query.yml  [T1071.001,T1568]  Axios NPM Compromise Malicious C2 Domain DNS Query
  T1589_azure-ad-account-credential-leaked.yml  [T1589]  Azure AD Account Credential Leaked
  T1078_azure-ad-threat-intelligence.yml  [T1078]  Azure AD Threat Intelligence
  T1078_azure-login-bypassing-conditional-access-policies.yml  [T1078]  Azure Login Bypassing Conditional Access Policies
  T1078.004_azure-subscription-permission-elevation-via-activitylogs.yml  [T1078.004]  Azure Subscription Permission Elevation Via ActivityLogs
  T1078_azure-subscription-permission-elevation-via-auditlogs.yml  [T1078]  Azure Subscription Permission Elevation Via AuditLogs
  T1197_bits-transfer-job-download-from-direct-ip.yml  [T1197]  BITS Transfer Job Download From Direct IP
  T1197_bits-transfer-job-download-from-file-sharing-domains.yml  [T1197]  BITS Transfer Job Download From File Sharing Domains
  T1197_bits-transfer-job-download-to-potential-suspicious-folder.yml  [T1197]  BITS Transfer Job Download To Potential Suspicious Folder
  T1059_bpfdoor-abnormal-process-id-or-lock-file-accessed.yml  [T1059,T1106]  BPFDoor Abnormal Process ID or Lock File Accessed
  T1021.003_baaupdate-exe-suspicious-dll-load.yml  [T1021.003,T1218]  BaaUpdate.exe Suspicious DLL Load
  T1218.011_bad-opsec-defaults-sacrificial-processes-with-improper-argum.yml  [T1218.011]  Bad Opsec Defaults Sacrificial Processes With Improper Arguments
  T1027_base64-encoded-powershell-command-detected.yml  [T1027,T1059.001,T1140]  Base64 Encoded PowerShell Command Detected
  base64-mz-header-in-commandline.yml  []  Base64 MZ Header In CommandLine
  T1027.001_binary-padding-linux.yml  [T1027.001]  Binary Padding - Linux
  T1027.001_binary-padding-macos.yml  [T1027.001]  Binary Padding - MacOS
  T1213.003_bitbucket-full-data-export-triggered.yml  [T1213.003]  Bitbucket Full Data Export Triggered
  T1685_bitbucket-secret-scanning-exempt-repository-added.yml  [T1685]  Bitbucket Secret Scanning Exempt Repository Added
  T1071.001_bitsadmin-to-uncommon-ip-server-address.yml  [T1071.001,T1197]  Bitsadmin to Uncommon IP Server Address
  T1071.001_bitsadmin-to-uncommon-tld.yml  [T1071.001,T1197]  Bitsadmin to Uncommon TLD
  T1112_blackbyte-ransomware-registry.yml  [T1112]  Blackbyte Ransomware Registry
  T1059.001_bloodhound-collection-files.yml  [T1059.001,T1069.001,T1069.002,T1087.001,T1087.002,T1482]  BloodHound Collection Files
  T1047_blue-mockingbird.yml  [T1047,T1112]  Blue Mockingbird
  T1047_blue-mockingbird-registry.yml  [T1047,T1112]  Blue Mockingbird - Registry
  T1486_bluesky-ransomware-artefacts.yml  [T1486]  BlueSky Ransomware Artefacts
  T1490_boot-configuration-tampering-via-bcdedit-exe.yml  [T1490]  Boot Configuration Tampering Via Bcdedit.EXE
  T1068_buffer-overflow-attempts.yml  [T1068]  Buffer Overflow Attempts
  T1098_bulk-deletion-changes-to-privileged-account-permissions.yml  [T1098]  Bulk Deletion Changes To Privileged Account Permissions
  T1548.002_bypass-uac-using-delegateexecute.yml  [T1548.002]  Bypass UAC Using DelegateExecute
  T1547.010_bypass-uac-using-event-viewer.yml  [T1547.010]  Bypass UAC Using Event Viewer
  T1548.002_bypass-uac-using-silentcleanup-task.yml  [T1548.002]  Bypass UAC Using SilentCleanup Task
  T1218.003_bypass-uac-via-cmstp.yml  [T1218.003,T1548.002]  Bypass UAC via CMSTP
  T1548.002_bypass-uac-via-fodhelper-exe.yml  [T1548.002]  Bypass UAC via Fodhelper.exe
  T1548.002_bypass-uac-via-wsreset-exe.yml  [T1548.002]  Bypass UAC via WSReset.exe
  T1218.003_cmstp-execution-process-access.yml  [T1218.003,T1559.001]  CMSTP Execution Process Access
  T1218.003_cmstp-execution-process-creation.yml  [T1218.003]  CMSTP Execution Process Creation
  T1218.003_cmstp-execution-registry-event.yml  [T1218.003]  CMSTP Execution Registry Event
  T1218.003_cmstp-uac-bypass-via-com-object-access.yml  [T1218.003,T1548.002]  CMSTP UAC Bypass via COM Object Access
  coldsteel-persistence-service-creation.yml  []  COLDSTEEL Persistence Service Creation
  coldsteel-rat-anonymous-user-process-execution.yml  []  COLDSTEEL RAT Anonymous User Process Execution
  T1546_com-hijack-via-sdclt.yml  [T1546,T1548]  COM Hijack via Sdclt
  T1546.015_com-object-hijacking-via-modification-of-default-system-clsi.yml  [T1546.015]  COM Object Hijacking Via Modification Of Default System CLSID Default Value
  T1190_cve-2020-0688-exploitation-attempt.yml  [T1190]  CVE-2020-0688 Exploitation Attempt
  T1190_cve-2020-0688-exploitation-via-eventlog.yml  [T1190]  CVE-2020-0688 Exploitation via Eventlog
  T1112_cve-2020-1048-exploitation-attempt-suspicious-new-printer-po.yml  [T1112]  CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
  T1190_cve-2021-21972-vsphere-exploitation.yml  [T1190]  CVE-2021-21972 VSphere Exploitation
  T1190_cve-2021-21978-exploitation-attempt.yml  [T1190]  CVE-2021-21978 Exploitation Attempt
  T1203_cve-2021-26858-exchange-exploitation.yml  [T1203]  CVE-2021-26858 Exchange Exploitation
  T1190_cve-2021-41773-exploitation-attempt.yml  [T1190]  CVE-2021-41773 Exploitation Attempt
  cve-2021-44077-poc-default-dropped-file.yml  []  CVE-2021-44077 POC Default Dropped File
  T1059.001_cve-2022-24527-microsoft-connected-cache-lpe.yml  [T1059.001]  CVE-2022-24527 Microsoft Connected Cache LPE
  T1190_cve-2022-31656-vmware-workspace-one-access-auth-bypass.yml  [T1190]  CVE-2022-31656 VMware Workspace ONE Access Auth Bypass
  T1059_cve-2023-22518-exploitation-attempt-suspicious-confluence-ch.yml  [T1059,T1190]  CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)
  cve-2023-38331-exploitation-attempt-suspicious-double-extens.yml  []  CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File
  T1203_cve-2023-38331-exploitation-attempt-suspicious-winrar-child.yml  [T1203]  CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
  T1190_cve-2023-46747-exploitation-activity-proxy.yml  [T1190]  CVE-2023-46747 Exploitation Activity - Proxy
  T1190_cve-2023-46747-exploitation-activity-webserver.yml  [T1190]  CVE-2023-46747 Exploitation Activity - Webserver
  T1190_cve-2023-4966-exploitation-attempt-citrix-adc-sensitive-info.yml  [T1190]  CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy
  T1190_cve-2023-4966-exploitation-attempt-citrix-adc-sensitive-info_2.yml  [T1190]  CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
  cve-2024-1212-exploitation-progress-kemp-loadmaster-unauthen.yml  []  CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection
  T1499_cve-2024-49113-exploitation-attempt-ldap-nightmare.yml  [T1499]  CVE-2024-49113 Exploitation Attempt - LDAP Nightmare
  T1190_cve-2024-50623-exploitation-attempt-cleo.yml  [T1190]  CVE-2024-50623 Exploitation Attempt - Cleo
  cab-file-extraction-via-wusa-exe-from-potentially-suspicious.yml  []  Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths
  T1059_capsh-shell-invocation-linux.yml  [T1059]  Capsh Shell Invocation - Linux
  T1071.001_chafer-malware-url-pattern.yml  [T1071.001]  Chafer Malware URL Pattern
  T1546.001_change-default-file-association-to-executable-via-assoc.yml  [T1546.001]  Change Default File Association To Executable Via Assoc
  T1112_change-user-account-associated-with-the-fax-service.yml  [T1112]  Change User Account Associated with the FAX Service
  T1685.001_change-winevt-channel-access-permission-via-registry.yml  [T1685.001]  Change Winevt Channel Access Permission Via Registry
  T1112_change-the-fax-dll.yml  [T1112]  Change the Fax Dll
  T1078.004_changes-to-pim-settings.yml  [T1078.004]  Changes To PIM Settings
  T1484_changes-to-device-registration-policy.yml  [T1484]  Changes to Device Registration Policy
  T1018_chopper-webshell-process-pattern.yml  [T1018,T1033,T1087,T1505.003]  Chopper Webshell Process Pattern
  T1053.005_chromeloader-malware-execution.yml  [T1053.005,T1059.001,T1176]  ChromeLoader Malware Execution
  chromium-browser-headless-execution-to-mockbin-like-site.yml  []  Chromium Browser Headless Execution To Mockbin Like Site
  T1190_cisco-asa-exploitation-activity-proxy.yml  [T1190]  Cisco ASA Exploitation Activity - Proxy
  T1190_cisco-asa-ftd-exploit-cve-2020-3452.yml  [T1190]  Cisco ASA FTD Exploit CVE-2020-3452
  T1070.003_cisco-clear-logs.yml  [T1070.003]  Cisco Clear Logs
  T1552.004_cisco-crypto-commands.yml  [T1552.004,T1553.004]  Cisco Crypto Commands
  T1685_cisco-disabling-logging.yml  [T1685]  Cisco Disabling Logging
  T1098_cisco-local-accounts.yml  [T1098,T1136.001]  Cisco Local Accounts
  T1070_clearing-windows-console-history.yml  [T1070,T1070.003]  Clearing Windows Console History
  T1059.001_cmd-exe-missing-space-characters-execution-anomaly.yml  [T1059.001]  Cmd.EXE Missing Space Characters Execution Anomaly
  T1218.011_cobaltstrike-load-by-rundll32.yml  [T1218.011]  CobaltStrike Load by Rundll32
  T1055_cobaltstrike-named-pipe-patterns.yml  [T1055]  CobaltStrike Named Pipe Patterns
  T1021.002_cobaltstrike-service-installations-security.yml  [T1021.002,T1543.003,T1569.002]  CobaltStrike Service Installations - Security
  T1137.006_code-executed-via-office-add-in-xll-file.yml  [T1137.006]  Code Executed Via Office Add-in XLL File
  T1574.006_code-injection-by-ld-so-preload.yml  [T1574.006]  Code Injection by ld.so Preload
  T1543_codeintegrity-blocked-driver-load-with-revoked-certificate.yml  [T1543]  CodeIntegrity - Blocked Driver Load With Revoked Certificate
  codeintegrity-blocked-image-load-with-revoked-certificate.yml  []  CodeIntegrity - Blocked Image Load With Revoked Certificate
  T1543_codeintegrity-blocked-image-driver-load-for-policy-violation.yml  [T1543]  CodeIntegrity - Blocked Image/Driver Load For Policy Violation
  codeintegrity-disallowed-file-for-protected-processes-has-be.yml  []  CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked
  codeintegrity-revoked-image-loaded.yml  []  CodeIntegrity - Revoked Image Loaded
  codeintegrity-revoked-kernel-driver-loaded.yml  []  CodeIntegrity - Revoked Kernel Driver Loaded
  codeintegrity-unmet-whql-requirements-for-loaded-kernel-modu.yml  []  CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module
  codeintegrity-unsigned-image-loaded.yml  []  CodeIntegrity - Unsigned Image Loaded
  codeintegrity-unsigned-kernel-module-loaded.yml  []  CodeIntegrity - Unsigned Kernel Module Loaded
  T1071.001_comrat-network-communication.yml  [T1071.001]  ComRAT Network Communication
  T1565.001_commands-to-clear-or-remove-the-syslog-builtin.yml  [T1565.001]  Commands to Clear or Remove the Syslog - Builtin
  T1090_communication-to-localtonet-tunneling-service-initiated.yml  [T1090,T1102,T1572]  Communication To LocaltoNet Tunneling Service Initiated
  T1090_communication-to-localtonet-tunneling-service-initiated-linu.yml  [T1090,T1102,T1572]  Communication To LocaltoNet Tunneling Service Initiated - Linux
  T1090_communication-to-ngrok-tunneling-service-linux.yml  [T1090,T1102,T1567,T1568.002,T1572]  Communication To Ngrok Tunneling Service - Linux
  T1090_communication-to-ngrok-tunneling-service-initiated.yml  [T1090,T1102,T1567,T1568.002,T1572]  Communication To Ngrok Tunneling Service Initiated
  T1190_commvault-qlogin-argument-injection-authentication-bypass-cv.yml  [T1190]  Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)
  T1505.003_commvault-qoperation-path-traversal-webshell-drop-cve-2025-5.yml  [T1505.003]  Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)
  T1059.003_conhost-exe-commandline-path-traversal.yml  [T1059.003]  Conhost.exe CommandLine Path Traversal
  T1560_conti-ntds-exfiltration-command.yml  [T1560]  Conti NTDS Exfiltration Command
  T1587.001_conti-volume-shadow-listing.yml  [T1587.001]  Conti Volume Shadow Listing
  T1218.002_control-panel-items.yml  [T1218.002,T1546]  Control Panel Items
  copy-dmp-dump-files-from-remote-share-via-cmd-exe.yml  []  Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
  T1490_copy-from-volumeshadowcopy-via-cmd-exe.yml  [T1490]  Copy From VolumeShadowCopy Via Cmd.EXE
  T1552.001_copy-passwd-or-shadow-from-tmp-path.yml  [T1552.001]  Copy Passwd Or Shadow From TMP Path
  T1003.002_copying-sensitive-files-with-credential-data.yml  [T1003.002,T1003.003]  Copying Sensitive Files with Credential Data
  T1003.003_create-volume-shadow-copy-with-powershell.yml  [T1003.003]  Create Volume Shadow Copy with Powershell
  T1003.001_createdump-process-dump.yml  [T1003.001,T1036]  CreateDump Process Dump
  T1547.009_creation-exe-for-service-with-unquoted-path.yml  [T1547.009]  Creation Exe for Service with Unquoted Path
  T1136.001_creation-of-a-local-hidden-user-account-by-registry.yml  [T1136.001]  Creation of a Local Hidden User Account by Registry
  T1003.001_cred-dump-tools-dropped-files.yml  [T1003.001,T1003.002,T1003.003,T1003.004,T1003.005]  Cred Dump Tools Dropped Files
  T1003.001_credential-dumping-activity-by-python-based-tool.yml  [T1003.001]  Credential Dumping Activity By Python Based Tool
  T1548_credential-dumping-attempt-via-svchost.yml  [T1548]  Credential Dumping Attempt Via Svchost
  T1003.001_credential-dumping-attempt-via-werfault.yml  [T1003.001]  Credential Dumping Attempt Via WerFault
  T1003.001_credential-dumping-tools-service-execution-security.yml  [T1003.001,T1003.002,T1003.004,T1003.005,T1003.006,T1569.002]  Credential Dumping Tools Service Execution - Security
  T1003.001_credential-dumping-tools-service-execution-system.yml  [T1003.001,T1003.002,T1003.004,T1003.005,T1003.006,T1569.002]  Credential Dumping Tools Service Execution - System
  T1552.001_credentials-in-files.yml  [T1552.001]  Credentials In Files
  T1552.001_credentials-in-files-linux.yml  [T1552.001]  Credentials In Files - Linux
  T1003.002_critical-hive-in-suspicious-location-access-bits-cleared.yml  [T1003.002]  Critical Hive In Suspicious Location Access Bits Cleared
  T1189_cross-site-scripting-strings.yml  [T1189]  Cross Site Scripting Strings
  T1071.001_crypto-miner-user-agent.yml  [T1071.001]  Crypto Miner User Agent
  T1027.004_csc-exe-execution-form-potentially-suspicious-parent.yml  [T1027.004,T1059.005,T1059.007,T1218.005]  Csc.EXE Execution Form Potentially Suspicious Parent
  T1059.005_cscript-wscript-uncommon-script-extension-execution.yml  [T1059.005,T1059.007]  Cscript/Wscript Uncommon Script Extension Execution
  T1105_curl-download-and-execute-combination.yml  [T1105,T1218]  Curl Download And Execute Combination
  T1202_custom-file-open-handler-executes-powershell.yml  [T1202]  Custom File Open Handler Executes PowerShell
  T1021.002_dcom-internetexplorer-application-iertutil-dll-hijack-securi.yml  [T1021.002,T1021.003]  DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
  T1505.003_dewmode-webshell-access.yml  [T1505.003]  DEWMODE Webshell Access
  T1112_dhcp-callout-dll-installation.yml  [T1112,T1574.001]  DHCP Callout DLL Installation
  T1574.001_dhcp-server-error-failed-loading-the-callout-dll.yml  [T1574.001]  DHCP Server Error Failed Loading the CallOut DLL
  T1574.001_dhcp-server-loaded-the-callout-dll.yml  [T1574.001]  DHCP Server Loaded the CallOut DLL
  T1547.008_dll-load-via-lsass.yml  [T1547.008]  DLL Load via LSASS
  T1218.003_dll-loaded-from-suspicious-location-via-cmspt-exe.yml  [T1218.003]  DLL Loaded From Suspicious Location Via Cmspt.EXE
  T1574.001_dll-search-order-hijackig-via-additional-space-in-path.yml  [T1574.001]  DLL Search Order Hijackig Via Additional Space in Path
  T1574.001_dll-sideloading-of-shellchromeapi-dll.yml  [T1574.001]  DLL Sideloading Of ShellChromeAPI.DLL
  T1574.001_dll-sideloading-by-vmware-xfer-utility.yml  [T1574.001]  DLL Sideloading by VMware Xfer Utility
  T1048.001_dns-exfiltration-and-tunneling-tools-execution.yml  [T1048.001,T1071.004,T1132.001]  DNS Exfiltration and Tunneling Tools Execution
  T1554_dns-hybridconnectionmanager-service-bus.yml  [T1554]  DNS HybridConnectionManager Service Bus
  T1071.004_dns-query-to-katz-stealer-domains.yml  [T1071.004]  DNS Query To Katz Stealer Domains
  T1071.004_dns-query-to-katz-stealer-domains-network.yml  [T1071.004]  DNS Query To Katz Stealer Domains - Network
  T1090.003_dns-query-tor-onion-address-sysmon.yml  [T1090.003]  DNS Query Tor .Onion Address - Sysmon
  T1059.003_dns-query-by-finger-utility.yml  [T1059.003,T1071.004]  DNS Query by Finger Utility
  T1567.002_dns-query-for-anonfiles-com-domain-dns-client.yml  [T1567.002]  DNS Query for Anonfiles.com Domain - DNS Client
  T1567.002_dns-query-for-anonfiles-com-domain-sysmon.yml  [T1567.002]  DNS Query for Anonfiles.com Domain - Sysmon
  T1190_dns-query-to-external-service-interaction-domains.yml  [T1190,T1595.002]  DNS Query to External Service Interaction Domains
  T1574.001_dns-server-error-failed-loading-the-serverlevelplugindll.yml  [T1574.001]  DNS Server Error Failed Loading the ServerLevelPluginDLL
  T1071.004_dns-txt-answer-with-possible-execution-strings.yml  [T1071.004]  DNS TXT Answer with Possible Execution Strings
  T1552.004_dpapi-backup-keys-and-certificate-export-activity-ioc.yml  [T1552.004,T1555]  DPAPI Backup Keys And Certificate Export Activity IOC
  T1003.004_dpapi-domain-backup-key-extraction.yml  [T1003.004]  DPAPI Domain Backup Key Extraction
  dprk-threat-actor-c2-communication-dns-indicators.yml  []  DPRK Threat Actor - C2 Communication DNS Indicators
  T1059.001_dsinternals-suspicious-powershell-cmdlets.yml  [T1059.001]  DSInternals Suspicious PowerShell Cmdlets
  T1059.001_dsinternals-suspicious-powershell-cmdlets-scriptblock.yml  [T1059.001]  DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
  T1059_darkgate-autoit3-exe-execution-parameters.yml  [T1059]  DarkGate - Autoit3.EXE Execution Parameters
  T1136.001_darkgate-user-created-via-net-exe.yml  [T1136.001]  DarkGate - User Created Via Net.EXE
  default-cobalt-strike-certificate.yml  []  Default Cobalt Strike Certificate
  T1547.010_default-rdp-port-changed-to-non-standard-port.yml  [T1547.010]  Default RDP Port Changed to Non Standard Port
  T1528_delegated-permissions-granted-for-all-users.yml  [T1528]  Delegated Permissions Granted For All Users
  T1489_delete-all-scheduled-tasks.yml  [T1489]  Delete All Scheduled Tasks
  T1489_delete-important-scheduled-task.yml  [T1489]  Delete Important Scheduled Task
  T1490_delete-volume-shadow-copies-via-wmi-with-powershell.yml  [T1490]  Delete Volume Shadow Copies Via WMI With PowerShell
  T1490_deletion-of-volume-shadow-copies-via-wmi-with-powershell.yml  [T1490]  Deletion of Volume Shadow Copies via WMI with PowerShell
  T1490_deletion-of-volume-shadow-copies-via-wmi-with-powershell-ps.yml  [T1490]  Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
  T1543.003_deny-service-access-using-security-descriptor-tampering-via.yml  [T1543.003]  Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
  T1543.003_devcon-execution-disabling-vmware-vmci-device.yml  [T1543.003,T1685]  Devcon Execution Disabling VMware VMCI Device
  devil-bait-potential-c2-communication-traffic.yml  []  Devil Bait Potential C2 Communication Traffic
  T1218_devtoolslauncher-exe-executes-specified-binary.yml  [T1218]  Devtoolslauncher.exe Executes Specified Binary
  T1203_dfsvc-exe-initiated-network-connection-over-uncommon-port.yml  [T1203]  Dfsvc.EXE Initiated Network Connection Over Uncommon Port
  T1202_diagnostic-library-sdiageng-dll-loaded-by-msdt-exe.yml  [T1202]  Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
  T1574.001_diamond-sleet-apt-dll-sideloading-indicators.yml  [T1574.001]  Diamond Sleet APT DLL Sideloading Indicators
  diamond-sleet-apt-dns-communication-indicators.yml  []  Diamond Sleet APT DNS Communication Indicators
  diamond-sleet-apt-file-creation-indicators.yml  []  Diamond Sleet APT File Creation Indicators
  diamond-sleet-apt-process-activity-indicators.yml  []  Diamond Sleet APT Process Activity Indicators
  T1685_diamond-sleet-apt-scheduled-task-creation-registry.yml  [T1685]  Diamond Sleet APT Scheduled Task Creation - Registry
  T1556_directory-service-restore-mode-dsrm-registry-value-tampering.yml  [T1556]  Directory Service Restore Mode(DSRM) Registry Value Tampering
  T1489_disable-important-scheduled-task.yml  [T1489]  Disable Important Scheduled Task
  disable-macro-runtime-scan-scope.yml  []  Disable Macro Runtime Scan Scope
  T1685_disable-pua-protection-on-windows-defender.yml  [T1685]  Disable PUA Protection on Windows Defender
  T1070.003_disable-powershell-command-history.yml  [T1070.003]  Disable Powershell Command History
  T1112_disable-security-events-logging-adding-reg-key-minint.yml  [T1112,T1685.001]  Disable Security Events Logging Adding Reg Key MiniNt
  T1686_disable-system-firewall.yml  [T1686]  Disable System Firewall
  T1685_disable-windows-defender-av-security-monitoring.yml  [T1685]  Disable Windows Defender AV Security Monitoring
  T1685_disable-windows-defender-functionalities-via-registry-keys.yml  [T1685]  Disable Windows Defender Functionalities Via Registry Keys
  T1685.001_disable-windows-event-logging-via-registry.yml  [T1685.001]  Disable Windows Event Logging Via Registry
  T1685.001_disable-windows-iis-http-logging.yml  [T1685.001]  Disable Windows IIS HTTP Logging
  T1070_disable-of-etw-trace-powershell.yml  [T1070,T1685]  Disable of ETW Trace - Powershell
  T1685_disable-windowsoptionalfeature-command-powershell.yml  [T1685]  Disable-WindowsOptionalFeature Command PowerShell
  T1685_disabled-ie-security-features.yml  [T1685]  Disabled IE Security Features
  T1685_disabled-volume-snapshots.yml  [T1685]  Disabled Volume Snapshots
  T1685_disabled-windows-defender-eventlog.yml  [T1685]  Disabled Windows Defender Eventlog
  T1556.006_disabling-multi-factor-authentication.yml  [T1556.006]  Disabling Multi Factor Authentication
  T1685_disabling-windows-defender-wmi-autologger-session-via-reg-ex.yml  [T1685]  Disabling Windows Defender WMI Autologger Session via Reg.exe
  T1087.004_discovery-using-azurehound.yml  [T1087.004,T1526]  Discovery Using AzureHound
  T1055_dllhost-exe-execution-anomaly.yml  [T1055]  Dllhost.EXE Execution Anomaly
  T1055_dotnet-clr-dll-loaded-by-scripting-applications.yml  [T1055]  DotNet CLR DLL Loaded By Scripting Applications
  driver-added-to-disallowed-images-in-hvci-registry.yml  []  Driver Added To Disallowed Images In HVCI - Registry
  T1543.003_driver-load-from-a-temporary-directory.yml  [T1543.003]  Driver Load From A Temporary Directory
  T1003.002_dumping-of-sensitive-hives-via-reg-exe.yml  [T1003.002,T1003.004,T1003.005]  Dumping of Sensitive Hives Via Reg.EXE
  T1059.012_esxi-admin-permission-assigned-to-account-via-esxcli.yml  [T1059.012,T1098]  ESXi Admin Permission Assigned To Account Via ESXCLI
  T1112_etw-logging-disabled-in-net-processes-registry.yml  [T1112,T1685]  ETW Logging Disabled In .NET Processes - Registry
  T1112_etw-logging-disabled-in-net-processes-sysmon-registry.yml  [T1112,T1685]  ETW Logging Disabled In .NET Processes - Sysmon Registry
  T1685_etw-logging-tamper-in-net-processes-via-commandline.yml  [T1685]  ETW Logging Tamper In .NET Processes Via CommandLine
  T1070_etw-trace-evasion-activity.yml  [T1070,T1685]  ETW Trace Evasion Activity
  email-exifiltration-via-powershell.yml  []  Email Exifiltration Via Powershell
  T1059.006_emotet-loader-execution-via-lnk-file.yml  [T1059.006]  Emotet Loader Execution Via .LNK File
  T1112_enable-lm-hash-storage.yml  [T1112]  Enable LM Hash Storage
  T1112_enable-lm-hash-storage-proccreation.yml  [T1112]  Enable LM Hash Storage - ProcCreation
  T1098_enabled-user-right-in-ad-to-control-user-objects.yml  [T1098]  Enabled User Right in AD to Control User Objects
  T1041_equation-group-c2-communication.yml  [T1041]  Equation Group C2 Communication
  T1059.004_equation-group-indicators.yml  [T1059.004]  Equation Group Indicators
  T1003.002_esentutl-volume-shadow-copy-service-keys.yml  [T1003.002]  Esentutl Volume Shadow Copy Service Keys
  T1190_exchange-exploitation-used-by-hafnium.yml  [T1190]  Exchange Exploitation Used by HAFNIUM
  T1070_exchange-powershell-cmdlet-history-deleted.yml  [T1070]  Exchange PowerShell Cmdlet History Deleted
  T1059.001_exchange-powershell-snap-ins-usage.yml  [T1059.001,T1114]  Exchange PowerShell Snap-Ins Usage
  T1190_exchange-proxyshell-pattern.yml  [T1190]  Exchange ProxyShell Pattern
  T1505.003_exchange-set-oabvirtualdirectory-externalurl-property.yml  [T1505.003]  Exchange Set OabVirtualDirectory ExternalUrl Property
  T1218_execute-pcwrun-exe-to-leverage-follina.yml  [T1218]  Execute Pcwrun.EXE To Leverage Follina
  T1218_execution-dll-of-choice-using-wab-exe.yml  [T1218]  Execution DLL of Choice Using WAB.EXE
  execution-of-non-existing-file.yml  []  Execution Of Non-Existing File
  T1059.001_execution-of-powershell-script-in-public-folder.yml  [T1059.001]  Execution of Powershell Script in Public Folder
  T1218_execution-via-workfolders-exe.yml  [T1218]  Execution via WorkFolders.exe
  T1218_execution-via-stordiag-exe.yml  [T1218]  Execution via stordiag.exe
  T1071.001_exploit-framework-user-agent.yml  [T1071.001]  Exploit Framework User Agent
  T1190_exploitation-activity-of-cve-2025-59287-wsus-deserialization.yml  [T1190,T1203]  Exploitation Activity of CVE-2025-59287 - WSUS Deserialization
  T1190_exploitation-activity-of-cve-2025-59287-wsus-suspicious-chil.yml  [T1190,T1203]  Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process
  T1210_exploitation-attempt-of-cve-2020-1472-execution-of-zerologon.yml  [T1210]  Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC
  T1210_exploitation-attempt-of-cve-2023-46214-using-public-poc-code.yml  [T1210]  Exploitation Attempt Of CVE-2023-46214 Using Public POC Code
  exploitation-indicator-of-cve-2022-42475.yml  []  Exploitation Indicator Of CVE-2022-42475
  exploitation-indicators-of-cve-2023-20198.yml  []  Exploitation Indicators Of CVE-2023-20198
  T1190_exploitation-of-cve-2021-26814-in-wazuh.yml  [T1190]  Exploitation of CVE-2021-26814 in Wazuh
  T1059.001_exploited-cve-2020-10189-zoho-manageengine.yml  [T1059.001,T1059.003,T1190]  Exploited CVE-2020-10189 Zoho ManageEngine
  T1059.003_exploiting-setupcomplete-cmd-cve-2019-1378.yml  [T1059.003,T1068,T1574]  Exploiting SetupComplete.cmd CVE-2019-1378
  T1548.002_explorer-nouaccheck-flag.yml  [T1548.002]  Explorer NOUACCHECK Flag
  T1012_exports-critical-registry-keys-to-a-file.yml  [T1012]  Exports Critical Registry Keys To a File
  T1564.004_exports-registry-key-to-an-alternate-data-stream.yml  [T1564.004]  Exports Registry Key To an Alternate Data Stream
  T1078_external-remote-smb-logon-from-public-ip.yml  [T1078,T1110,T1133]  External Remote SMB Logon from Public IP
  T1505.002_failed-msexchange-transport-agent-installation.yml  [T1505.002]  Failed MSExchange Transport Agent Installation
  T1059.001_fakeupdates-socgholish-activity.yml  [T1059.001]  FakeUpdates/SocGholish Activity
  T1574.001_fax-service-dll-search-order-hijack.yml  [T1574.001]  Fax Service DLL Search Order Hijack
  T1547.001_file-creation-in-suspicious-directory-by-msdt-exe.yml  [T1547.001]  File Creation In Suspicious Directory By Msdt.EXE
  file-creation-related-to-rat-clients.yml  []  File Creation Related To RAT Clients
  T1027_file-decoded-from-base64-hex-via-certutil-exe.yml  [T1027]  File Decoded From Base64/Hex Via Certutil.EXE
  T1105_file-download-and-execution-via-ieexec-exe.yml  [T1105]  File Download And Execution Via IEExec.EXE
  T1105_file-download-from-ip-based-url-via-certoc-exe.yml  [T1105]  File Download From IP Based URL Via CertOC.EXE
  T1105_file-download-using-notepad-gup-utility.yml  [T1105]  File Download Using Notepad++ GUP Utility
  T1036.003_file-download-via-bitsadmin-to-a-suspicious-target-folder.yml  [T1036.003,T1105,T1197]  File Download Via Bitsadmin To A Suspicious Target Folder
  T1105_file-download-via-windows-defender-mpcmprun-exe.yml  [T1105,T1218]  File Download Via Windows Defender MpCmpRun.EXE
  T1105_file-download-with-headless-browser.yml  [T1105,T1564.003]  File Download with Headless Browser
  file-encryption-decryption-via-gpg4win-from-suspicious-locat.yml  []  File Encryption/Decryption Via Gpg4win From Suspicious Locations
  T1135_file-explorer-folder-opened-using-explorer-folder-shortcut-v.yml  [T1135]  File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
  T1027_file-in-suspicious-location-encoded-to-base64-via-certutil-e.yml  [T1027]  File In Suspicious Location Encoded To Base64 Via Certutil.EXE
  T1036.003_file-with-suspicious-extension-downloaded-via-bitsadmin.yml  [T1036.003,T1105,T1197]  File With Suspicious Extension Downloaded Via Bitsadmin
  T1204.002_file-with-uncommon-extension-created-by-an-office-applicatio.yml  [T1204.002]  File With Uncommon Extension Created By An Office Application
  T1204.004_filefix-command-evidence-in-typedpaths.yml  [T1204.004]  FileFix - Command Evidence in TypedPaths
  T1552.006_findstr-gpp-passwords.yml  [T1552.006]  Findstr GPP Passwords
  T1105_finger-exe-execution.yml  [T1105]  Finger.EXE Execution
  T1218.011_fireball-archer-install.yml  [T1218.011]  Fireball Archer Install
  T1021.002_first-time-seen-remote-named-pipe.yml  [T1021.002]  First Time Seen Remote Named Pipe
  T1021.002_first-time-seen-remote-named-pipe-zeek.yml  [T1021.002]  First Time Seen Remote Named Pipe - Zeek
  T1036.005_flash-player-update-from-suspicious-location.yml  [T1036.005,T1189,T1204.002]  Flash Player Update from Suspicious Location
  T1685_folder-removed-from-exploit-guard-protectedfolders-list-regi.yml  [T1685]  Folder Removed From Exploit Guard ProtectedFolders List - Registry
  T1547.001_forest-blizzard-apt-custom-protocol-handler-creation.yml  [T1547.001]  Forest Blizzard APT - Custom Protocol Handler Creation
  T1547.001_forest-blizzard-apt-custom-protocol-handler-dll-registry-set.yml  [T1547.001]  Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
  T1685.001_forest-blizzard-apt-file-creation-activity.yml  [T1685.001]  Forest Blizzard APT - File Creation Activity
  forest-blizzard-apt-process-creation-activity.yml  []  Forest Blizzard APT - Process Creation Activity
  T1036_forfiles-exe-child-process-masquerading.yml  [T1036]  Forfiles.EXE Child Process Masquerading
  T1587.001_formbook-process-creation.yml  [T1587.001]  Formbook Process Creation
  T1070_fsutil-suspicious-invocation.yml  [T1070,T1485]  Fsutil Suspicious Invocation
  T1486_funklocker-ransomware-file-creation.yml  [T1486]  FunkLocker Ransomware File Creation
  T1204.002_gac-dll-loaded-via-office-applications.yml  [T1204.002]  GAC DLL Loaded Via Office Applications
  T1071_gallium-artefacts-builtin.yml  [T1071]  GALLIUM Artefacts - Builtin
  T1071_gallium-iocs.yml  [T1071,T1212]  GALLIUM IOCs
  T1556_github-high-risk-configuration-disabled.yml  [T1556]  Github High Risk Configuration Disabled
  T1685_github-push-protection-disabled.yml  [T1685]  Github Push Protection Disabled
  T1685_github-secret-scanning-feature-disabled.yml  [T1685]  Github Secret Scanning Feature Disabled
  goofy-guineapig-backdoor-ioc.yml  []  Goofy Guineapig Backdoor IOC
  goofy-guineapig-backdoor-potential-c2-communication.yml  []  Goofy Guineapig Backdoor Potential C2 Communication
  T1046_grixba-malware-reconnaissance-activity.yml  [T1046,T1595.001]  Grixba Malware Reconnaissance Activity
  T1212_guacamole-two-users-sharing-session-anomaly.yml  [T1212]  Guacamole Two Users Sharing Session Anomaly
  T1068_hktl-sharpsuccessor-privilege-escalation-tool-execution.yml  [T1068]  HKTL - SharpSuccessor Privilege Escalation Tool Execution
  T1047_html-help-hh-exe-suspicious-child-process.yml  [T1047,T1059.001,T1059.003,T1059.005,T1059.007,T1218,T1218.001,T1218.010,T1218.011,T1566,T1566.001]  HTML Help HH.EXE Suspicious Child Process
  T1505.004_http-logging-disabled-on-iis-server.yml  [T1505.004,T1685.001]  HTTP Logging Disabled On IIS Server
  T1110_hack-tool-user-agent.yml  [T1110,T1190]  Hack Tool User Agent
  T1557.001_hacktool-adcspwn-execution.yml  [T1557.001]  HackTool - ADCSPwn Execution
  T1059.001_hacktool-bloodhound-sharphound-execution.yml  [T1059.001,T1069.001,T1069.002,T1087.001,T1087.002,T1482]  HackTool - Bloodhound/Sharphound Execution
  T1055.012_hacktool-cactustorch-remote-thread-creation.yml  [T1055.012,T1059.005,T1059.007,T1218.005]  HackTool - CACTUSTORCH Remote Thread Creation
  T1649_hacktool-certify-execution.yml  [T1649]  HackTool - Certify Execution
  T1649_hacktool-certipy-execution.yml  [T1649]  HackTool - Certipy Execution
  T1106_hacktool-cobaltstrike-bof-injection-pattern.yml  [T1106,T1685]  HackTool - CobaltStrike BOF Injection Pattern
  T1071.001_hacktool-cobaltstrike-malleable-profile-patterns-proxy.yml  [T1071.001]  HackTool - CobaltStrike Malleable Profile Patterns - Proxy
  T1055_hacktool-coercedpotato-execution.yml  [T1055]  HackTool - CoercedPotato Execution
  T1055_hacktool-coercedpotato-named-pipe-creation.yml  [T1055]  HackTool - CoercedPotato Named Pipe Creation
  T1059.001_hacktool-covenant-powershell-launcher.yml  [T1059.001,T1564.003]  HackTool - Covenant PowerShell Launcher
  T1047_hacktool-crackmapexec-execution.yml  [T1047,T1053,T1059.001,T1059.003,T1110,T1201]  HackTool - CrackMapExec Execution
  T1047_hacktool-crackmapexec-execution-patterns.yml  [T1047,T1053,T1059.001,T1059.003]  HackTool - CrackMapExec Execution Patterns
  T1003.001_hacktool-crackmapexec-file-indicators.yml  [T1003.001]  HackTool - CrackMapExec File Indicators
  T1027.005_hacktool-crackmapexec-powershell-obfuscation.yml  [T1027.005,T1059.001]  HackTool - CrackMapExec PowerShell Obfuscation
  T1003.001_hacktool-crackmapexec-process-patterns.yml  [T1003.001]  HackTool - CrackMapExec Process Patterns
  T1003.001_hacktool-createminidump-execution.yml  [T1003.001]  HackTool - CreateMiniDump Execution
  T1053.005_hacktool-default-powersploit-empire-scheduled-task-creation.yml  [T1053.005,T1059.001]  HackTool - Default PowerSploit/Empire Scheduled Task Creation
  T1003.001_hacktool-doppelanger-lsass-dumper-execution.yml  [T1003.001]  HackTool - Doppelanger LSASS Dumper Execution
  T1685_hacktool-edrsilencer-execution.yml  [T1685]  HackTool - EDRSilencer Execution
  T1685_hacktool-edrsilencer-execution-filter-added.yml  [T1685]  HackTool - EDRSilencer Execution - Filter Added
  T1055_hacktool-efspotato-named-pipe-creation.yml  [T1055]  HackTool - EfsPotato Named Pipe Creation
  T1059.001_hacktool-empire-powershell-launch-parameters.yml  [T1059.001]  HackTool - Empire PowerShell Launch Parameters
  T1071.001_hacktool-empire-useragent-uri-combo.yml  [T1071.001]  HackTool - Empire UserAgent URI Combo
  hacktool-evil-winrm-execution-powershell-module.yml  []  HackTool - Evil-WinRm Execution - PowerShell Module
  hacktool-gmer-rootkit-detector-and-remover-execution.yml  []  HackTool - GMER Rootkit Detector and Remover Execution
  T1003.001_hacktool-generic-process-access.yml  [T1003.001]  HackTool - Generic Process Access
  T1003.001_hacktool-handlekatz-duplicating-lsass-handle.yml  [T1003.001,T1106]  HackTool - HandleKatz Duplicating LSASS Handle
  T1003.001_hacktool-handlekatz-lsass-dumper-execution.yml  [T1003.001]  HackTool - HandleKatz LSASS Dumper Execution
  T1110.002_hacktool-hashcat-password-cracker-execution.yml  [T1110.002]  HackTool - Hashcat Password Cracker Execution
  T1055.012_hacktool-hollowreaper-execution.yml  [T1055.012]  HackTool - HollowReaper Execution
  T1090_hacktool-htran-natbypass-execution.yml  [T1090]  HackTool - Htran/NATBypass Execution
  T1110_hacktool-hydra-password-bruteforce-execution.yml  [T1110,T1110.001]  HackTool - Hydra Password Bruteforce Execution
  T1003.001_hacktool-impacket-file-indicators.yml  [T1003.001]  HackTool - Impacket File Indicators
  T1557.001_hacktool-impacket-tools-execution.yml  [T1557.001]  HackTool - Impacket Tools Execution
  T1059.003_hacktool-koadic-execution.yml  [T1059.003,T1059.005,T1059.007]  HackTool - Koadic Execution
  T1558.003_hacktool-krbrelay-execution.yml  [T1558.003]  HackTool - KrbRelay Execution
  T1550.003_hacktool-krbrelayup-execution.yml  [T1550.003,T1558.003]  HackTool - KrbRelayUp Execution
  T1055.003_hacktool-littlecorporal-generated-maldoc-injection.yml  [T1055.003,T1204.002]  HackTool - LittleCorporal Generated Maldoc Injection
  hacktool-localpotato-execution.yml  []  HackTool - LocalPotato Execution
  T1003.001_hacktool-mimikatz-execution.yml  [T1003.001,T1003.002,T1003.004,T1003.005,T1003.006]  HackTool - Mimikatz Execution
  hacktool-nppspy-hacktool-usage.yml  []  HackTool - NPPSpy Hacktool Usage
  T1018_hacktool-netexec-execution.yml  [T1018,T1021]  HackTool - NetExec Execution
  T1021.002_hacktool-netexec-file-indicators.yml  [T1021.002,T1059.005]  HackTool - NetExec File Indicators
  T1134_hacktool-nofilter-execution.yml  [T1134,T1134.001]  HackTool - NoFilter Execution
  T1007_hacktool-pchunter-execution.yml  [T1007,T1012,T1057,T1082,T1083]  HackTool - PCHunter Execution
  T1134.004_hacktool-ppid-spoofing-selectmyparent-tool-execution.yml  [T1134.004]  HackTool - PPID Spoofing SelectMyParent Tool Execution
  T1055.001_hacktool-potential-cobaltstrike-process-injection.yml  [T1055.001]  HackTool - Potential CobaltStrike Process Injection
  T1021.003_hacktool-potential-impacket-lateral-movement-activity.yml  [T1021.003,T1047]  HackTool - Potential Impacket Lateral Movement Activity
  T1003_hacktool-potential-remote-credential-dumping-activity-via-cr.yml  [T1003]  HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
  T1685_hacktool-powertool-execution.yml  [T1685]  HackTool - PowerTool Execution
  T1574.001_hacktool-powerup-write-hijack-dll.yml  [T1574.001]  HackTool - Powerup Write Hijack DLL
  T1003.002_hacktool-pypykatz-credentials-dumping-activity.yml  [T1003.002]  HackTool - Pypykatz Credentials Dumping Activity
  T1003.002_hacktool-quarks-pwdump-execution.yml  [T1003.002]  HackTool - Quarks PwDump Execution
  T1059.003_hacktool-redmimicry-winnti-playbook-execution.yml  [T1059.003,T1106,T1218.011]  HackTool - RedMimicry Winnti Playbook Execution
  T1558.003_hacktool-remotekrbrelay-execution.yml  [T1558.003]  HackTool - RemoteKrbRelay Execution
  T1219.002_hacktool-remotekrbrelay-smb-relay-secrets-dump-module-indica.yml  [T1219.002]  HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
  T1003_hacktool-rubeus-execution-scriptblock.yml  [T1003,T1550.003,T1558.003]  HackTool - Rubeus Execution - ScriptBlock
  T1071_hacktool-silenttrinity-stager-dll-load.yml  [T1071]  HackTool - SILENTTRINITY Stager DLL Load
  T1071_hacktool-silenttrinity-stager-execution.yml  [T1071]  HackTool - SILENTTRINITY Stager Execution
  T1087_hacktool-soaphound-execution.yml  [T1087]  HackTool - SOAPHound Execution
  T1003.001_hacktool-safetykatz-dump-indicator.yml  [T1003.001]  HackTool - SafetyKatz Dump Indicator
  T1053_hacktool-sharpersist-execution.yml  [T1053]  HackTool - SharPersist Execution
  T1090.001_hacktool-sharpchisel-execution.yml  [T1090.001]  HackTool - SharpChisel Execution
  T1134.001_hacktool-sharpdpapi-execution.yml  [T1134.001,T1134.003]  HackTool - SharpDPAPI Execution
  T1685.001_hacktool-sharpevtmute-dll-load.yml  [T1685.001]  HackTool - SharpEvtMute DLL Load
  T1685.001_hacktool-sharpevtmute-execution.yml  [T1685.001]  HackTool - SharpEvtMute Execution
  T1134.001_hacktool-sharpimpersonation-execution.yml  [T1134.001,T1134.003]  HackTool - SharpImpersonation Execution
  T1033_hacktool-sharpldapwhoami-execution.yml  [T1033]  HackTool - SharpLdapWhoami Execution
  T1021.002_hacktool-sharpmove-tool-execution.yml  [T1021.002]  HackTool - SharpMove Tool Execution
  T1033_hacktool-sharpview-execution.yml  [T1033,T1049,T1069.002,T1135,T1482]  HackTool - SharpView Execution
  T1210_hacktool-sharpwsus-wsuspendu-execution.yml  [T1210]  HackTool - SharpWSUS/WSUSpendu Execution
  T1059_hacktool-stracciatella-execution.yml  [T1059,T1685]  HackTool - Stracciatella Execution
  T1685.001_hacktool-sysmonente-execution.yml  [T1685.001]  HackTool - SysmonEnte Execution
  T1482_hacktool-trufflesnout-execution.yml  [T1482]  HackTool - TruffleSnout Execution
  T1552.001_hacktool-typical-hivenightmare-sam-file-export.yml  [T1552.001]  HackTool - Typical HiveNightmare SAM File Export
  T1548.002_hacktool-uacme-akagi-execution.yml  [T1548.002]  HackTool - UACMe Akagi Execution
  T1003.001_hacktool-wsass-execution.yml  [T1003.001]  HackTool - WSASS Execution
  T1046_hacktool-winpwn-execution.yml  [T1046,T1082,T1106,T1518,T1548.002,T1552.001,T1555,T1555.003]  HackTool - WinPwn Execution
  T1046_hacktool-winpwn-execution-scriptblock.yml  [T1046,T1082,T1106,T1518,T1548.002,T1552.001,T1555,T1555.003]  HackTool - WinPwn Execution - ScriptBlock
  hacktool-wmiexec-default-powershell-command.yml  []  HackTool - Wmiexec Default Powershell Command
  T1003.001_hacktool-xordump-execution.yml  [T1003.001,T1036]  HackTool - XORDump Execution
  T1046_hacktool-winpeas-execution.yml  [T1046,T1082,T1087]  HackTool - winPEAS Execution
  T1564.004_hacktool-named-file-stream-created.yml  [T1564.004]  HackTool Named File Stream Created
  T1569.002_hacktool-service-registration-or-execution.yml  [T1569.002]  HackTool Service Registration or Execution
  T1685_hacktool-edr-freeze-execution.yml  [T1685]  Hacktool - EDR-Freeze Execution
  T1003_hacktool-execution-pe-metadata.yml  [T1003,T1588.002]  Hacktool Execution - PE Metadata
  T1059_hacktool-ruler.yml  [T1059,T1087,T1114,T1550.002]  Hacktool Ruler
  T1021.001_hermetic-wiper-tg-process-patterns.yml  [T1021.001]  Hermetic Wiper TG Process Patterns
  T1136.001_hidden-local-user-creation.yml  [T1136.001]  Hidden Local User Creation
  T1685_hide-schedule-task-via-index-value-tamper.yml  [T1685]  Hide Schedule Task Via Index Value Tamper
  T1564.002_hiding-user-account-via-specialaccounts-registry-key.yml  [T1564.002]  Hiding User Account Via SpecialAccounts Registry Key
  T1219.002_hijack-legit-rdp-session-to-move-laterally.yml  [T1219.002]  Hijack Legit RDP Session to Move Laterally
  T1565.001_history-file-deletion.yml  [T1565.001]  History File Deletion
  T1554_hybridconnectionmanager-service-installation.yml  [T1554]  HybridConnectionManager Service Installation
  T1608_hybridconnectionmanager-service-installation-registry.yml  [T1608]  HybridConnectionManager Service Installation - Registry
  T1554_hybridconnectionmanager-service-running.yml  [T1554]  HybridConnectionManager Service Running
  T1685_hypervisor-enforced-paging-translation-disabled.yml  [T1685]  Hypervisor Enforced Paging Translation Disabled
  T1685_hypervisor-protected-code-integrity-hvci-related-registry-ta.yml  [T1685]  Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
  ie-zonemap-setting-downgraded-to-mycomputer-zone-for-http-pr.yml  []  IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
  ie-zonemap-setting-downgraded-to-mycomputer-zone-for-http-pr_2.yml  []  IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI
  T1566.001_iso-file-created-within-temp-folders.yml  [T1566.001]  ISO File Created Within Temp Folders
  T1218.011_icedid-malware-suspicious-single-digit-dll-execution-via-run.yml  [T1218.011]  IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32
  imagingdevices-unusual-parent-child-processes.yml  []  ImagingDevices Unusual Parent/Child Processes
  T1021.002_impacket-psexec-execution.yml  [T1021.002]  Impacket PsExec Execution
  T1489_important-scheduled-task-deleted-or-disabled.yml  [T1489]  Important Scheduled Task Deleted or Disabled
  T1053.005_important-scheduled-task-deleted-disabled.yml  [T1053.005]  Important Scheduled Task Deleted/Disabled
  T1685.001_important-windows-event-auditing-disabled.yml  [T1685.001]  Important Windows Event Auditing Disabled
  T1685.005_important-windows-eventlog-cleared.yml  [T1685.005]  Important Windows Eventlog Cleared
  important-windows-service-terminated-unexpectedly.yml  []  Important Windows Service Terminated Unexpectedly
  important-windows-service-terminated-with-error.yml  []  Important Windows Service Terminated With Error
  T1112_imports-registry-key-from-an-ads.yml  [T1112]  Imports Registry Key From an ADS
  T1078_impossible-travel.yml  [T1078]  Impossible Travel
  T1055_injected-browser-process-spawning-rundll32-guloader-activity.yml  [T1055]  Injected Browser Process Spawning Rundll32 - GuLoader Activity
  T1059_inline-python-execution-spawn-shell-via-os-system-library.yml  [T1059]  Inline Python Execution - Spawn Shell Via OS System Library
  T1059_installation-of-wsl-kali-linux.yml  [T1059]  Installation of WSL Kali-Linux
  T1053.002_interactive-at-job.yml  [T1053.002]  Interactive AT Job
  T1078_invalid-pim-license.yml  [T1078]  Invalid PIM License
  T1027_invoke-obfuscation-clip-launcher.yml  [T1027,T1059.001]  Invoke-Obfuscation CLIP+ Launcher
  T1027_invoke-obfuscation-clip-launcher-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation CLIP+ Launcher - PowerShell
  T1027_invoke-obfuscation-clip-launcher-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
  T1027_invoke-obfuscation-clip-launcher-security.yml  [T1027,T1059.001]  Invoke-Obfuscation CLIP+ Launcher - Security
  T1027_invoke-obfuscation-clip-launcher-system.yml  [T1027,T1059.001]  Invoke-Obfuscation CLIP+ Launcher - System
  T1027_invoke-obfuscation-obfuscated-iex-invocation.yml  [T1027,T1059.001]  Invoke-Obfuscation Obfuscated IEX Invocation
  T1027_invoke-obfuscation-obfuscated-iex-invocation-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
  T1027_invoke-obfuscation-obfuscated-iex-invocation-powershell-modu.yml  [T1027,T1059.001]  Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
  T1027_invoke-obfuscation-obfuscated-iex-invocation-security.yml  [T1027]  Invoke-Obfuscation Obfuscated IEX Invocation - Security
  T1027_invoke-obfuscation-obfuscated-iex-invocation-system.yml  [T1027]  Invoke-Obfuscation Obfuscated IEX Invocation - System
  T1027_invoke-obfuscation-stdin-launcher.yml  [T1027,T1059.001]  Invoke-Obfuscation STDIN+ Launcher
  T1027_invoke-obfuscation-stdin-launcher-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
  T1027_invoke-obfuscation-stdin-launcher-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation STDIN+ Launcher - Powershell
  T1027_invoke-obfuscation-stdin-launcher-security.yml  [T1027,T1059.001]  Invoke-Obfuscation STDIN+ Launcher - Security
  T1027_invoke-obfuscation-stdin-launcher-system.yml  [T1027,T1059.001]  Invoke-Obfuscation STDIN+ Launcher - System
  T1027_invoke-obfuscation-var-launcher.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR+ Launcher
  T1027_invoke-obfuscation-var-launcher-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR+ Launcher - PowerShell
  T1027_invoke-obfuscation-var-launcher-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR+ Launcher - PowerShell Module
  T1027_invoke-obfuscation-var-launcher-security.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR+ Launcher - Security
  T1027_invoke-obfuscation-var-launcher-system.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR+ Launcher - System
  T1027_invoke-obfuscation-var-launcher-obfuscation.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
  T1027_invoke-obfuscation-var-launcher-obfuscation-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
  T1027_invoke-obfuscation-var-launcher-obfuscation-powershell-modul.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
  T1027_invoke-obfuscation-var-launcher-obfuscation-security.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
  T1027_invoke-obfuscation-var-launcher-obfuscation-system.yml  [T1027,T1059.001]  Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
  T1027_invoke-obfuscation-via-stdin.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Stdin
  T1027_invoke-obfuscation-via-stdin-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Stdin - PowerShell Module
  T1027_invoke-obfuscation-via-stdin-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Stdin - Powershell
  T1027_invoke-obfuscation-via-stdin-security.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Stdin - Security
  T1027_invoke-obfuscation-via-stdin-system.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Stdin - System
  T1027_invoke-obfuscation-via-use-clip.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Clip
  T1027_invoke-obfuscation-via-use-clip-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Clip - PowerShell Module
  T1027_invoke-obfuscation-via-use-clip-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Clip - Powershell
  T1027_invoke-obfuscation-via-use-clip-security.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Clip - Security
  T1027_invoke-obfuscation-via-use-clip-system.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Clip - System
  T1027_invoke-obfuscation-via-use-mshta.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use MSHTA
  T1027_invoke-obfuscation-via-use-mshta-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use MSHTA - PowerShell
  T1027_invoke-obfuscation-via-use-mshta-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use MSHTA - PowerShell Module
  T1027_invoke-obfuscation-via-use-mshta-security.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use MSHTA - Security
  T1027_invoke-obfuscation-via-use-mshta-system.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use MSHTA - System
  T1027_invoke-obfuscation-via-use-rundll32-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Rundll32 - PowerShell
  T1027_invoke-obfuscation-via-use-rundll32-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
  T1027_invoke-obfuscation-via-use-rundll32-security.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Rundll32 - Security
  T1027_invoke-obfuscation-via-use-rundll32-system.yml  [T1027,T1059.001]  Invoke-Obfuscation Via Use Rundll32 - System
  T1190_jndiexploit-pattern.yml  [T1190]  JNDIExploit Pattern
  T1059.002_jxa-in-memory-execution-via-osascript.yml  [T1059.002,T1059.007]  JXA In-memory Execution Via OSAScript
  T1190_java-payload-strings.yml  [T1190]  Java Payload Strings
  T1059.004_jexboss-command-sequence.yml  [T1059.004]  JexBoss Command Sequence
  T1059.001_kalambur-backdoor-curl-tor-socks-proxy-execution.yml  [T1059.001,T1071.001,T1090,T1573]  Kalambur Backdoor Curl TOR SOCKS Proxy Execution
  T1547.001_kapeka-backdoor-autorun-persistence.yml  [T1547.001]  Kapeka Backdoor Autorun Persistence
  T1218.011_kapeka-backdoor-execution-via-rundll32-exe.yml  [T1218.011]  Kapeka Backdoor Execution Via RunDLL32.EXE
  T1204.002_kapeka-backdoor-loaded-via-rundll32-exe.yml  [T1204.002,T1218.011]  Kapeka Backdoor Loaded Via Rundll32.EXE
  T1053.005_kapeka-backdoor-persistence-activity.yml  [T1053.005]  Kapeka Backdoor Persistence Activity
  T1053.005_kapeka-backdoor-scheduled-task-creation.yml  [T1053.005]  Kapeka Backdoor Scheduled Task Creation
  T1685_kaspersky-endpoint-security-stopped-via-commandline-linux.yml  [T1685]  Kaspersky Endpoint Security Stopped Via CommandLine - Linux
  T1129_katz-stealer-dll-loaded.yml  [T1129]  Katz Stealer DLL Loaded
  T1071.001_katz-stealer-suspicious-user-agent.yml  [T1071.001]  Katz Stealer Suspicious User-Agent
  T1127_kavremover-dropped-binary-lolbin-usage.yml  [T1127]  Kavremover Dropped Binary LOLBIN Usage
  T1212_kerberos-manipulation.yml  [T1212]  Kerberos Manipulation
  kernel-memory-dump-via-livekd.yml  []  Kernel Memory Dump Via LiveKD
  T1543_krbrelayup-service-installation.yml  [T1543]  KrbRelayUp Service Installation
  T1036.003_lol-binary-copied-from-system-directory.yml  [T1036.003]  LOL-Binary Copied From System Directory
  T1190_lpe-installerfiletakeover-poc-cve-2021-41379.yml  [T1190]  LPE InstallerFileTakeOver PoC CVE-2021-41379
  T1003.001_lsass-access-detected-via-attack-surface-reduction.yml  [T1003.001]  LSASS Access Detected via Attack Surface Reduction
  T1003.001_lsass-access-from-potentially-white-listed-processes.yml  [T1003.001]  LSASS Access From Potentially White-Listed Processes
  T1499_lsass-crash-via-netlogon-stack-buffer-overflow-cve-2026-4108.yml  [T1499]  LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089
  T1003.001_lsass-dump-keyword-in-commandline.yml  [T1003.001]  LSASS Dump Keyword In CommandLine
  T1003.001_lsass-memory-access-by-tool-with-dump-keyword-in-name.yml  [T1003.001]  LSASS Memory Access by Tool With Dump Keyword In Name
  T1003.001_lsass-process-crashed-application.yml  [T1003.001]  LSASS Process Crashed - Application
  T1003.001_lsass-process-dump-artefact-in-crashdumps-folder.yml  [T1003.001]  LSASS Process Dump Artefact In CrashDumps Folder
  T1003.001_lsass-process-memory-dump-creation-via-taskmgr-exe.yml  [T1003.001]  LSASS Process Memory Dump Creation Via Taskmgr.EXE
  T1003.001_lsass-process-memory-dump-files.yml  [T1003.001]  LSASS Process Memory Dump Files
  T1552.006_lsass-process-reconnaissance-via-findstr-exe.yml  [T1552.006]  LSASS Process Reconnaissance Via Findstr.EXE
  lace-tempest-cobalt-strike-download.yml  []  Lace Tempest Cobalt Strike Download
  lace-tempest-file-indicators.yml  []  Lace Tempest File Indicators
  lace-tempest-malware-loader-execution.yml  []  Lace Tempest Malware Loader Execution
  T1059.001_lace-tempest-powershell-evidence-eraser.yml  [T1059.001]  Lace Tempest PowerShell Evidence Eraser
  T1059.001_lace-tempest-powershell-launcher.yml  [T1059.001]  Lace Tempest PowerShell Launcher
  T1574.001_lazarus-apt-dll-sideloading-activity.yml  [T1574.001]  Lazarus APT DLL Sideloading Activity
  T1036.005_lazarus-system-binary-masquerading.yml  [T1036.005]  Lazarus System Binary Masquerading
  T1218_legitimate-application-dropped-archive.yml  [T1218]  Legitimate Application Dropped Archive
  T1218_legitimate-application-dropped-executable.yml  [T1218]  Legitimate Application Dropped Executable
  T1218_legitimate-application-dropped-script.yml  [T1218]  Legitimate Application Dropped Script
  T1105_legitimate-application-writing-files-in-uncommon-location.yml  [T1105,T1218]  Legitimate Application Writing Files In Uncommon Location
  T1070.003_linux-command-history-tampering.yml  [T1070.003]  Linux Command History Tampering
  T1496_linux-crypto-mining-indicators.yml  [T1496]  Linux Crypto Mining Indicators
  T1496_linux-crypto-mining-pool-connections.yml  [T1496]  Linux Crypto Mining Pool Connections
  T1587_linux-hacktool-execution.yml  [T1587]  Linux HackTool Execution
  T1003_linux-keylogging-with-pam-d.yml  [T1003,T1056.001]  Linux Keylogging with Pam.d
  T1552.001_linux-recon-indicators.yml  [T1552.001,T1592.004]  Linux Recon Indicators
  T1059_linux-suspicious-child-process-from-node-js-react2shell.yml  [T1059,T1190]  Linux Suspicious Child Process from Node.js - React2Shell
  T1505.003_linux-webshell-indicators.yml  [T1505.003]  Linux Webshell Indicators
  T1195.002_litellm-teampcp-supply-chain-attack-indicators.yml  [T1195.002,T1543.002,T1560.001]  LiteLLM / TeamPCP Supply Chain Attack Indicators
  T1003_live-memory-dump-using-powershell.yml  [T1003]  Live Memory Dump Using Powershell
  livekd-driver-creation-by-uncommon-process.yml  []  LiveKD Driver Creation By Uncommon Process
  livekd-kernel-memory-dump-file-created.yml  []  LiveKD Kernel Memory Dump File Created
  T1486_load-of-rstrtmgr-dll-by-a-suspicious-process.yml  [T1486,T1685]  Load Of RstrtMgr.DLL By A Suspicious Process
  loading-diagcab-package-from-remote-path.yml  []  Loading Diagcab Package From Remote Path
  T1547.006_loading-of-kernel-module-via-insmod.yml  [T1547.006]  Loading of Kernel Module via Insmod
  T1557.001_local-privilege-escalation-indicator-tabtip.yml  [T1557.001]  Local Privilege Escalation Indicator TabTip
  T1190_log4j-rce-cve-2021-44228-generic.yml  [T1190]  Log4j RCE CVE-2021-44228 Generic
  T1190_log4j-rce-cve-2021-44228-in-fields.yml  [T1190]  Log4j RCE CVE-2021-44228 in Fields
  T1685_logging-configuration-changes-on-linux-host.yml  [T1685]  Logging Configuration Changes on Linux Host
  T1105_lolbas-onedrivestandaloneupdater-exe-proxy-download.yml  [T1105]  Lolbas OneDriveStandaloneUpdater.exe Proxy Download
  T1003.001_lsass-full-dump-request-via-dumptype-registry-settings.yml  [T1003.001]  Lsass Full Dump Request Via DumpType Registry Settings
  T1003.001_lsass-memory-dump-via-comsvcs-dll.yml  [T1003.001]  Lsass Memory Dump via Comsvcs DLL
  T1055_lummac-stealer-activity-execution-of-more-com-and-vbc-exe.yml  [T1055]  Lummac Stealer Activity - Execution Of More.com And Vbc.exe
  T1059.001_mercury-apt-activity.yml  [T1059.001]  MERCURY APT Activity
  T1036.002_mmc-executing-files-with-reversed-extensions-using-rtlo-abus.yml  [T1036.002,T1204.002,T1218.014]  MMC Executing Files with Reversed Extensions Using RTLO Abuse
  T1021.003_mmc-spawning-windows-shell.yml  [T1021.003]  MMC Spawning Windows Shell
  T1021.003_mmc20-lateral-movement.yml  [T1021.003]  MMC20 Lateral Movement
  T1505.003_moveit-cve-2023-34362-exploitation-attempt-potential-web-she.yml  [T1505.003]  MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request
  T1218_msdt-execution-via-answer-file.yml  [T1218]  MSDT Execution Via Answer File
  T1059.007_mshta-execution-with-suspicious-file-extensions.yml  [T1059.007,T1140,T1218.005]  MSHTA Execution with Suspicious File Extensions
  msmq-corrupted-packet-encountered.yml  []  MSMQ Corrupted Packet Encountered
  mssql-add-account-to-sysadmin-role.yml  []  MSSQL Add Account To Sysadmin Role
  mssql-disable-audit-settings.yml  []  MSSQL Disable Audit Settings
  T1546_mssql-extended-stored-procedure-backdoor-maggie.yml  [T1546]  MSSQL Extended Stored Procedure Backdoor Maggie
  mssql-spprocoption-set.yml  []  MSSQL SPProcoption Set
  mssql-xpcmdshell-option-change.yml  []  MSSQL XPCmdshell Option Change
  mssql-xpcmdshell-suspicious-execution.yml  []  MSSQL XPCmdshell Suspicious Execution
  T1112_macro-enabled-in-a-potentially-suspicious-document.yml  [T1112]  Macro Enabled In A Potentially Suspicious Document
  T1059.001_malicious-base64-encoded-powershell-keywords-in-command-line.yml  [T1059.001]  Malicious Base64 Encoded PowerShell Keywords in Command Lines
  T1574.001_malicious-dll-file-dropped-in-the-teams-or-onedrive-folder.yml  [T1574.001]  Malicious DLL File Dropped in the Teams or OneDrive Folder
  T1068_malicious-driver-load.yml  [T1068,T1543.003]  Malicious Driver Load
  T1090_malicious-ip-address-sign-in-failure-rate.yml  [T1090]  Malicious IP Address Sign-In Failure Rate
  T1090_malicious-ip-address-sign-in-suspicious.yml  [T1090]  Malicious IP Address Sign-In Suspicious
  T1059.001_malicious-nishang-powershell-commandlets.yml  [T1059.001]  Malicious Nishang PowerShell Commandlets
  T1059.001_malicious-powershell-commandlets-poshmodule.yml  [T1059.001,T1069,T1069.001,T1069.002,T1087,T1087.001,T1087.002,T1482]  Malicious PowerShell Commandlets - PoshModule
  T1059.001_malicious-powershell-commandlets-processcreation.yml  [T1059.001,T1069,T1069.001,T1069.002,T1087,T1087.001,T1087.002,T1482]  Malicious PowerShell Commandlets - ProcessCreation
  T1059.001_malicious-powershell-commandlets-scriptblock.yml  [T1059.001,T1069,T1069.001,T1069.002,T1087,T1087.001,T1087.002,T1482]  Malicious PowerShell Commandlets - ScriptBlock
  T1059.001_malicious-powershell-scripts-filecreation.yml  [T1059.001]  Malicious PowerShell Scripts - FileCreation
  T1059.001_malicious-powershell-scripts-poshmodule.yml  [T1059.001]  Malicious PowerShell Scripts - PoshModule
  T1059.001_malicious-shellintel-powershell-commandlets.yml  [T1059.001]  Malicious ShellIntel PowerShell Commandlets
  T1078_malicious-usage-of-imds-credentials-outside-of-aws-infrastru.yml  [T1078,T1078.002]  Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure
  T1055_malware-shellcode-in-verclsid-target-process.yml  [T1055]  Malware Shellcode in Verclsid Target Process
  T1071.001_malware-user-agent.yml  [T1071.001]  Malware User Agent
  T1055.001_manageengine-endpoint-central-dctask64-exe-potential-abuse.yml  [T1055.001]  ManageEngine Endpoint Central Dctask64.EXE Potential Abuse
  T1653_mask-system-power-settings-via-systemctl.yml  [T1653]  Mask System Power Settings Via Systemctl
  T1055.001_mavinject-inject-dll-into-running-process.yml  [T1055.001,T1218.013]  Mavinject Inject DLL Into Running Process
  T1021.002_metasploit-or-impacket-service-installation-via-smb-psexec.yml  [T1021.002,T1569.002,T1570]  Metasploit Or Impacket Service Installation Via SMB PsExec
  T1021.002_metasploit-smb-authentication.yml  [T1021.002]  Metasploit SMB Authentication
  T1134.001_meterpreter-or-cobalt-strike-getsystem-service-installation.yml  [T1134.001,T1134.002]  Meterpreter or Cobalt Strike Getsystem Service Installation - Security
  T1134.001_meterpreter-or-cobalt-strike-getsystem-service-installation_2.yml  [T1134.001,T1134.002]  Meterpreter or Cobalt Strike Getsystem Service Installation - System
  T1574.001_microsoft-defender-blocked-from-loading-unsigned-dll.yml  [T1574.001]  Microsoft Defender Blocked from Loading Unsigned DLL
  T1685_microsoft-defender-tamper-protection-trigger.yml  [T1685]  Microsoft Defender Tamper Protection Trigger
  T1003_microsoft-iis-connection-strings-decryption.yml  [T1003]  Microsoft IIS Connection Strings Decryption
  T1003_microsoft-iis-service-account-password-dumped.yml  [T1003]  Microsoft IIS Service Account Password Dumped
  T1211_microsoft-malware-protection-engine-crash.yml  [T1211,T1685]  Microsoft Malware Protection Engine Crash
  T1211_microsoft-malware-protection-engine-crash-wer.yml  [T1211,T1685]  Microsoft Malware Protection Engine Crash - WER
  T1574.001_microsoft-office-dll-sideload.yml  [T1574.001]  Microsoft Office DLL Sideload
  T1685_microsoft-office-protected-view-disabled.yml  [T1685]  Microsoft Office Protected View Disabled
  T1003.006_mimikatz-dc-sync.yml  [T1003.006]  Mimikatz DC Sync
  T1003.001_mimikatz-use.yml  [T1003.001,T1003.002,T1003.004,T1003.006]  Mimikatz Use
  mint-sandstorm-log4j-wstomcat-process-execution.yml  []  Mint Sandstorm - Log4J Wstomcat Process Execution
  T1574.006_modification-of-ld-so-preload.yml  [T1574.006]  Modification of ld.so.preload
  T1020_modification-or-deletion-of-an-aws-rds-cluster.yml  [T1020]  Modification or Deletion of an AWS RDS Cluster
  T1547.001_modify-user-shell-folders-startup-value.yml  [T1547.001]  Modify User Shell Folders Startup Value
  T1496_monero-crypto-coin-mining-pool-lookup.yml  [T1496,T1567]  Monero Crypto Coin Mining Pool Lookup
  T1218_mpiexec-lolbin.yml  [T1218]  MpiExec Lolbin
  mshtml-dll-runhtmlapplication-suspicious-usage.yml  []  Mshtml.DLL RunHTMLApplication Suspicious Usage
  mstsc-exe-execution-from-uncommon-parent.yml  []  Mstsc.EXE Execution From Uncommon Parent
  T1587.001_mustang-panda-dropper.yml  [T1587.001]  Mustang Panda Dropper
  T1112_net-ngenassemblyusagelog-registry-key-tamper.yml  [T1112]  NET NGenAssemblyUsageLog Registry Key Tamper
  T1003.003_ntds-exfiltration-filename-patterns.yml  [T1003.003]  NTDS Exfiltration Filename Patterns
  T1003.003_ntds-dit-creation-by-uncommon-parent-process.yml  [T1003.003]  NTDS.DIT Creation By Uncommon Parent Process
  T1003.002_ntds-dit-creation-by-uncommon-process.yml  [T1003.002,T1003.003]  NTDS.DIT Creation By Uncommon Process
  T1059.001_ntfs-alternate-data-stream.yml  [T1059.001,T1564.004]  NTFS Alternate Data Stream
  T1499.001_ntfs-vulnerability-exploitation.yml  [T1499.001]  NTFS Vulnerability Exploitation
  T1187_ntlm-hash-leak-via-curl-ntlm-authentication.yml  [T1187]  NTLM Hash Leak Via Curl NTLM Authentication
  T1547.001_narrator-s-feedback-hub-persistence.yml  [T1547.001]  Narrator's Feedback-Hub Persistence
  T1059.001_net-webclient-casing-anomalies.yml  [T1059.001]  Net WebClient Casing Anomalies
  T1112_netntlm-downgrade-attack.yml  [T1112,T1685]  NetNTLM Downgrade Attack
  T1112_netntlm-downgrade-attack-registry.yml  [T1112,T1685]  NetNTLM Downgrade Attack - Registry
  T1105_network-communication-initiated-to-file-sharing-domains-from.yml  [T1105]  Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
  T1496_network-communication-with-crypto-mining-pool.yml  [T1496]  Network Communication With Crypto Mining Pool
  T1218_network-connection-initiated-by-addinutil-exe.yml  [T1218]  Network Connection Initiated By AddinUtil.EXE
  T1203_network-connection-initiated-by-eqnedt32-exe.yml  [T1203]  Network Connection Initiated By Eqnedt32.EXE
  T1105_network-connection-initiated-by-imewdbld-exe.yml  [T1105]  Network Connection Initiated By IMEWDBLD.EXE
  T1105_network-connection-initiated-from-process-located-in-potenti.yml  [T1105]  Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
  T1055_network-connection-initiated-via-notepad-exe.yml  [T1055]  Network Connection Initiated Via Notepad.EXE
  T1059.003_network-connection-initiated-via-finger-exe.yml  [T1059.003,T1071.004]  Network Connection Initiated via Finger.EXE
  T1082_network-reconnaissance-activity.yml  [T1082,T1087]  Network Reconnaissance Activity
  T1546.003_new-activescripteventconsumer-created-via-wmic-exe.yml  [T1546.003]  New ActiveScriptEventConsumer Created Via Wmic.EXE
  T1102_new-connection-initiated-to-potential-dead-drop-resolver-dom.yml  [T1102,T1102.001]  New Connection Initiated To Potential Dead Drop Resolver Domain
  T1078_new-country.yml  [T1078]  New Country
  T1112_new-dns-serverlevelplugindll-installed.yml  [T1112,T1574.001]  New DNS ServerLevelPluginDll Installed
  T1112_new-dns-serverlevelplugindll-installed-via-dnscmd-exe.yml  [T1112,T1574.001]  New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
  new-file-association-using-exefile.yml  []  New File Association Using Exefile
  T1686.003_new-firewall-rule-added-in-windows-firewall-exception-list-f.yml  [T1686.003]  New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
  T1546.007_new-netsh-helper-dll-registered-from-a-suspicious-location.yml  [T1546.007]  New Netsh Helper DLL Registered From A Suspicious Location
  T1021_new-rdp-connection-initiated-from-domain-controller.yml  [T1021]  New RDP Connection Initiated From Domain Controller
  T1547.001_new-run-key-pointing-to-suspicious-folder.yml  [T1547.001]  New RUN Key Pointing to Suspicious Folder
  T1547.003_new-timeproviders-registered-with-uncommon-dll-name.yml  [T1547.003]  New TimeProviders Registered With Uncommon DLL Name
  T1136.001_new-user-created-via-net-exe-with-never-expire-option.yml  [T1136.001]  New User Created Via Net.EXE With Never Expire Option
  T1499.004_nginx-core-dump.yml  [T1499.004]  Nginx Core Dump
  T1090_ngrok-usage-with-remote-desktop-service.yml  [T1090]  Ngrok Usage with Remote Desktop Service
  T1068_non-standard-nsswitch-conf-creation-potential-cve-2025-32463.yml  [T1068]  Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
  T1112_non-privileged-usage-of-reg-or-powershell.yml  [T1112]  Non-privileged Usage of Reg or Powershell
  ntdllpipe-like-activity-execution.yml  []  NtdllPipe Like Activity Execution
  T1021.006_omigod-http-no-authentication-rce-cve-2021-38647.yml  [T1021.006,T1068,T1190,T1203,T1210]  OMIGOD HTTP No Authentication RCE - CVE-2021-38647
  T1068_omigod-scx-runasprovider-executescript.yml  [T1068,T1190,T1203]  OMIGOD SCX RunAsProvider ExecuteScript
  T1068_omigod-scx-runasprovider-executeshellcommand.yml  [T1068,T1190,T1203]  OMIGOD SCX RunAsProvider ExecuteShellCommand
  T1059.002_osacompile-run-only-execution.yml  [T1059.002]  OSACompile Run-Only Execution
  T1027.010_obfuscated-powershell-msi-install-via-windowsinstaller-com.yml  [T1027.010,T1059.001,T1218.007]  Obfuscated PowerShell MSI Install via WindowsInstaller COM
  T1059.001_obfuscated-powershell-oneliner-execution.yml  [T1059.001,T1685]  Obfuscated PowerShell OneLiner Execution
  T1195_octopus-scanner-malware.yml  [T1195,T1195.001]  Octopus Scanner Malware
  T1218.008_odbcconf-exe-suspicious-dll-location.yml  [T1218.008]  Odbcconf.EXE Suspicious DLL Location
  T1566.001_office-macro-file-creation-from-suspicious-process.yml  [T1566.001]  Office Macro File Creation From Suspicious Process
  T1112_office-macros-warning-disabled.yml  [T1112]  Office Macros Warning Disabled
  T1566_okta-fastpass-phishing-detection.yml  [T1566]  Okta FastPass Phishing Detection
  T1078.004_okta-new-admin-console-behaviours.yml  [T1078.004]  Okta New Admin Console Behaviours
  T1586.003_okta-suspicious-activity-reported-by-end-user.yml  [T1586.003]  Okta Suspicious Activity Reported by End-user
  T1685_okta-user-session-start-via-an-anonymising-proxy-service.yml  [T1685]  Okta User Session Start Via An Anonymising Proxy Service
  T1218.001_onenote-exe-execution-of-malicious-embedded-scripts.yml  [T1218.001]  OneNote.EXE Execution of Malicious Embedded Scripts
  onyx-sleet-apt-file-creation-indicators.yml  []  Onyx Sleet APT File Creation Indicators
  T1021_opencanary-ftp-login-attempt.yml  [T1021,T1190]  OpenCanary - FTP Login Attempt
  T1213_opencanary-git-clone-request.yml  [T1213]  OpenCanary - GIT Clone Request
  T1190_opencanary-http-get-request.yml  [T1190]  OpenCanary - HTTP GET Request
  T1190_opencanary-http-post-login-attempt.yml  [T1190]  OpenCanary - HTTP POST Login Attempt
  T1090_opencanary-httpproxy-login-attempt.yml  [T1090]  OpenCanary - HTTPPROXY Login Attempt
  T1046_opencanary-host-port-scan-syn-scan.yml  [T1046]  OpenCanary - Host Port Scan (SYN Scan)
  T1003_opencanary-mssql-login-attempt-via-sqlauth.yml  [T1003,T1213]  OpenCanary - MSSQL Login Attempt Via SQLAuth
  T1003_opencanary-mssql-login-attempt-via-windows-authentication.yml  [T1003,T1213]  OpenCanary - MSSQL Login Attempt Via Windows Authentication
  T1003_opencanary-mysql-login-attempt.yml  [T1003,T1213]  OpenCanary - MySQL Login Attempt
  T1046_opencanary-nmap-fin-scan.yml  [T1046]  OpenCanary - NMAP FIN Scan
  T1046_opencanary-nmap-null-scan.yml  [T1046]  OpenCanary - NMAP NULL Scan
  T1046_opencanary-nmap-os-scan.yml  [T1046]  OpenCanary - NMAP OS Scan
  T1046_opencanary-nmap-xmas-scan.yml  [T1046]  OpenCanary - NMAP XMAS Scan
  T1498_opencanary-ntp-monlist-request.yml  [T1498]  OpenCanary - NTP Monlist Request
  T1021.001_opencanary-rdp-new-connection-attempt.yml  [T1021.001,T1133]  OpenCanary - RDP New Connection Attempt
  T1003_opencanary-redis-action-command-attempt.yml  [T1003,T1213]  OpenCanary - REDIS Action Command Attempt
  T1123_opencanary-sip-request.yml  [T1123]  OpenCanary - SIP Request
  T1005_opencanary-smb-file-open-request.yml  [T1005,T1021]  OpenCanary - SMB File Open Request
  T1016_opencanary-snmp-oid-request.yml  [T1016,T1021]  OpenCanary - SNMP OID Request
  T1021_opencanary-ssh-login-attempt.yml  [T1021,T1078,T1133]  OpenCanary - SSH Login Attempt
  T1021_opencanary-ssh-new-connection-attempt.yml  [T1021,T1078,T1133]  OpenCanary - SSH New Connection Attempt
  T1041_opencanary-tftp-request.yml  [T1041]  OpenCanary - TFTP Request
  T1078_opencanary-telnet-login-attempt.yml  [T1078,T1133]  OpenCanary - Telnet Login Attempt
  T1021_opencanary-vnc-connection-attempt.yml  [T1021]  OpenCanary - VNC Connection Attempt
  T1218_openwith-exe-executes-specified-binary.yml  [T1218]  OpenWith.exe Executes Specified Binary
  T1012_operation-wocao-activity.yml  [T1012,T1027,T1036.004,T1053.005,T1059.001]  Operation Wocao Activity
  T1012_operation-wocao-activity-security.yml  [T1012,T1027,T1036.004,T1053.005,T1059.001]  Operation Wocao Activity - Security
  T1059.003_operator-bloopers-cobalt-strike-commands.yml  [T1059.003]  Operator Bloopers Cobalt Strike Commands
  T1059.003_operator-bloopers-cobalt-strike-modules.yml  [T1059.003]  Operator Bloopers Cobalt Strike Modules
  T1190_oracle-weblogic-exploit-cve-2020-14882.yml  [T1190]  Oracle WebLogic Exploit CVE-2020-14882
  T1218.003_outbound-network-connection-initiated-by-cmstp-exe.yml  [T1218.003]  Outbound Network Connection Initiated By Cmstp.EXE
  T1071.001_outbound-network-connection-initiated-by-microsoft-dialer.yml  [T1071.001]  Outbound Network Connection Initiated By Microsoft Dialer
  T1105_outbound-network-connection-initiated-by-script-interpreter.yml  [T1105]  Outbound Network Connection Initiated By Script Interpreter
  T1021.001_outbound-rdp-connections-over-non-standard-tools.yml  [T1021.001]  Outbound RDP Connections Over Non-Standard Tools
  T1195.001_outdated-dependency-or-vulnerability-alert-disabled.yml  [T1195.001]  Outdated Dependency Or Vulnerability Alert Disabled
  T1059_outlook-enableunsafeclientmailrules-setting-enabled.yml  [T1059,T1202]  Outlook EnableUnsafeClientMailRules Setting Enabled
  T1112_outlook-enableunsafeclientmailrules-setting-enabled-registry.yml  [T1112]  Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
  T1008_outlook-macro-execution-without-warning-setting-enabled.yml  [T1008,T1137,T1546]  Outlook Macro Execution Without Warning Setting Enabled
  T1059_pcre-net-package-image-load.yml  [T1059]  PCRE.NET Package Image Load
  T1059_pcre-net-package-temp-files.yml  [T1059]  PCRE.NET Package Temp Files
  pdf-file-created-by-regedit-exe.yml  []  PDF File Created By RegEdit.EXE
  T1078_pim-alert-setting-changes-to-disabled.yml  [T1078]  PIM Alert Setting Changes To Disabled
  T1078.004_pim-approvals-and-deny-elevation.yml  [T1078.004]  PIM Approvals And Deny Elevation
  T1003.001_ppl-tampering-via-werfaultsecure.yml  [T1003.001,T1685]  PPL Tampering Via WerFaultSecure
  T1059.001_psasyncshell-asynchronous-tcp-reverse-shell.yml  [T1059.001]  PSAsyncShell - Asynchronous TCP Reverse Shell
  T1136.002_psexec-remote-execution-file-artefact.yml  [T1136.002,T1543.003,T1570]  PSEXEC Remote Execution File Artefact
  T1047_psexec-and-wmi-process-creations-block.yml  [T1047,T1569.002]  PSExec and WMI Process Creations Block
  T1572_pua-3proxy-execution.yml  [T1572]  PUA - 3Proxy Execution
  T1018_pua-adfind-suspicious-execution.yml  [T1018,T1069.002,T1087.002,T1482]  PUA - AdFind Suspicious Execution
  T1134.002_pua-advancedrun-suspicious-execution.yml  [T1134.002]  PUA - AdvancedRun Suspicious Execution
  T1090.001_pua-chisel-tunneling-tool-execution.yml  [T1090.001]  PUA - Chisel Tunneling Tool Execution
  T1685_pua-cleanwipe-execution.yml  [T1685]  PUA - CleanWipe Execution
  T1590.001_pua-crassus-execution.yml  [T1590.001]  PUA - Crassus Execution
  T1569.002_pua-csexec-execution.yml  [T1569.002,T1587.001]  PUA - CsExec Execution
  T1003.003_pua-dit-snapshot-viewer.yml  [T1003.003]  PUA - DIT Snapshot Viewer
  T1027.005_pua-defendercheck-execution.yml  [T1027.005]  PUA - DefenderCheck Execution
  T1090_pua-fast-reverse-proxy-frp-execution.yml  [T1090]  PUA - Fast Reverse Proxy (FRP) Execution
  T1543.003_pua-kernel-driver-utility-kdu-execution.yml  [T1543.003]  PUA - Kernel Driver Utility (KDU) Execution
  T1003_pua-memory-dump-mount-via-memprocfs.yml  [T1003,T1003.001,T1003.002,T1003.004]  PUA - Memory Dump Mount Via MemProcFS
  T1090_pua-nps-tunneling-tool-execution.yml  [T1090]  PUA - NPS Tunneling Tool Execution
  T1569.002_pua-nsudo-execution.yml  [T1569.002]  PUA - NSudo Execution
  T1095_pua-netcat-suspicious-execution.yml  [T1095]  PUA - Netcat Suspicious Execution
  T1572_pua-ngrok-execution.yml  [T1572]  PUA - Ngrok Execution
  T1105_pua-nimgrab-execution.yml  [T1105]  PUA - Nimgrab Execution
  T1569.002_pua-nircmd-execution-as-local-system.yml  [T1569.002]  PUA - NirCmd Execution As LOCAL SYSTEM
  T1595_pua-pingcastle-execution-from-potentially-suspicious-parent.yml  [T1595]  PUA - PingCastle Execution From Potentially Suspicious Parent
  T1543_pua-process-hacker-driver-load.yml  [T1543]  PUA - Process Hacker Driver Load
  T1567.002_pua-rclone-execution.yml  [T1567.002]  PUA - Rclone Execution
  T1048_pua-restic-backup-tool-execution.yml  [T1048,T1567.002]  PUA - Restic Backup Tool Execution
  T1569.002_pua-runxcmd-execution.yml  [T1569.002]  PUA - RunXCmd Execution
  T1083_pua-seatbelt-execution.yml  [T1083,T1087,T1526]  PUA - Seatbelt Execution
  T1087.002_pua-suspicious-activedirectory-enumeration-via-adfind-exe.yml  [T1087.002]  PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
  T1059_pua-wsudo-suspicious-execution.yml  [T1059]  PUA - Wsudo Suspicious Execution
  T1090_pua-iox-tunneling-tool-execution.yml  [T1090]  PUA- IOX Tunneling Tool Execution
  papercut-mf-ng-exploitation-related-indicators.yml  []  PaperCut MF/NG Exploitation Related Indicators
  papercut-mf-ng-potential-exploitation.yml  []  PaperCut MF/NG Potential Exploitation
  T1098_password-change-on-directory-service-restore-mode-dsrm-accou.yml  [T1098]  Password Change on Directory Service Restore Mode (DSRM) Account
  T1003.001_password-dumper-activity-on-lsass.yml  [T1003.001]  Password Dumper Activity on LSASS
  T1003.001_password-dumper-remote-thread-in-lsass.yml  [T1003.001]  Password Dumper Remote Thread in LSASS
  T1027_password-protected-zip-file-opened-email-attachment.yml  [T1027,T1566.001]  Password Protected ZIP File Opened (Email Attachment)
  T1027_password-protected-zip-file-opened-suspicious-filenames.yml  [T1027,T1036,T1105]  Password Protected ZIP File Opened (Suspicious Filenames)
  T1110_password-spray-activity.yml  [T1110]  Password Spray Activity
  peach-sandstorm-apt-process-activity-indicators.yml  []  Peach Sandstorm APT Process Activity Indicators
  persistence-via-hhctrl-ocx.yml  []  Persistence Via Hhctrl.ocx
  T1053.005_persistence-and-execution-at-scale-via-gpo-scheduled-task.yml  [T1053.005]  Persistence and Execution at Scale via GPO Scheduled Task
  T1187_petitpotam-suspicious-kerberos-tgt-request.yml  [T1187]  PetitPotam Suspicious Kerberos TGT Request
  T1566_phishing-pattern-iso-in-archive.yml  [T1566]  Phishing Pattern ISO in Archive
  pikabot-fake-dll-extension-execution-via-rundll32-exe.yml  []  Pikabot Fake DLL Extension Execution Via Rundll32.EXE
  T1027_ping-hex-ip.yml  [T1027,T1140]  Ping Hex IP
  T1574.001_pingback-backdoor-activity.yml  [T1574.001]  Pingback Backdoor Activity
  T1574.001_pingback-backdoor-dll-loading-activity.yml  [T1574.001]  Pingback Backdoor DLL Loading Activity
  T1574.001_pingback-backdoor-file-indicators.yml  [T1574.001]  Pingback Backdoor File Indicators
  T1569_possible-cve-2021-1675-print-spooler-exploitation.yml  [T1569]  Possible CVE-2021-1675 Print Spooler Exploitation
  T1033_possible-dcsync-attack.yml  [T1033]  Possible DCSync Attack
  T1210_possible-exploitation-of-exchange-rce-cve-2021-42321.yml  [T1210]  Possible Exploitation of Exchange RCE CVE-2021-42321
  T1003.002_possible-impacket-secretdump-remote-activity.yml  [T1003.002,T1003.003,T1003.004]  Possible Impacket SecretDump Remote Activity
  T1003.002_possible-impacket-secretdump-remote-activity-zeek.yml  [T1003.002,T1003.003,T1003.004]  Possible Impacket SecretDump Remote Activity - Zeek
  T1187_possible-petitpotam-coerce-authentication-attempt.yml  [T1187]  Possible PetitPotam Coerce Authentication Attempt
  T1574.011_possible-privilege-escalation-via-weak-service-permissions.yml  [T1574.011]  Possible Privilege Escalation via Weak Service Permissions
  T1556_possible-shadow-credentials-added.yml  [T1556]  Possible Shadow Credentials Added
  T1053_potential-actinium-persistence-activity.yml  [T1053,T1053.005]  Potential ACTINIUM Persistence Activity
  T1685_potential-amsi-bypass-via-net-reflection.yml  [T1685]  Potential AMSI Bypass Via .NET Reflection
  T1685_potential-amsi-com-server-hijacking.yml  [T1685]  Potential AMSI COM Server Hijacking
  T1059.001_potential-apt-fin7-powerhold-execution.yml  [T1059.001]  Potential APT FIN7 POWERHOLD Execution
  potential-apt-fin7-reconnaissance-powertrash-related-activit.yml  []  Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity
  potential-apt-fin7-related-powershell-script-created.yml  []  Potential APT FIN7 Related PowerShell Script Created
  potential-apt-mustang-panda-activity-against-australian-gov.yml  []  Potential APT Mustang Panda Activity Against Australian Gov
  T1059.005_potential-apt10-cloud-hopper-activity.yml  [T1059.005]  Potential APT10 Cloud Hopper Activity
  T1003.001_potential-adplus-exe-abuse.yml  [T1003.001]  Potential Adplus.EXE Abuse
  T1127_potential-arbitrary-code-execution-via-node-exe.yml  [T1127]  Potential Arbitrary Code Execution Via Node.EXE
  T1202_potential-arbitrary-command-execution-using-msdt-exe.yml  [T1202]  Potential Arbitrary Command Execution Using Msdt.EXE
  T1202_potential-arbitrary-file-download-using-office-application.yml  [T1202]  Potential Arbitrary File Download Using Office Application
  T1059_potential-atlassian-confluence-cve-2021-26084-exploitation-a.yml  [T1059,T1190]  Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt
  potential-attachment-manager-settings-associations-tamper.yml  []  Potential Attachment Manager Settings Associations Tamper
  potential-attachment-manager-settings-attachments-tamper.yml  []  Potential Attachment Manager Settings Attachments Tamper
  T1685.001_potential-autologger-sessions-tampering.yml  [T1685.001]  Potential AutoLogger Sessions Tampering
  T1012_potential-baby-shark-malware-activity.yml  [T1012,T1059.001,T1059.003,T1218.005]  Potential Baby Shark Malware Activity
  T1140_potential-base64-decoded-from-images.yml  [T1140]  Potential Base64 Decoded From Images
  T1053.005_potential-bearlpe-exploitation.yml  [T1053.005]  Potential BearLPE Exploitation
  T1059.001_potential-blackbyte-ransomware-activity.yml  [T1059.001,T1140,T1485,T1498]  Potential BlackByte Ransomware Activity
  T1059.001_potential-bumblebee-remote-thread-creation.yml  [T1059.001,T1218.011]  Potential Bumblebee Remote Thread Creation
  potential-coldsteel-persistence-service-dll-creation.yml  []  Potential COLDSTEEL Persistence Service DLL Creation
  potential-coldsteel-persistence-service-dll-load.yml  []  Potential COLDSTEEL Persistence Service DLL Load
  potential-coldsteel-rat-file-indicators.yml  []  Potential COLDSTEEL RAT File Indicators
  potential-coldsteel-rat-windows-user-creation.yml  []  Potential COLDSTEEL RAT Windows User Creation
  T1219.002_potential-csharp-streamer-rat-loading-net-executable-image.yml  [T1219.002]  Potential CSharp Streamer RAT Loading .NET Executable Image
  T1190_potential-cve-2021-26084-exploitation-attempt.yml  [T1190]  Potential CVE-2021-26084 Exploitation Attempt
  T1203_potential-cve-2021-26857-exploitation-attempt.yml  [T1203]  Potential CVE-2021-26857 Exploitation Attempt
  T1059_potential-cve-2021-40444-exploitation-attempt.yml  [T1059]  Potential CVE-2021-40444 Exploitation Attempt
  T1190_potential-cve-2021-44228-exploitation-attempt-vmware-horizon.yml  [T1190]  Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon
  T1190_potential-cve-2022-21587-exploitation-attempt.yml  [T1190]  Potential CVE-2022-21587 Exploitation Attempt
  T1190_potential-cve-2022-26809-exploitation-attempt.yml  [T1190,T1569.002]  Potential CVE-2022-26809 Exploitation Attempt
  potential-cve-2022-29072-exploitation-attempt.yml  []  Potential CVE-2022-29072 Exploitation Attempt
  T1190_potential-cve-2022-46169-exploitation-attempt.yml  [T1190]  Potential CVE-2022-46169 Exploitation Attempt
  potential-cve-2023-21554-queuejumper-exploitation.yml  []  Potential CVE-2023-21554 QueueJumper Exploitation
  T1190_potential-cve-2023-23752-exploitation-attempt.yml  [T1190]  Potential CVE-2023-23752 Exploitation Attempt
  potential-cve-2023-25157-exploitation-attempt.yml  []  Potential CVE-2023-25157 Exploitation Attempt
  T1190_potential-cve-2023-25717-exploitation-attempt.yml  [T1190]  Potential CVE-2023-25717 Exploitation Attempt
  T1505.001_potential-cve-2023-27363-exploitation-hta-file-creation-by-f.yml  [T1505.001]  Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader
  potential-cve-2023-36874-exploitation-fake-wermgr-execution.yml  []  Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
  potential-cve-2023-36874-exploitation-fake-wermgr-exe-creati.yml  []  Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
  potential-cve-2023-36884-exploitation-share-access.yml  []  Potential CVE-2023-36884 Exploitation - Share Access
  potential-cve-2023-36884-exploitation-url-marker.yml  []  Potential CVE-2023-36884 Exploitation - URL Marker
  potential-cve-2024-3400-exploitation-palo-alto-globalprotect.yml  []  Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection
  T1187_potential-cve-2026-33829-exploitation-windows-snipping-tool.yml  [T1187]  Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI
  potential-cve-2303-36884-url-request-pattern-traffic.yml  []  Potential CVE-2303-36884 URL Request Pattern Traffic
  T1190_potential-centos-web-panel-exploitation-attempt-cve-2022-448.yml  [T1190]  Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877
  T1204.001_potential-clickfix-execution-pattern-registry.yml  [T1204.001]  Potential ClickFix Execution Pattern - Registry
  T1059_potential-cobaltstrike-process-patterns.yml  [T1059]  Potential CobaltStrike Process Patterns
  T1021.002_potential-cobaltstrike-service-installations-registry.yml  [T1021.002,T1543.003,T1569.002]  Potential CobaltStrike Service Installations - Registry
  T1027_potential-commandline-obfuscation-using-unicode-characters-f.yml  [T1027]  Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
  T1059.003_potential-commandline-path-traversal-via-cmd-exe.yml  [T1059.003]  Potential CommandLine Path Traversal Via Cmd.EXE
  potential-compromised-3cxdesktopapp-beaconing-activity-dns.yml  []  Potential Compromised 3CXDesktopApp Beaconing Activity - DNS
  potential-compromised-3cxdesktopapp-beaconing-activity-netco.yml  []  Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon
  potential-compromised-3cxdesktopapp-beaconing-activity-proxy.yml  []  Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy
  T1218_potential-compromised-3cxdesktopapp-execution.yml  [T1218]  Potential Compromised 3CXDesktopApp Execution
  potential-compromised-3cxdesktopapp-ico-c2-file-download.yml  []  Potential Compromised 3CXDesktopApp ICO C2 File Download
  T1218_potential-compromised-3cxdesktopapp-update-activity.yml  [T1218]  Potential Compromised 3CXDesktopApp Update Activity
  T1005_potential-conti-ransomware-database-dumping-activity-via-sql.yml  [T1005]  Potential Conti Ransomware Database Dumping Activity Via SQLCmd
  T1003_potential-credential-dumping-attempt-using-new-networkprovid.yml  [T1003]  Potential Credential Dumping Attempt Using New NetworkProvider - CLI
  T1003.001_potential-credential-dumping-attempt-via-powershell-remote-t.yml  [T1003.001]  Potential Credential Dumping Attempt Via PowerShell Remote Thread
  T1003.001_potential-credential-dumping-via-wer.yml  [T1003.001]  Potential Credential Dumping Via WER
  T1496_potential-crypto-mining-activity.yml  [T1496]  Potential Crypto Mining Activity
  T1574.001_potential-dll-sideloading-of-keyscramblerie-dll-via-keyscram.yml  [T1574.001]  Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
  T1574.001_potential-dll-sideloading-of-non-existent-dlls-from-system-f.yml  [T1574.001]  Potential DLL Sideloading Of Non-Existent DLLs From System Folders
  T1574.001_potential-dll-sideloading-via-vmware-xfer.yml  [T1574.001]  Potential DLL Sideloading Via VMware Xfer
  T1574.001_potential-dll-sideloading-via-comctl32-dll.yml  [T1574.001]  Potential DLL Sideloading Via comctl32.dll
  T1059.001_potential-data-exfiltration-activity-via-commandline-tools.yml  [T1059.001]  Potential Data Exfiltration Activity Via CommandLine Tools
  T1185_potential-data-stealing-via-chromium-headless-debugging.yml  [T1185,T1564.003]  Potential Data Stealing Via Chromium Headless Debugging
  potential-defense-evasion-activity-via-emoji-usage-in-comman.yml  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
  potential-defense-evasion-activity-via-emoji-usage-in-comman_2.yml  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2
  potential-defense-evasion-activity-via-emoji-usage-in-comman_3.yml  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
  potential-defense-evasion-activity-via-emoji-usage-in-comman_4.yml  []  Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4
  T1036.003_potential-defense-evasion-via-rename-of-highly-relevant-bina.yml  [T1036.003]  Potential Defense Evasion Via Rename Of Highly Relevant Binaries
  T1036.002_potential-defense-evasion-via-right-to-left-override.yml  [T1036.002]  Potential Defense Evasion Via Right-to-Left Override
  T1218_potential-devil-bait-malware-reconnaissance.yml  [T1218]  Potential Devil Bait Malware Reconnaissance
  potential-devil-bait-related-indicator.yml  []  Potential Devil Bait Related Indicator
  T1574.001_potential-eacore-dll-sideloading.yml  [T1574.001]  Potential EACore.DLL Sideloading
  T1574.001_potential-edputil-dll-sideloading.yml  [T1574.001]  Potential Edputil.DLL Sideloading
  T1027_potential-emotet-activity.yml  [T1027,T1059.001]  Potential Emotet Activity
  T1218.010_potential-empiremonkey-activity.yml  [T1218.010]  Potential EmpireMonkey Activity
  T1685.001_potential-eventlog-file-location-tampering.yml  [T1685.001]  Potential EventLog File Location Tampering
  T1021.003_potential-excel-exe-dcom-lateral-movement-via-activatemicros.yml  [T1021.003]  Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
  potential-exploitation-attempt-from-office-application.yml  []  Potential Exploitation Attempt From Office Application
  T1190_potential-exploitation-attempt-of-undocumented-windowsserver.yml  [T1190]  Potential Exploitation Attempt Of Undocumented WindowsServer RCE
  potential-exploitation-of-cve-2024-3094-suspicious-ssh-child.yml  []  Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process
  potential-exploitation-of-cve-2024-37085-suspicious-creation.yml  []  Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group
  potential-exploitation-of-cve-2024-37085-suspicious-esx-admi.yml  []  Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity
  T1190_potential-exploitation-of-cve-2025-4427-4428-ivanti-epmm-pre.yml  [T1190,T1203]  Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE
  T1059.001_potential-exploitation-of-crushftp-rce-vulnerability-cve-202.yml  [T1059.001,T1059.003,T1068,T1190]  Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
  T1059.001_potential-exploitation-of-goanywhere-mft-vulnerability.yml  [T1059.001,T1133,T1190]  Potential Exploitation of GoAnywhere MFT Vulnerability
  T1105_potential-exploitation-of-rce-vulnerability-cve-2025-33053.yml  [T1105,T1218]  Potential Exploitation of RCE Vulnerability CVE-2025-33053
  T1105_potential-exploitation-of-rce-vulnerability-cve-2025-33053-i.yml  [T1105,T1218]  Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load
  T1105_potential-exploitation-of-rce-vulnerability-cve-2025-33053-p.yml  [T1105,T1218]  Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access
  T1036.002_potential-file-extension-spoofing-using-right-to-left-overri.yml  [T1036.002]  Potential File Extension Spoofing Using Right-to-Left Override
  T1485_potential-file-overwrite-via-sysinternals-sdelete.yml  [T1485]  Potential File Overwrite Via Sysinternals SDelete
  T1082_potential-gobrat-file-discovery-via-grep.yml  [T1082]  Potential GobRAT File Discovery Via Grep
  potential-goofy-guineapig-backdoor-activity.yml  []  Potential Goofy Guineapig Backdoor Activity
  potential-goofy-guineapig-goolgeupdate-process-anomaly.yml  []  Potential Goofy Guineapig GoolgeUpdate Process Anomaly
  T1190_potential-information-disclosure-cve-2023-43261-exploitation.yml  [T1190]  Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy
  T1190_potential-information-disclosure-cve-2023-43261-exploitation_2.yml  [T1190]  Potential Information Disclosure CVE-2023-43261 Exploitation - Web
  T1003_potential-invoke-mimikatz-powershell-script.yml  [T1003]  Potential Invoke-Mimikatz PowerShell Script
  T1574.001_potential-iviewers-dll-sideloading.yml  [T1574.001]  Potential Iviewers.DLL Sideloading
  T1574.001_potential-jli-dll-side-loading.yml  [T1574.001]  Potential JLI.dll Side-Loading
  T1190_potential-jndi-injection-exploitation-in-jvm-based-applicati.yml  [T1190]  Potential JNDI Injection Exploitation In JVM Based Application
  T1505.003_potential-java-webshell-upload-in-sap-netviewer-server.yml  [T1505.003]  Potential Java WebShell Upload in SAP NetViewer Server
  potential-kdc-rc4-hmac-downgrade-exploit-cve-2022-37966.yml  []  Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966
  T1547.001_potential-kamikakabot-activity-winlogon-shell-persistence.yml  [T1547.001]  Potential KamiKakaBot Activity - Winlogon Shell Persistence
  potential-kapeka-decrypted-backdoor-indicator.yml  []  Potential Kapeka Decrypted Backdoor Indicator
  T1685_potential-ke3chang-tidepool-malware-activity.yml  [T1685]  Potential Ke3chang/TidePool Malware Activity
  T1557.003_potential-kerberos-coercion-by-spoofing-spns-via-dns-manipul.yml  [T1557.003]  Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
  T1003.001_potential-lsass-process-dump-via-procdump.yml  [T1003.001,T1036]  Potential LSASS Process Dump Via Procdump
  T1218.005_potential-lethalhta-technique-execution.yml  [T1218.005]  Potential LethalHTA Technique Execution
  T1190_potential-local-file-read-vulnerability-in-jvm-based-applica.yml  [T1190]  Potential Local File Read Vulnerability In JVM Based Application
  T1078.004_potential-mfa-bypass-using-legacy-client-authentication.yml  [T1078.004,T1110]  Potential MFA Bypass Using Legacy Client Authentication
  T1190_potential-moveit-transfer-cve-2023-34362-exploitation-file-a.yml  [T1190]  Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity
  T1563.002_potential-mstsc-shadowing-activity.yml  [T1563.002]  Potential MSTSC Shadowing Activity
  T1566_potential-malicious-usage-of-cloudtrail-system-manager.yml  [T1566,T1566.002]  Potential Malicious Usage of CloudTrail System Manager
  T1216_potential-manage-bde-wsf-abuse-to-proxy-execution.yml  [T1216]  Potential Manage-bde.wsf Abuse To Proxy Execution
  T1134.001_potential-meterpreter-cobaltstrike-activity.yml  [T1134.001,T1134.002]  Potential Meterpreter/CobaltStrike Activity
  T1574.001_potential-mpclient-dll-sideloading.yml  [T1574.001]  Potential Mpclient.DLL Sideloading
  T1574.001_potential-mpclient-dll-sideloading-via-defender-binaries.yml  [T1574.001]  Potential Mpclient.DLL Sideloading Via Defender Binaries
  T1036.005_potential-msiexec-masquerading.yml  [T1036.005]  Potential MsiExec Masquerading
  potential-muddywater-apt-activity.yml  []  Potential MuddyWater APT Activity
  T1218_potential-ntlm-coercion-via-certutil-exe.yml  [T1218]  Potential NTLM Coercion Via Certutil.EXE
  T1112_potential-netwire-rat-activity-registry.yml  [T1112]  Potential NetWire RAT Activity - Registry
  T1059_potential-netcat-reverse-shell-execution.yml  [T1059]  Potential Netcat Reverse Shell Execution
  T1068_potential-nimbuspwn-exploit-cve-2022-29799-and-cve-2022-2780.yml  [T1068]  Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800
  T1574.008_potential-notepad-cve-2025-49144-exploitation.yml  [T1574.008]  Potential Notepad++ CVE-2025-49144 Exploitation
  T1190_potential-ognl-injection-exploitation-in-jvm-based-applicati.yml  [T1190]  Potential OGNL Injection Exploitation In JVM Based Application
  T1190_potential-owassrf-exploitation-attempt-proxy.yml  [T1190]  Potential OWASSRF Exploitation Attempt - Proxy
  T1190_potential-owassrf-exploitation-attempt-webserver.yml  [T1190]  Potential OWASSRF Exploitation Attempt - Webserver
  T1552_potential-okta-password-in-alternateid-field.yml  [T1552]  Potential Okta Password in AlternateID Field
  potential-operation-triangulation-c2-beaconing-activity-dns.yml  []  Potential Operation Triangulation C2 Beaconing Activity - DNS
  potential-operation-triangulation-c2-beaconing-activity-prox.yml  []  Potential Operation Triangulation C2 Beaconing Activity - Proxy
  potential-php-reverse-shell.yml  []  Potential PHP Reverse Shell
  T1059.001_potential-powertrash-script-execution.yml  [T1059.001]  Potential POWERTRASH Script Execution
  T1546.015_potential-psfactorybuffer-com-hijacking.yml  [T1546.015]  Potential PSFactoryBuffer COM Hijacking
  potential-perl-reverse-shell-execution.yml  []  Potential Perl Reverse Shell Execution
  T1546.012_potential-persistence-via-app-paths-default-property.yml  [T1546.012]  Potential Persistence Via App Paths Default Property
  potential-persistence-via-autodialdll.yml  []  Potential Persistence Via AutodialDLL
  potential-persistence-via-chm-helper-dll.yml  []  Potential Persistence Via CHM Helper DLL
  potential-persistence-via-dllpathoverride.yml  []  Potential Persistence Via DLLPathOverride
  T1137.006_potential-persistence-via-excel-add-in-registry.yml  [T1137.006]  Potential Persistence Via Excel Add-in - Registry
  T1546.012_potential-persistence-via-globalflags.yml  [T1546.012]  Potential Persistence Via GlobalFlags
  potential-persistence-via-lsa-extensions.yml  []  Potential Persistence Via LSA Extensions
  T1037.001_potential-persistence-via-logon-scripts-commandline.yml  [T1037.001]  Potential Persistence Via Logon Scripts - CommandLine
  T1137.006_potential-persistence-via-microsoft-office-add-in.yml  [T1137.006]  Potential Persistence Via Microsoft Office Add-In
  T1137_potential-persistence-via-microsoft-office-startup-folder.yml  [T1137]  Potential Persistence Via Microsoft Office Startup Folder
  potential-persistence-via-mpnotify.yml  []  Potential Persistence Via Mpnotify
  potential-persistence-via-mycomputer-registry-keys.yml  []  Potential Persistence Via MyComputer Registry Keys
  T1137.003_potential-persistence-via-outlook-form.yml  [T1137.003]  Potential Persistence Via Outlook Form
  T1112_potential-persistence-via-outlook-home-page.yml  [T1112]  Potential Persistence Via Outlook Home Page
  T1008_potential-persistence-via-outlook-loadmacroprovideronboot-se.yml  [T1008,T1137,T1546]  Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
  T1112_potential-persistence-via-outlook-today-page.yml  [T1112]  Potential Persistence Via Outlook Today Page
  T1543.001_potential-persistence-via-plistbuddy.yml  [T1543.001,T1543.004]  Potential Persistence Via PlistBuddy
  T1053.005_potential-persistence-via-powershell-search-order-hijacking.yml  [T1053.005,T1059.001]  Potential Persistence Via Powershell Search Order Hijacking - Task
  potential-persistence-via-security-descriptors-scriptblock.yml  []  Potential Persistence Via Security Descriptors - ScriptBlock
  T1546.011_potential-persistence-via-shim-database-in-uncommon-location.yml  [T1546.011]  Potential Persistence Via Shim Database In Uncommon Location
  potential-persistence-via-typedpaths.yml  []  Potential Persistence Via TypedPaths
  T1573_potential-pikabot-c2-activity.yml  [T1573]  Potential Pikabot C2 Activity
  T1016_potential-pikabot-discovery-activity.yml  [T1016,T1049,T1087]  Potential Pikabot Discovery Activity
  T1055.012_potential-pikabot-hollowing-activity.yml  [T1055.012]  Potential Pikabot Hollowing Activity
  T1574.001_potential-plugx-activity.yml  [T1574.001]  Potential PlugX Activity
  T1027_potential-powershell-command-line-obfuscation.yml  [T1027,T1059.001]  Potential PowerShell Command Line Obfuscation
  potential-powershell-execution-policy-tampering-proccreation.yml  []  Potential PowerShell Execution Policy Tampering - ProcCreation
  T1218.011_potential-powershell-execution-via-dll.yml  [T1218.011]  Potential PowerShell Execution Via DLL
  T1027_potential-powershell-obfuscation-via-reversed-commands.yml  [T1027,T1059.001]  Potential PowerShell Obfuscation Via Reversed Commands
  T1027_potential-powershell-obfuscation-via-wchar-char.yml  [T1027,T1059.001]  Potential PowerShell Obfuscation Via WCHAR/CHAR
  T1059.001_potential-powershell-reverseshell-connection.yml  [T1059.001]  Potential Powershell ReverseShell Connection
  T1574_potential-printnightmare-exploitation-attempt.yml  [T1574]  Potential PrintNightmare Exploitation Attempt
  potential-privilege-escalation-attempt-via-exe-local-techniq.yml  []  Potential Privilege Escalation Attempt Via .Exe.Local Technique
  T1587.001_potential-privilege-escalation-to-local-system.yml  [T1587.001]  Potential Privilege Escalation To LOCAL SYSTEM
  T1546.008_potential-privilege-escalation-using-symlink-between-osk-and.yml  [T1546.008]  Potential Privilege Escalation Using Symlink Between Osk and Cmd
  T1548_potential-privilege-escalation-via-local-kerberos-relay-over.yml  [T1548]  Potential Privilege Escalation via Local Kerberos Relay over LDAP
  T1574.011_potential-privilege-escalation-via-service-permissions-weakn.yml  [T1574.011]  Potential Privilege Escalation via Service Permissions Weakness
  T1055_potential-process-injection-via-msra-exe.yml  [T1055]  Potential Process Injection Via Msra.EXE
  T1218_potential-provisioning-registry-key-abuse-for-binary-proxy-e.yml  [T1218]  Potential Provisioning Registry Key Abuse For Binary Proxy Execution
  T1218_potential-provisioning-registry-key-abuse-for-binary-proxy-e_2.yml  [T1218]  Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
  T1587.001_potential-psexec-remote-execution.yml  [T1587.001]  Potential PsExec Remote Execution
  T1112_potential-qakbot-registry-activity.yml  [T1112]  Potential Qakbot Registry Activity
  potential-qakbot-rundll32-execution.yml  []  Potential Qakbot Rundll32 Execution
  T1190_potential-rce-exploitation-attempt-in-nodejs.yml  [T1190]  Potential RCE Exploitation Attempt In NodeJS
  T1572_potential-rdp-tunneling-via-plink.yml  [T1572]  Potential RDP Tunneling Via Plink
  T1572_potential-rdp-tunneling-via-ssh.yml  [T1572]  Potential RDP Tunneling Via SSH
  T1491.001_potential-ransomware-activity-using-legalnotice-message.yml  [T1491.001]  Potential Ransomware Activity Using LegalNotice Message
  T1574.001_potential-raspberry-robin-aclui-dll-sideloading.yml  [T1574.001]  Potential Raspberry Robin Aclui Dll SideLoading
  T1218.011_potential-raspberry-robin-cpl-execution-activity.yml  [T1218.011]  Potential Raspberry Robin CPL Execution Activity
  potential-raspberry-robin-dot-ending-file.yml  []  Potential Raspberry Robin Dot Ending File
  T1574.001_potential-rcdll-dll-sideloading.yml  [T1574.001]  Potential Rcdll.DLL Sideloading
  potential-recon-activity-using-driverquery-exe.yml  []  Potential Recon Activity Using DriverQuery.EXE
  T1003.005_potential-reconnaissance-for-cached-credentials-via-cmdkey-e.yml  [T1003.005]  Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
  T1053.005_potential-registry-persistence-attempt-via-windows-telemetry.yml  [T1053.005]  Potential Registry Persistence Attempt Via Windows Telemetry
  T1021.006_potential-remote-powershell-session-initiated.yml  [T1021.006,T1059.001]  Potential Remote PowerShell Session Initiated
  T1047_potential-remote-squiblytwo-technique-execution.yml  [T1047,T1059.005,T1059.007,T1220]  Potential Remote SquiblyTwo Technique Execution
  T1218_potential-remotefxvgpudisablement-exe-abuse.yml  [T1218]  Potential RemoteFXvGPUDisablement.EXE Abuse
  T1218_potential-remotefxvgpudisablement-exe-abuse-powershell-modul.yml  [T1218]  Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module
  T1218_potential-remotefxvgpudisablement-exe-abuse-powershell-scrip.yml  [T1218]  Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock
  potential-renamed-rundll32-execution.yml  []  Potential Renamed Rundll32 Execution
  T1547_potential-ripzip-attack-on-startup-folder.yml  [T1547]  Potential RipZip Attack on Startup Folder
  T1574.001_potential-rjvplatform-dll-sideloading-from-non-default-locat.yml  [T1574.001]  Potential RjvPlatform.DLL Sideloading From Non-Default Location
  T1564.004_potential-rundll32-execution-with-dll-stored-in-ads.yml  [T1564.004]  Potential Rundll32 Execution With DLL Stored In ADS
  T1547.001_potential-ryuk-ransomware-activity.yml  [T1547.001]  Potential Ryuk Ransomware Activity
  T1003.002_potential-sam-database-dump.yml  [T1003.002]  Potential SAM Database Dump
  T1190_potential-sap-netviewer-webshell-command-execution.yml  [T1190,T1505.003]  Potential SAP NetViewer Webshell Command Execution
  potential-snake-malware-installation-binary-indicator.yml  []  Potential SNAKE Malware Installation Binary Indicator
  potential-snake-malware-installation-cli-arguments-indicator.yml  []  Potential SNAKE Malware Installation CLI Arguments Indicator
  potential-snake-malware-persistence-service-execution.yml  []  Potential SNAKE Malware Persistence Service Execution
  T1053.005_potential-ssh-tunnel-persistence-install-using-a-scheduled-t.yml  [T1053.005]  Potential SSH Tunnel Persistence Install Using A Scheduled Task
  T1190_potential-server-side-template-injection-in-velocity.yml  [T1190]  Potential Server Side Template Injection In Velocity
  T1190_potential-sharepoint-toolshell-cve-2025-53770-exploitation-i.yml  [T1190]  Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators
  potential-signing-bypass-via-windows-developer-features.yml  []  Potential Signing Bypass Via Windows Developer Features
  potential-signing-bypass-via-windows-developer-features-regi.yml  []  Potential Signing Bypass Via Windows Developer Features - Registry
  T1574.001_potential-smadhook-dll-sideloading.yml  [T1574.001]  Potential SmadHook.DLL Sideloading
  T1204_potential-snatch-ransomware-activity.yml  [T1204]  Potential Snatch Ransomware Activity
  T1219.002_potential-socgholish-second-stage-c2-dns-query.yml  [T1219.002]  Potential SocGholish Second Stage C2 DNS Query
  T1190_potential-spel-injection-in-spring-framework.yml  [T1190]  Potential SpEL Injection In Spring Framework
  T1547.001_potential-startup-shortcut-persistence-via-powershell-exe.yml  [T1547.001]  Potential Startup Shortcut Persistence Via PowerShell.EXE
  potential-suspicious-bpf-activity-linux.yml  []  Potential Suspicious BPF Activity - Linux
  T1218_potential-suspicious-child-process-of-3cxdesktopapp.yml  [T1218]  Potential Suspicious Child Process Of 3CXDesktopApp
  T1218_potential-suspicious-mofcomp-execution.yml  [T1218]  Potential Suspicious Mofcomp Execution
  potential-suspicious-winget-package-installation.yml  []  Potential Suspicious Winget Package Installation
  T1003.001_potential-sysinternals-procdump-evasion.yml  [T1003.001,T1036]  Potential SysInternals ProcDump Evasion
  T1574.001_potential-system-dll-sideloading-from-non-system-locations.yml  [T1574.001]  Potential System DLL Sideloading From Non System Locations
  T1021.001_potential-tampering-with-rdp-related-registry-keys-via-reg-e.yml  [T1021.001,T1112]  Potential Tampering With RDP Related Registry Keys Via Reg.EXE
  T1685_potential-tampering-with-security-products-via-wmic.yml  [T1685]  Potential Tampering With Security Products Via WMIC
  T1112_potential-ursnif-malware-activity-registry.yml  [T1112]  Potential Ursnif Malware Activity - Registry
  T1574.001_potential-vcruntime140-dll-sideloading.yml  [T1574.001]  Potential Vcruntime140 DLL Sideloading
  T1574.001_potential-waveedit-dll-sideloading.yml  [T1574.001]  Potential Waveedit.DLL Sideloading
  T1036.003_potential-werfault-reflectdebugger-registry-value-abuse.yml  [T1036.003]  Potential WerFault ReflectDebugger Registry Value Abuse
  T1106_potential-winapi-calls-via-commandline.yml  [T1106]  Potential WinAPI Calls Via CommandLine
  T1059.001_potential-winapi-calls-via-powershell-scripts.yml  [T1059.001,T1106]  Potential WinAPI Calls Via PowerShell Scripts
  T1003.001_potential-windows-defender-av-bypass-via-dump64-exe-rename.yml  [T1003.001]  Potential Windows Defender AV Bypass Via Dump64.EXE Rename
  T1047_potential-windows-defender-tampering-via-wmic-exe.yml  [T1047,T1685]  Potential Windows Defender Tampering Via Wmic.EXE
  T1027_potential-winnti-dropper-activity.yml  [T1027]  Potential Winnti Dropper Activity
  potential-wizardupdate-malware-infection.yml  []  Potential WizardUpdate Malware Infection
  T1190_potential-xxe-exploitation-attempt-in-jvm-based-application.yml  [T1190]  Potential XXE Exploitation Attempt In JVM Based Application
  T1068_potential-zerologon-cve-2020-1472-exploitation.yml  [T1068]  Potential Zerologon (CVE-2020-1472) Exploitation
  T1574.001_potential-appverifui-dll-sideloading.yml  [T1574.001]  Potential appverifUI.DLL Sideloading
  T1127_potentially-suspicious-asp-net-compilation-via-aspnetcompile.yml  [T1127]  Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
  potentially-suspicious-call-to-win32-nteventlogfile-class.yml  []  Potentially Suspicious Call To Win32_NTEventlogFile Class
  T1218.010_potentially-suspicious-child-process-of-regsvr32.yml  [T1218.010]  Potentially Suspicious Child Process Of Regsvr32
  T1202_potentially-suspicious-child-processes-spawned-by-conhost.yml  [T1202,T1218]  Potentially Suspicious Child Processes Spawned by ConHost
  T1059.001_potentially-suspicious-command-executed-via-run-dialog-box-r.yml  [T1059.001]  Potentially Suspicious Command Executed Via Run Dialog Box - Registry
  T1218.008_potentially-suspicious-dll-registered-via-odbcconf-exe.yml  [T1218.008]  Potentially Suspicious DLL Registered Via Odbcconf.EXE
  T1548.002_potentially-suspicious-event-viewer-child-process.yml  [T1548.002]  Potentially Suspicious Event Viewer Child Process
  T1059_potentially-suspicious-execution-from-parent-process-in-publ.yml  [T1059,T1564]  Potentially Suspicious Execution From Parent Process In Public Folder
  potentially-suspicious-file-download-from-file-sharing-domai.yml  []  Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
  potentially-suspicious-file-download-from-zip-tld.yml  []  Potentially Suspicious File Download From ZIP TLD
  potentially-suspicious-googleupdate-child-process.yml  []  Potentially Suspicious GoogleUpdate Child Process
  T1571_potentially-suspicious-malware-callback-communication.yml  [T1571]  Potentially Suspicious Malware Callback Communication
  T1571_potentially-suspicious-malware-callback-communication-linux.yml  [T1571]  Potentially Suspicious Malware Callback Communication - Linux
  T1003_potentially-suspicious-odbc-driver-registered.yml  [T1003]  Potentially Suspicious ODBC Driver Registered
  T1202_potentially-suspicious-office-document-executed-from-trusted.yml  [T1202]  Potentially Suspicious Office Document Executed From Trusted Location
  T1218.010_potentially-suspicious-regsvr32-http-ip-pattern.yml  [T1218.010]  Potentially Suspicious Regsvr32 HTTP IP Pattern
  T1059.001_powershell-adrecon-execution.yml  [T1059.001]  PowerShell ADRecon Execution
  T1059.001_powershell-base64-encoded-frombase64string-cmdlet.yml  [T1059.001,T1140]  PowerShell Base64 Encoded FromBase64String Cmdlet
  T1059.001_powershell-base64-encoded-iex-cmdlet.yml  [T1059.001]  PowerShell Base64 Encoded IEX Cmdlet
  T1027_powershell-base64-encoded-invoke-keyword.yml  [T1027,T1059.001]  PowerShell Base64 Encoded Invoke Keyword
  T1027_powershell-base64-encoded-reflective-assembly-load.yml  [T1027,T1059.001,T1620]  PowerShell Base64 Encoded Reflective Assembly Load
  T1027_powershell-base64-encoded-wmi-classes.yml  [T1027,T1059.001]  PowerShell Base64 Encoded WMI Classes
  T1059.001_powershell-called-from-an-executable-version-mismatch.yml  [T1059.001]  PowerShell Called from an Executable Version Mismatch
  T1059.001_powershell-credential-prompt.yml  [T1059.001]  PowerShell Credential Prompt
  T1685_powershell-defender-threat-severity-default-action-set-to-al.yml  [T1685]  PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'
  T1059_powershell-download-and-execution-cradles.yml  [T1059]  PowerShell Download and Execution Cradles
  powershell-execution-with-potential-decryption-capabilities.yml  []  PowerShell Execution With Potential Decryption Capabilities
  T1552.004_powershell-get-process-lsass.yml  [T1552.004]  PowerShell Get-Process LSASS
  T1003.001_powershell-get-process-lsass-in-scriptblock.yml  [T1003.001]  PowerShell Get-Process LSASS in ScriptBlock
  T1112_powershell-logging-disabled-via-registry-key-tampering.yml  [T1112,T1564.001]  PowerShell Logging Disabled Via Registry Key Tampering
  T1059.001_powershell-psattack.yml  [T1059.001]  PowerShell PSAttack
  T1003.002_powershell-sam-copy.yml  [T1003.002]  PowerShell SAM Copy
  powershell-script-change-permission-via-set-acl.yml  []  PowerShell Script Change Permission Via Set-Acl
  T1569.002_powershell-scripts-installed-as-services.yml  [T1569.002]  PowerShell Scripts Installed as Services
  T1569.002_powershell-scripts-installed-as-services-security.yml  [T1569.002]  PowerShell Scripts Installed as Services - Security
  powershell-set-acl-on-windows-folder.yml  []  PowerShell Set-Acl On Windows Folder
  T1222_powershell-set-acl-on-windows-folder-psscript.yml  [T1222]  PowerShell Set-Acl On Windows Folder - PsScript
  T1055_powershell-shellcode.yml  [T1055,T1059.001]  PowerShell ShellCode
  T1548.002_powershell-web-access-feature-enabled-via-dism.yml  [T1548.002]  PowerShell Web Access Feature Enabled Via DISM
  T1059.001_powershell-web-access-installation-psscript.yml  [T1059.001]  PowerShell Web Access Installation - PsScript
  T1569.002_powershell-as-a-service-in-registry.yml  [T1569.002]  PowerShell as a Service in Registry
  T1059.001_powerview-powershell-cmdlets-scriptblock.yml  [T1059.001]  PowerView PowerShell Cmdlets - ScriptBlock
  T1565_powershell-add-name-resolution-policy-table-rule.yml  [T1565]  Powershell Add Name Resolution Policy Table Rule
  T1685_powershell-base64-encoded-mppreference-cmdlet.yml  [T1685]  Powershell Base64 Encoded MpPreference Cmdlet
  T1048_powershell-dnsexfiltration.yml  [T1048]  Powershell DNSExfiltration
  T1685_powershell-defender-disable-scan-feature.yml  [T1685]  Powershell Defender Disable Scan Feature
  T1556.002_powershell-install-a-dll-in-system-directory.yml  [T1556.002]  Powershell Install a DLL in System Directory
  T1027.009_powershell-token-obfuscation-process-creation.yml  [T1027.009]  Powershell Token Obfuscation - Process Creation
  T1098_powerview-add-domainobjectacl-dcsync-ad-extend-right.yml  [T1098]  Powerview Add-DomainObjectAcl DCSync AD Extend Right
  T1070.004_prefetch-file-deleted.yml  [T1070.004]  Prefetch File Deleted
  T1528_primary-refresh-token-access-attempt.yml  [T1528]  Primary Refresh Token Access Attempt
  T1105_printbrm-zip-creation-of-extraction.yml  [T1105,T1564.004]  PrintBrm ZIP Creation of Extraction
  T1021_privilege-escalation-via-named-pipe-impersonation.yml  [T1021]  Privilege Escalation via Named Pipe Impersonation
  T1078_privilege-role-elevation-not-occuring-on-saw-or-paw.yml  [T1078]  Privilege Role Elevation Not Occuring on SAW or PAW
  T1078_privilege-role-sign-in-outside-expected-controls.yml  [T1078]  Privilege Role Sign-In Outside Expected Controls
  T1078_privilege-role-sign-in-outside-of-normal-hours.yml  [T1078]  Privilege Role Sign-In Outside Of Normal Hours
  T1098_privileged-user-has-been-created.yml  [T1098,T1136.001]  Privileged User Has Been Created
  T1003.001_process-access-via-trolleyexpress-exclusion.yml  [T1003.001,T1218.011]  Process Access via TrolleyExpress Exclusion
  T1190_process-execution-error-in-jvm-based-application.yml  [T1190]  Process Execution Error In JVM Based Application
  T1036_process-execution-from-a-potentially-suspicious-folder.yml  [T1036]  Process Execution From A Potentially Suspicious Folder
  T1068_process-explorer-driver-creation-by-non-sysinternals-binary.yml  [T1068]  Process Explorer Driver Creation By Non-Sysinternals Binary
  T1102_process-initiated-network-connection-to-ngrok-domain.yml  [T1102,T1567,T1572]  Process Initiated Network Connection To Ngrok Domain
  T1003.001_process-memory-dump-via-comsvcs-dll.yml  [T1003.001,T1036]  Process Memory Dump Via Comsvcs.DLL
  T1003.001_process-memory-dump-via-rdrleakdiag-exe.yml  [T1003.001]  Process Memory Dump via RdrLeakDiag.EXE
  T1543.003_processhacker-privilege-elevation.yml  [T1543.003,T1569.002]  ProcessHacker Privilege Elevation
  T1021.002_protected-storage-service-access.yml  [T1021.002]  Protected Storage Service Access
  T1218_proxy-execution-via-wuauclt-exe.yml  [T1218]  Proxy Execution Via Wuauclt.EXE
  T1036.003_ps-exe-renamed-sysinternals-tool.yml  [T1036.003]  Ps.exe Renamed SysInternals Tool
  psexec-service-child-process-execution-as-local-system.yml  []  PsExec Service Child Process Execution as LOCAL SYSTEM
  T1587.001_psexec-paexec-escalation-to-local-system.yml  [T1587.001]  PsExec/PAExec Escalation to LOCAL SYSTEM
  T1021.001_publicly-accessible-rdp-service.yml  [T1021.001]  Publicly Accessible RDP Service
  T1190_pulse-connect-secure-rce-attack-cve-2021-22893.yml  [T1190]  Pulse Connect Secure RCE Attack CVE-2021-22893
  T1548.001_pwnkit-local-privilege-escalation.yml  [T1548.001]  PwnKit Local Privilege Escalation
  T1685_python-function-execution-security-warning-disabled-in-excel.yml  [T1685]  Python Function Execution Security Warning Disabled In Excel
  T1685_python-function-execution-security-warning-disabled-in-excel_2.yml  [T1685]  Python Function Execution Security Warning Disabled In Excel - Registry
  T1027.010_python-one-liners-with-base64-decoding.yml  [T1027.010,T1059.006]  Python One-Liners with Base64 Decoding
  T1027.010_python-one-liners-with-base64-decoding-linux.yml  [T1027.010,T1059.006]  Python One-Liners with Base64 Decoding - Linux
  python-reverse-shell-execution-via-pty-and-socket-modules.yml  []  Python Reverse Shell Execution Via PTY And Socket Modules
  T1059_python-spawning-pretty-tty-on-windows.yml  [T1059]  Python Spawning Pretty TTY on Windows
  qakbot-regsvr32-calc-pattern.yml  []  Qakbot Regsvr32 Calc Pattern
  qakbot-uninstaller-execution.yml  []  Qakbot Uninstaller Execution
  T1090.003_query-tor-onion-address-dns-client.yml  [T1090.003]  Query Tor Onion Address - DNS Client
  T1686.003_rdp-connection-allowed-via-netsh-exe.yml  [T1686.003]  RDP Connection Allowed Via Netsh.EXE
  T1021.001_rdp-login-from-localhost.yml  [T1021.001]  RDP Login from Localhost
  T1021.001_rdp-over-reverse-ssh-tunnel.yml  [T1021.001,T1572]  RDP Over Reverse SSH Tunnel
  T1090_rdp-port-forwarding-rule-added-via-netsh-exe.yml  [T1090]  RDP Port Forwarding Rule Added Via Netsh.EXE
  T1112_rdp-sensitive-settings-changed.yml  [T1112]  RDP Sensitive Settings Changed
  T1021.001_rdp-over-reverse-ssh-tunnel-wfp.yml  [T1021.001,T1090.001,T1090.002]  RDP over Reverse SSH Tunnel WFP
  T1021.001_rdp-to-http-or-https-target-ports.yml  [T1021.001,T1572]  RDP to HTTP or HTTPS Target Ports
  rtcore-suspicious-service-installation.yml  []  RTCore Suspicious Service Installation
  T1685_raccine-uninstall.yml  [T1685]  Raccine Uninstall
  T1560.001_rar-usage-with-password-and-compression-level.yml  [T1560.001]  Rar Usage with Password and Compression Level
  T1055_rare-remote-thread-creation-by-uncommon-source-image.yml  [T1055]  Rare Remote Thread Creation By Uncommon Source Image
  T1059.001_raspberry-robin-initial-execution-from-external-drive.yml  [T1059.001]  Raspberry Robin Initial Execution From External Drive
  T1059.001_raspberry-robin-subsequent-execution-of-commands.yml  [T1059.001]  Raspberry Robin Subsequent Execution of Commands
  T1071.001_raw-paste-service-access.yml  [T1071.001,T1102.001,T1102.003]  Raw Paste Service Access
  recon-activity-via-sasec.yml  []  Recon Activity via SASec
  T1069.002_reconnaissance-activity.yml  [T1069.002,T1087.002]  Reconnaissance Activity
  T1112_redmimicry-winnti-playbook-registry-manipulation.yml  [T1112]  RedMimicry Winnti Playbook Registry Manipulation
  T1036.005_redsun-conhost-exe-spawned-by-tieringengineservice-exe.yml  [T1036.005,T1134.002]  RedSun - Conhost.exe Spawned by TieringEngineService.exe
  T1112_reg-add-suspicious-paths.yml  [T1112,T1685]  Reg Add Suspicious Paths
  T1548_regedit-as-trusted-installer.yml  [T1548]  Regedit as Trusted Installer
  T1558.003_register-new-logon-process-by-rubeus.yml  [T1558.003]  Register new Logon Process by Rubeus
  T1490_registry-disable-system-restore.yml  [T1490]  Registry Disable System Restore
  T1552.002_registry-export-of-third-party-credentials.yml  [T1552.002]  Registry Export of Third-Party Credentials
  T1112_registry-modification-for-oci-dll-redirection.yml  [T1112,T1574.001]  Registry Modification for OCI DLL Redirection
  T1547_registry-persistence-mechanisms-in-recycle-bin.yml  [T1547]  Registry Persistence Mechanisms in Recycle Bin
  T1547.001_registry-persistence-via-explorer-run-key.yml  [T1547.001]  Registry Persistence via Explorer Run Key
  T1564.001_registry-persistence-via-service-in-safe-mode.yml  [T1564.001]  Registry Persistence via Service in Safe Mode
  T1218.010_regsvr32-dll-execution-with-suspicious-file-extension.yml  [T1218.010]  Regsvr32 DLL Execution With Suspicious File Extension
  T1218.010_regsvr32-execution-from-highly-suspicious-location.yml  [T1218.010]  Regsvr32 Execution From Highly Suspicious Location
  T1190_rejetto-http-file-server-rce.yml  [T1190,T1505.003]  Rejetto HTTP File Server RCE
  T1588_relevant-anti-virus-signature-keywords-in-application-log.yml  [T1588]  Relevant Anti-Virus Signature Keywords In Application Log
  T1588.001_relevant-clamav-message.yml  [T1588.001]  Relevant ClamAV Message
  T1219.002_remote-access-tool-anydesk-silent-installation.yml  [T1219.002]  Remote Access Tool - AnyDesk Silent Installation
  T1219.002_remote-access-tool-anydesk-execution-from-suspicious-folder.yml  [T1219.002]  Remote Access Tool - Anydesk Execution From Suspicious Folder
  T1036.003_remote-access-tool-renamed-meshagent-execution-macos.yml  [T1036.003,T1219.002]  Remote Access Tool - Renamed MeshAgent Execution - MacOS
  T1036.003_remote-access-tool-renamed-meshagent-execution-windows.yml  [T1036.003,T1219.002]  Remote Access Tool - Renamed MeshAgent Execution - Windows
  T1190_remote-access-tool-screenconnect-server-web-shell-execution.yml  [T1190]  Remote Access Tool - ScreenConnect Server Web Shell Execution
  remote-appx-package-downloaded-from-file-sharing-or-cdn-doma.yml  []  Remote AppX Package Downloaded from File Sharing or CDN Domain
  T1218.001_remote-chm-file-download-execution-via-hh-exe.yml  [T1218.001]  Remote CHM File Download/Execution Via HH.EXE
  T1021.003_remote-dcom-wmi-lateral-movement.yml  [T1021.003,T1047]  Remote DCOM/WMI Lateral Movement
  remote-encrypting-file-system-abuse.yml  []  Remote Encrypting File System Abuse
  remote-event-log-recon.yml  []  Remote Event Log Recon
  T1003.001_remote-lsass-process-access-through-windows-remote-managemen.yml  [T1003.001,T1021.006,T1059.001]  Remote LSASS Process Access Through Windows Remote Management
  T1021.006_remote-powershell-session-ps-module.yml  [T1021.006,T1059.001]  Remote PowerShell Session (PS Module)
  T1059.001_remote-powershell-sessions-network-connections-winrm.yml  [T1059.001]  Remote PowerShell Sessions Network Connections (WinRM)
  remote-printing-abuse-for-lateral-movement.yml  []  Remote Printing Abuse for Lateral Movement
  T1112_remote-registry-lateral-movement.yml  [T1112]  Remote Registry Lateral Movement
  remote-registry-recon.yml  []  Remote Registry Recon
  T1053_remote-schedule-task-lateral-movement-via-atsvc.yml  [T1053,T1053.002]  Remote Schedule Task Lateral Movement via ATSvc
  T1053_remote-schedule-task-lateral-movement-via-itaskschedulerserv.yml  [T1053,T1053.002]  Remote Schedule Task Lateral Movement via ITaskSchedulerService
  T1053_remote-schedule-task-lateral-movement-via-sasec.yml  [T1053,T1053.002]  Remote Schedule Task Lateral Movement via SASec
  remote-schedule-task-recon-via-atscv.yml  []  Remote Schedule Task Recon via AtScv
  remote-schedule-task-recon-via-itaskschedulerservice.yml  []  Remote Schedule Task Recon via ITaskSchedulerService
  remote-server-service-abuse.yml  []  Remote Server Service Abuse
  T1569.002_remote-server-service-abuse-for-lateral-movement.yml  [T1569.002]  Remote Server Service Abuse for Lateral Movement
  T1555.005_remote-thread-created-in-keepass-exe.yml  [T1555.005]  Remote Thread Created In KeePass.EXE
  remote-thread-creation-in-mstsc-exe-from-suspicious-location.yml  []  Remote Thread Creation In Mstsc.Exe From Suspicious Location
  T1127_remote-thread-creation-ttdinject-exe-proxy.yml  [T1127]  Remote Thread Creation Ttdinject.exe Proxy
  T1220_remote-xsl-execution-via-msxsl-exe.yml  [T1220]  Remote XSL Execution Via Msxsl.EXE
  T1218_remotefxvgpudisablement-abuse-via-atomictestharnesses.yml  [T1218]  RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses
  T1218.005_remotely-hosted-hta-file-executed-via-mshta-exe.yml  [T1218.005]  Remotely Hosted HTA File Executed Via Mshta.EXE
  T1685_removal-of-amsi-provider-registry-keys.yml  [T1685]  Removal Of AMSI Provider Registry Keys
  T1070_remove-exported-mailbox-from-exchange-webserver.yml  [T1070]  Remove Exported Mailbox from Exchange Webserver
  T1018_renamed-adfind-execution.yml  [T1018,T1069.002,T1087.002,T1482]  Renamed AdFind Execution
  T1027_renamed-autoit-execution.yml  [T1027]  Renamed AutoIt Execution
  T1036.003_renamed-browsercore-exe-execution.yml  [T1036.003,T1528]  Renamed BrowserCore.EXE Execution
  T1090.001_renamed-cloudflared-exe-execution.yml  [T1090.001]  Renamed Cloudflared.EXE Execution
  T1003.001_renamed-createdump-utility-execution.yml  [T1003.001,T1036]  Renamed CreateDump Utility Execution
  T1486_renamed-gpg-exe-execution.yml  [T1486]  Renamed Gpg.EXE Execution
  T1036.003_renamed-jusched-exe-execution.yml  [T1036.003]  Renamed Jusched.EXE Execution
  T1055.001_renamed-mavinject-exe-execution.yml  [T1055.001,T1218.013]  Renamed Mavinject.EXE Execution
  T1218_renamed-megasync-execution.yml  [T1218]  Renamed MegaSync Execution
  T1036.003_renamed-msdt-exe-execution.yml  [T1036.003]  Renamed Msdt.EXE Execution
  renamed-netsupport-rat-execution.yml  []  Renamed NetSupport RAT Execution
  T1059_renamed-nircmd-exe-execution.yml  [T1059,T1202]  Renamed NirCmd.EXE Execution
  T1036.003_renamed-office-binary-execution.yml  [T1036.003]  Renamed Office Binary Execution
  T1202_renamed-paexec-execution.yml  [T1202]  Renamed PAExec Execution
  T1059_renamed-pingcastle-binary-execution.yml  [T1059,T1202]  Renamed PingCastle Binary Execution
  T1036_renamed-plink-execution.yml  [T1036]  Renamed Plink Execution
  T1036.003_renamed-procdump-execution.yml  [T1036.003]  Renamed ProcDump Execution
  renamed-psexec-service-execution.yml  []  Renamed PsExec Service Execution
  T1036.003_renamed-schtasks-execution.yml  [T1036.003,T1053.005]  Renamed Schtasks Execution
  T1588.002_renamed-sysinternals-debugview-execution.yml  [T1588.002]  Renamed SysInternals DebugView Execution
  T1485_renamed-sysinternals-sdelete-execution.yml  [T1485]  Renamed Sysinternals Sdelete Execution
  T1071.001_renamed-visual-studio-code-tunnel-execution.yml  [T1071.001,T1219]  Renamed Visual Studio Code Tunnel Execution
  T1574.001_renamed-vmnat-exe-execution.yml  [T1574.001]  Renamed Vmnat.exe Execution
  renamed-vscode-code-tunnel-execution-file-indicator.yml  []  Renamed VsCode Code Tunnel Execution - File Indicator
  T1036_renamed-zoho-dctask64-execution.yml  [T1036,T1055.001,T1202,T1218]  Renamed ZOHO Dctask64 Execution
  T1558_replay-attack-detected.yml  [T1558]  Replay Attack Detected
  T1020_restore-public-aws-rds-instance.yml  [T1020]  Restore Public AWS RDS Instance
  T1072_restricted-software-access-by-srp.yml  [T1072]  Restricted Software Access By SRP
  T1112_restrictedadminmode-registry-value-tampering.yml  [T1112]  RestrictedAdminMode Registry Value Tampering
  T1112_restrictedadminmode-registry-value-tampering-proccreation.yml  [T1112]  RestrictedAdminMode Registry Value Tampering - ProcCreation
  T1078_roles-activated-too-frequently.yml  [T1078]  Roles Activated Too Frequently
  T1078_roles-activation-doesn-t-require-mfa.yml  [T1078]  Roles Activation Doesn't Require MFA
  T1078_roles-are-not-being-used.yml  [T1078]  Roles Are Not Being Used
  T1078_roles-assigned-outside-pim.yml  [T1078]  Roles Assigned Outside PIM
  T1553.004_root-certificate-installed-from-susp-locations.yml  [T1553.004]  Root Certificate Installed From Susp Locations
  T1557.001_rottenpotato-like-attack-pattern.yml  [T1557.001]  RottenPotato Like Attack Pattern
  T1564.004_run-powershell-script-from-ads.yml  [T1564.004]  Run PowerShell Script from ADS
  T1059_run-powershell-script-from-redirected-input-stream.yml  [T1059]  Run PowerShell Script from Redirected Input Stream
  T1218.011_rundll32-spawning-explorer.yml  [T1218.011]  RunDLL32 Spawning Explorer
  T1070.003_runmru-registry-key-deletion.yml  [T1070.003]  RunMRU Registry Key Deletion
  T1070.003_runmru-registry-key-deletion-registry.yml  [T1070.003]  RunMRU Registry Key Deletion - Registry
  T1202_rundll32-execution-without-commandline-parameters.yml  [T1202]  Rundll32 Execution Without CommandLine Parameters
  T1021.002_rundll32-execution-without-parameters.yml  [T1021.002,T1569.002,T1570]  Rundll32 Execution Without Parameters
  T1546.015_rundll32-registered-com-objects.yml  [T1546.015]  Rundll32 Registered COM Objects
  T1021.002_rundll32-unc-path-execution.yml  [T1021.002,T1218.011]  Rundll32 UNC Path Execution
  T1133_running-chrome-vpn-extensions-via-the-registry-2-vpn-extensi.yml  [T1133]  Running Chrome VPN Extensions via the Registry 2 VPN Extension
  T1012_sam-registry-hive-handle-request.yml  [T1012,T1552.002]  SAM Registry Hive Handle Request
  T1606_saml-token-issuer-anomaly.yml  [T1606]  SAML Token Issuer Anomaly
  T1021.002_smb-create-remote-file-admin-share.yml  [T1021.002]  SMB Create Remote File Admin Share
  snake-malware-covert-store-registry-key.yml  []  SNAKE Malware Covert Store Registry Key
  snake-malware-werfault-persistence-file-creation.yml  []  SNAKE Malware WerFault Persistence File Creation
  T1546_sourgum-actor-behaviours.yml  [T1546,T1546.015]  SOURGUM Actor Behaviours
  T1190_sql-injection-strings-in-uri.yml  [T1190]  SQL Injection Strings In URI
  T1005_sqlite-chromium-profile-data-db-access.yml  [T1005,T1539,T1555.003]  SQLite Chromium Profile Data DB Access
  T1005_sqlite-firefox-profile-data-db-access.yml  [T1005,T1539]  SQLite Firefox Profile Data DB Access
  T1685_safeboot-registry-key-deleted-via-reg-exe.yml  [T1685]  SafeBoot Registry Key Deleted Via Reg.EXE
  T1210_scanner-poc-for-cve-2019-0708-rdp-rce-vuln.yml  [T1210]  Scanner PoC for CVE-2019-0708 RDP RCE Vuln
  T1036.004_scheduled-task-creation-masquerading-as-system-processes.yml  [T1036.004,T1036.005,T1053.005]  Scheduled Task Creation Masquerading as System Processes
  T1053.005_scheduled-task-executing-encoded-payload-from-registry.yml  [T1053.005,T1059.001]  Scheduled Task Executing Encoded Payload from Registry
  T1053_scheduled-taskcache-change-by-uncommon-program.yml  [T1053,T1053.005]  Scheduled TaskCache Change by Uncommon Program
  scheduled-tasks-names-used-by-svr-for-graphicalproton-backdo.yml  []  Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor
  scheduled-tasks-names-used-by-svr-for-graphicalproton-backdo_2.yml  []  Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler
  T1053.005_schtasks-creation-or-modification-with-system-privileges.yml  [T1053.005]  Schtasks Creation Or Modification With SYSTEM Privileges
  T1053.005_schtasks-from-suspicious-folders.yml  [T1053.005]  Schtasks From Suspicious Folders
  screenconnect-slashandgrab-exploitation-indicators.yml  []  ScreenConnect - SlashAndGrab Exploitation Indicators
  T1047_script-event-consumer-spawning-process.yml  [T1047]  Script Event Consumer Spawning Process
  T1059_script-interpreter-execution-from-suspicious-folder.yml  [T1059]  Script Interpreter Execution From Suspicious Folder
  T1005_script-interpreter-spawning-credential-scanner-linux.yml  [T1005,T1059.004,T1552]  Script Interpreter Spawning Credential Scanner - Linux
  T1005_script-interpreter-spawning-credential-scanner-windows.yml  [T1005,T1059.007,T1552]  Script Interpreter Spawning Credential Scanner - Windows
  T1036_sdiagnhost-calling-suspicious-child-process.yml  [T1036,T1218]  Sdiagnhost Calling Suspicious Child Process
  T1112_security-event-logging-disabled-via-minint-registry-key-proc.yml  [T1112,T1685.001]  Security Event Logging Disabled via MiniNt Registry Key - Process
  T1112_security-event-logging-disabled-via-minint-registry-key-regi.yml  [T1112,T1685.001]  Security Event Logging Disabled via MiniNt Registry Key - Registry Set
  T1685.005_security-eventlog-cleared.yml  [T1685.005]  Security Eventlog Cleared
  T1033_security-privileges-enumeration-via-whoami-exe.yml  [T1033]  Security Privileges Enumeration Via Whoami.EXE
  T1685_security-service-disabled-via-reg-exe.yml  [T1685]  Security Service Disabled Via Reg.EXE
  T1547.005_security-support-provider-ssp-added-to-lsa-configuration.yml  [T1547.005]  Security Support Provider (SSP) Added to LSA Configuration
  T1218_self-extracting-package-creation-via-iexpress-exe-from-poten.yml  [T1218]  Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
  T1490_sensitive-file-access-via-volume-shadow-copy-backup.yml  [T1490]  Sensitive File Access Via Volume Shadow Copy Backup
  T1003.002_sensitive-file-dump-via-print-exe.yml  [T1003.002,T1003.003,T1218]  Sensitive File Dump Via Print.EXE
  T1003.003_sensitive-file-dump-via-wbadmin-exe.yml  [T1003.003]  Sensitive File Dump Via Wbadmin.EXE
  T1003.003_sensitive-file-recovery-from-backup-via-wbadmin-exe.yml  [T1003.003]  Sensitive File Recovery From Backup Via Wbadmin.EXE
  T1053.005_serpent-backdoor-payload-execution-via-scheduled-task.yml  [T1053.005,T1059.006]  Serpent Backdoor Payload Execution Via Scheduled Task
  T1221_server-side-template-injection-strings.yml  [T1221]  Server Side Template Injection Strings
  T1112_service-binary-in-suspicious-folder.yml  [T1112]  Service Binary in Suspicious Folder
  T1574.011_service-dacl-abuse-to-hide-services-via-sc-exe.yml  [T1574.011]  Service DACL Abuse To Hide Services Via Sc.EXE
  T1543.003_service-installation-with-suspicious-folder-pattern.yml  [T1543.003]  Service Installation with Suspicious Folder Pattern
  T1543_service-installed-by-unusual-client-security.yml  [T1543]  Service Installed By Unusual Client - Security
  T1543_service-installed-by-unusual-client-system.yml  [T1543]  Service Installed By Unusual Client - System
  T1685_service-registry-key-deleted-via-reg-exe.yml  [T1685]  Service Registry Key Deleted Via Reg.EXE
  T1564.001_set-suspicious-files-as-system-files-using-attrib-exe.yml  [T1564.001]  Set Suspicious Files as System Files Using Attrib.EXE
  T1070_shadow-copies-deletion-using-operating-systems-utilities.yml  [T1070,T1490]  Shadow Copies Deletion Using Operating Systems Utilities
  T1195.002_shai-hulud-2-0-malicious-npm-package-installation.yml  [T1195.002]  Shai-Hulud 2.0 Malicious NPM Package Installation
  T1195.002_shai-hulud-2-0-malicious-npm-package-installation-linux.yml  [T1195.002]  Shai-Hulud 2.0 Malicious NPM Package Installation - Linux
  T1195.002_shai-hulud-malicious-bun-execution.yml  [T1195.002,T1203]  Shai-Hulud Malicious Bun Execution
  T1195.002_shai-hulud-malicious-bun-execution-linux.yml  [T1195.002,T1203]  Shai-Hulud Malicious Bun Execution - Linux
  T1119_shai-hulud-malicious-github-workflow-creation.yml  [T1119,T1552.001]  Shai-Hulud Malicious GitHub Workflow Creation
  T1059_shai-hulud-malware-indicators-linux.yml  [T1059]  Shai-Hulud Malware Indicators - Linux
  T1059_shai-hulud-malware-indicators-windows.yml  [T1059]  Shai-Hulud Malware Indicators - Windows
  T1005_shai-hulud-npm-package-malicious-exfiltration-via-curl.yml  [T1005,T1041]  Shai-Hulud NPM Package Malicious Exfiltration via Curl
  T1087_sharphound-recon-account-discovery.yml  [T1087]  SharpHound Recon Account Discovery
  T1033_sharphound-recon-sessions.yml  [T1033]  SharpHound Recon Sessions
  T1083_shell-execution-gcc-linux.yml  [T1083]  Shell Execution GCC  - Linux
  shell-execution-of-process-located-in-tmp-directory.yml  []  Shell Execution Of Process Located In Tmp Directory
  T1083_shell-execution-via-find-linux.yml  [T1083]  Shell Execution via Find - Linux
  T1083_shell-execution-via-flock-linux.yml  [T1083]  Shell Execution via Flock - Linux
  T1059_shell-execution-via-git-linux.yml  [T1059]  Shell Execution via Git - Linux
  T1083_shell-execution-via-nice-linux.yml  [T1083]  Shell Execution via Nice - Linux
  T1059_shell-execution-via-rsync-linux.yml  [T1059]  Shell Execution via Rsync - Linux
  T1059_shell-invocation-via-ssh-linux.yml  [T1059]  Shell Invocation Via Ssh - Linux
  T1059.004_shell-invocation-via-env-command-linux.yml  [T1059.004]  Shell Invocation via Env Command - Linux
  T1546.001_shell-open-registry-keys-manipulation.yml  [T1546.001,T1548.002]  Shell Open Registry Keys Manipulation
  T1218.011_shell32-dll-execution-in-suspicious-directory.yml  [T1218.011]  Shell32 DLL Execution in Suspicious Directory
  T1505.003_shellshock-expression.yml  [T1505.003]  Shellshock Expression
  T1112_shimcache-flush.yml  [T1112]  ShimCache Flush
  T1090_sign-in-from-malware-infected-ip.yml  [T1090]  Sign-In From Malware Infected IP
  T1078.004_sign-in-failure-due-to-conditional-access-requirements-not-m.yml  [T1078.004,T1110]  Sign-in Failure Due to Conditional Access Requirements Not Met
  T1078.004_sign-ins-from-non-compliant-devices.yml  [T1078.004]  Sign-ins from Non-Compliant Devices
  T1127.001_silenttrinity-stager-msbuild-activity.yml  [T1127.001]  Silenttrinity Stager Msbuild Activity
  T1190_sitecore-pre-auth-rce-cve-2021-42237.yml  [T1190]  Sitecore Pre-Auth RCE CVE-2021-42237
  T1543.003_sliver-c2-default-service-installation.yml  [T1543.003,T1569.002]  Sliver C2 Default Service Installation
  T1574.001_small-sieve-malware-commandline-indicator.yml  [T1574.001]  Small Sieve Malware CommandLine Indicator
  T1036.005_small-sieve-malware-file-indicator-creation.yml  [T1036.005]  Small Sieve Malware File Indicator Creation
  small-sieve-malware-registry-persistence.yml  []  Small Sieve Malware Registry Persistence
  T1059.003_sofacy-trojan-loader-activity.yml  [T1059.003,T1218.011]  Sofacy Trojan Loader Activity
  T1190_sonicwall-ssl-vpn-jarrewrite-exploitation.yml  [T1190]  SonicWall SSL/VPN Jarrewrite Exploitation
  T1078_stale-accounts-in-a-privileged-role.yml  [T1078]  Stale Accounts In A Privileged Role
  T1543.003_stonedrill-service-install.yml  [T1543.003]  StoneDrill Service Install
  T1550.002_successful-overpass-the-hash-attempt.yml  [T1550.002]  Successful Overpass the Hash Attempt
  T1068_sudo-privilege-escalation-cve-2019-14287.yml  [T1068,T1548.003]  Sudo Privilege Escalation CVE-2019-14287
  T1055_suspect-svchost-activity.yml  [T1055]  Suspect Svchost Activity
  T1505.003_suspicious-aspx-file-drop-by-exchange.yml  [T1505.003]  Suspicious ASPX File Drop by Exchange
  T1069.002_suspicious-active-directory-database-snapshot-via-adexplorer.yml  [T1069.002,T1087.002,T1482]  Suspicious Active Directory Database Snapshot Via ADExplorer
  T1059.004_suspicious-activity-in-shell-commands.yml  [T1059.004]  Suspicious Activity in Shell Commands
  T1218_suspicious-addinutil-exe-commandline-execution.yml  [T1218]  Suspicious AddinUtil.EXE CommandLine Execution
  suspicious-advpack-call-via-rundll32-exe.yml  []  Suspicious Advpack Call Via Rundll32.EXE
  T1218_suspicious-agentexecutor-powershell-execution.yml  [T1218]  Suspicious AgentExecutor PowerShell Execution
  T1685_suspicious-application-allowed-through-exploit-guard.yml  [T1685]  Suspicious Application Allowed Through Exploit Guard
  T1059_suspicious-arcsoc-exe-child-process.yml  [T1059,T1203]  Suspicious ArcSOC.exe Child Process
  T1047_suspicious-autorun-registry-modified-via-wmi.yml  [T1047,T1547.001]  Suspicious Autorun Registry Modified via WMI
  T1204_suspicious-binaries-and-scripts-in-public-folder.yml  [T1204]  Suspicious Binaries and Scripts in Public Folder
  T1204.002_suspicious-binary-in-user-directory-spawned-from-office-appl.yml  [T1204.002]  Suspicious Binary In User Directory Spawned From Office Application
  T1219.002_suspicious-binary-writes-via-anydesk.yml  [T1219.002]  Suspicious Binary Writes Via AnyDesk
  T1021.003_suspicious-bitlocker-access-agent-update-utility-execution.yml  [T1021.003,T1218]  Suspicious BitLocker Access Agent Update Utility Execution
  T1078_suspicious-browser-activity.yml  [T1078]  Suspicious Browser Activity
  T1036_suspicious-calculator-usage.yml  [T1036]  Suspicious Calculator Usage
  T1123_suspicious-camera-and-microphone-access.yml  [T1123,T1125]  Suspicious Camera and Microphone Access
  T1105_suspicious-certreq-command-to-download.yml  [T1105]  Suspicious CertReq Command to Download
  T1134.002_suspicious-child-process-created-as-system.yml  [T1134.002]  Suspicious Child Process Created as System
  T1059.005_suspicious-child-process-of-bginfo-exe.yml  [T1059.005,T1202,T1218]  Suspicious Child Process Of BgInfo.EXE
  T1102_suspicious-child-process-of-manage-engine-servicedesk.yml  [T1102]  Suspicious Child Process Of Manage Engine ServiceDesk
  T1190_suspicious-child-process-of-sql-server.yml  [T1190,T1505.003]  Suspicious Child Process Of SQL Server
  T1036_suspicious-child-process-of-wermgr-exe.yml  [T1036,T1055]  Suspicious Child Process Of Wermgr.EXE
  T1127_suspicious-child-process-of-aspnetcompiler.yml  [T1127]  Suspicious Child Process of AspNetCompiler
  T1195.002_suspicious-child-process-of-notepad-updater-gup-exe.yml  [T1195.002,T1557]  Suspicious Child Process of Notepad++ Updater - GUP.Exe
  T1190_suspicious-child-process-of-solarwinds-webhelpdesk.yml  [T1190]  Suspicious Child Process of SolarWinds WebHelpDesk
  T1176.001_suspicious-chromium-browser-instance-executed-with-custom-ex.yml  [T1176.001]  Suspicious Chromium Browser Instance Executed With Custom Extension
  T1204.001_suspicious-clickfix-filefix-execution-pattern.yml  [T1204.001,T1204.004]  Suspicious ClickFix/FileFix Execution Pattern
  T1053.005_suspicious-command-patterns-in-scheduled-task-creation.yml  [T1053.005]  Suspicious Command Patterns In Scheduled Task Creation
  T1036_suspicious-computer-account-name-change-cve-2021-42287.yml  [T1036,T1098]  Suspicious Computer Account Name Change CVE-2021-42287
  T1218.011_suspicious-control-panel-dll-load.yml  [T1218.011]  Suspicious Control Panel DLL Load
  T1564_suspicious-creation-with-colorcpl.yml  [T1564]  Suspicious Creation with Colorcpl
  T1105_suspicious-curl-exe-download.yml  [T1105]  Suspicious Curl.EXE Download
  T1216_suspicious-customshellhost-execution.yml  [T1216]  Suspicious CustomShellHost Execution
  T1218_suspicious-dll-loaded-via-certoc-exe.yml  [T1218]  Suspicious DLL Loaded via CertOC.EXE
  T1187_suspicious-dns-query-indicating-kerberos-coercion-via-dns-ob.yml  [T1187,T1557.001]  Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
  T1187_suspicious-dns-query-indicating-kerberos-coercion-via-dns-ob_2.yml  [T1187,T1557.001]  Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
  T1546.008_suspicious-debugger-registration-cmdline.yml  [T1546.008]  Suspicious Debugger Registration Cmdline
  T1105_suspicious-desktopimgdownldr-command.yml  [T1105]  Suspicious Desktopimgdownldr Command
  T1105_suspicious-desktopimgdownldr-target-file.yml  [T1105]  Suspicious Desktopimgdownldr Target File
  T1218_suspicious-dotnet-clr-usage-log-artifact.yml  [T1218]  Suspicious DotNET CLR Usage Log Artifact
  T1566.001_suspicious-double-extension-file-execution.yml  [T1566.001]  Suspicious Double Extension File Execution
  T1036.007_suspicious-double-extension-files.yml  [T1036.007]  Suspicious Double Extension Files
  T1036.003_suspicious-download-from-direct-ip-via-bitsadmin.yml  [T1036.003,T1197]  Suspicious Download From Direct IP Via Bitsadmin
  T1036.003_suspicious-download-from-file-sharing-website-via-bitsadmin.yml  [T1036.003,T1105,T1197]  Suspicious Download From File-Sharing Website Via Bitsadmin
  T1059.004_suspicious-download-and-execute-pattern-via-curl-wget.yml  [T1059.004,T1203]  Suspicious Download and Execute Pattern via Curl/Wget
  T1105_suspicious-download-from-office-domain.yml  [T1105,T1608]  Suspicious Download from Office Domain
  T1218.008_suspicious-driver-dll-installation-via-odbcconf-exe.yml  [T1218.008]  Suspicious Driver/DLL Installation Via Odbcconf.EXE
  T1105_suspicious-dropbox-api-usage.yml  [T1105,T1567.002]  Suspicious Dropbox API Usage
  T1003.001_suspicious-dumpminitool-execution.yml  [T1003.001,T1036]  Suspicious DumpMinitool Execution
  T1027_suspicious-encoded-and-obfuscated-reflection-assembly-load-f.yml  [T1027,T1059.001]  Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
  T1059.001_suspicious-encoded-powershell-command-line.yml  [T1059.001]  Suspicious Encoded PowerShell Command Line
  T1047_suspicious-encoded-scripts-in-a-wmi-consumer.yml  [T1047,T1546.003]  Suspicious Encoded Scripts in a WMI Consumer
  suspicious-environment-variable-has-been-registered.yml  []  Suspicious Environment Variable Has Been Registered
  T1685.001_suspicious-eventlog-clearing-or-configuration-change-activit.yml  [T1685.001,T1685.005]  Suspicious Eventlog Clearing or Configuration Change Activity
  T1564_suspicious-executable-file-creation.yml  [T1564]  Suspicious Executable File Creation
  T1566.001_suspicious-execution-from-outlook-temporary-folder.yml  [T1566.001]  Suspicious Execution From Outlook Temporary Folder
  suspicious-execution-location-of-wermgr-exe.yml  []  Suspicious Execution Location Of Wermgr.EXE
  T1588.002_suspicious-execution-of-renamed-sysinternals-tools-registry.yml  [T1588.002]  Suspicious Execution Of Renamed Sysinternals Tools - Registry
  T1027.010_suspicious-explorer-process-with-whitespace-padding-clickfix.yml  [T1027.010,T1204.004]  Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
  T1566_suspicious-external-webdav-execution.yml  [T1566,T1584]  Suspicious External WebDAV Execution
  suspicious-file-created-via-onenote-application.yml  []  Suspicious File Created Via OneNote Application
  T1105_suspicious-file-created-by-arcsoc-exe.yml  [T1105,T1127,T1133]  Suspicious File Created by ArcSOC.exe
  T1566.001_suspicious-file-created-in-outlook-temporary-directory.yml  [T1566.001]  Suspicious File Created in Outlook Temporary Directory
  suspicious-file-creation-activity-from-fake-recycle-bin-fold.yml  []  Suspicious File Creation Activity From Fake Recycle.Bin Folder
  suspicious-file-creation-in-uncommon-appdata-folder.yml  []  Suspicious File Creation In Uncommon AppData Folder
  suspicious-file-download-from-file-sharing-domain-via-curl-e.yml  []  Suspicious File Download From File Sharing Domain Via Curl.EXE
  suspicious-file-download-from-file-sharing-domain-via-wget-e.yml  []  Suspicious File Download From File Sharing Domain Via Wget.EXE
  T1564.004_suspicious-file-download-from-file-sharing-websites-file-str.yml  [T1564.004]  Suspicious File Download From File Sharing Websites -  File Stream
  suspicious-file-download-from-ip-via-curl-exe.yml  []  Suspicious File Download From IP Via Curl.EXE
  suspicious-file-download-from-ip-via-wget-exe.yml  []  Suspicious File Download From IP Via Wget.EXE
  suspicious-file-download-from-ip-via-wget-exe-paths.yml  []  Suspicious File Download From IP Via Wget.EXE - Paths
  T1027_suspicious-file-downloaded-from-direct-ip-via-certutil-exe.yml  [T1027,T1105]  Suspicious File Downloaded From Direct IP Via Certutil.EXE
  T1027_suspicious-file-downloaded-from-file-sharing-website-via-cer.yml  [T1027,T1105]  Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
  T1027_suspicious-file-encoded-to-base64-via-certutil-exe.yml  [T1027]  Suspicious File Encoded To Base64 Via Certutil.EXE
  T1059.001_suspicious-file-execution-from-internet-hosted-webdav-share.yml  [T1059.001]  Suspicious File Execution From Internet Hosted WebDav Share
  T1190_suspicious-file-write-to-sharepoint-layouts-directory.yml  [T1190,T1505.003]  Suspicious File Write to SharePoint Layouts Directory
  T1204.004_suspicious-filefix-execution-pattern.yml  [T1204.004]  Suspicious FileFix Execution Pattern
  T1027_suspicious-filename-with-embedded-base64-commands.yml  [T1027,T1059.004]  Suspicious Filename with Embedded Base64 Commands
  T1574.001_suspicious-gup-usage.yml  [T1574.001]  Suspicious GUP Usage
  T1003.003_suspicious-get-addbaccount-usage.yml  [T1003.003]  Suspicious Get-ADDBAccount Usage
  T1027_suspicious-get-variable-exe-creation.yml  [T1027,T1546]  Suspicious Get-Variable.exe Creation
  T1059_suspicious-greedy-compression-using-rar-exe.yml  [T1059]  Suspicious Greedy Compression Using Rar.EXE
  T1547_suspicious-grpconv-execution.yml  [T1547]  Suspicious GrpConv Execution
  T1047_suspicious-hh-exe-execution.yml  [T1047,T1059.001,T1059.003,T1059.005,T1059.007,T1218,T1218.001,T1218.010,T1218.011,T1566,T1566.001]  Suspicious HH.EXE Execution
  T1059.003_suspicious-hwp-sub-processes.yml  [T1059.003,T1203,T1566.001]  Suspicious HWP Sub Processes
  T1505.004_suspicious-iis-module-registration.yml  [T1505.004]  Suspicious IIS Module Registration
  T1114.003_suspicious-inbox-forwarding-identity-protection.yml  [T1114.003]  Suspicious Inbox Forwarding Identity Protection
  T1140_suspicious-inbox-manipulation-rules.yml  [T1140]  Suspicious Inbox Manipulation Rules
  T1059.001_suspicious-interactive-powershell-as-system.yml  [T1059.001]  Suspicious Interactive PowerShell as SYSTEM
  T1059_suspicious-invocation-of-shell-via-awk-linux.yml  [T1059]  Suspicious Invocation of Shell via AWK - Linux
  T1059_suspicious-invocation-of-shell-via-rsync.yml  [T1059,T1203]  Suspicious Invocation of Shell via Rsync
  T1105_suspicious-invoke-webrequest-execution.yml  [T1105]  Suspicious Invoke-WebRequest Execution
  T1059_suspicious-java-children-processes.yml  [T1059]  Suspicious Java Children Processes
  T1218.005_suspicious-javascript-execution-via-mshta-exe.yml  [T1218.005]  Suspicious JavaScript Execution Via Mshta.EXE
  T1558.003_suspicious-kerberos-ticket-request-via-cli.yml  [T1558.003]  Suspicious Kerberos Ticket Request via CLI
  T1558.003_suspicious-kerberos-ticket-request-via-powershell-script-scr.yml  [T1558.003]  Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock
  T1082_suspicious-kernel-dump-using-dtrace.yml  [T1082]  Suspicious Kernel Dump Using Dtrace
  T1555.004_suspicious-key-manager-access.yml  [T1555.004]  Suspicious Key Manager Access
  T1001.003_suspicious-ldap-attributes-used.yml  [T1001.003]  Suspicious LDAP-Attributes Used
  T1204.002_suspicious-lnk-command-line-padding-with-whitespace-characte.yml  [T1204.002]  Suspicious LNK Command-Line Padding with Whitespace Characters
  T1003.001_suspicious-lsass-access-via-malseclogon.yml  [T1003.001]  Suspicious LSASS Access Via MalSecLogon
  T1003_suspicious-loading-of-dbgcore-dbghelp-dlls-from-uncommon-loc.yml  [T1003,T1685]  Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
  T1036_suspicious-msdt-parent-process.yml  [T1036,T1218]  Suspicious MSDT Parent Process
  T1190_suspicious-msexchangemailboxreplication-aspx-write.yml  [T1190,T1505.003]  Suspicious MSExchangeMailboxReplication ASPX Write
  T1218.005_suspicious-mshta-child-process.yml  [T1218.005]  Suspicious MSHTA Child Process
  T1560.001_suspicious-manipulation-of-default-accounts-via-net-exe.yml  [T1560.001]  Suspicious Manipulation Of Default Accounts Via Net.EXE
  T1047_suspicious-microsoft-office-child-process.yml  [T1047,T1204.002,T1218.010]  Suspicious Microsoft Office Child Process
  T1059.002_suspicious-microsoft-office-child-process-macos.yml  [T1059.002,T1137.002,T1204.002]  Suspicious Microsoft Office Child Process - MacOS
  T1566_suspicious-microsoft-onenote-child-process.yml  [T1566,T1566.001]  Suspicious Microsoft OneNote Child Process
  T1053.005_suspicious-modification-of-scheduled-tasks.yml  [T1053.005]  Suspicious Modification Of Scheduled Tasks
  T1106_suspicious-mshta-exe-execution-patterns.yml  [T1106]  Suspicious Mshta.EXE Execution Patterns
  T1219.002_suspicious-mstsc-exe-execution-with-local-rdp-file.yml  [T1219.002]  Suspicious Mstsc.EXE Execution With Local RDP File
  T1212_suspicious-ntlm-authentication-on-the-printer-spooler-servic.yml  [T1212]  Suspicious NTLM Authentication on the Printer Spooler Service
  T1190_suspicious-named-error.yml  [T1190]  Suspicious Named Error
  suspicious-network-connection-binary-no-commandline.yml  []  Suspicious Network Connection Binary No CommandLine
  T1543.003_suspicious-new-service-creation.yml  [T1543.003]  Suspicious New Service Creation
  suspicious-nohup-execution.yml  []  Suspicious Nohup Execution
  suspicious-obfuscated-powershell-code.yml  []  Suspicious Obfuscated PowerShell Code
  T1204.002_suspicious-outlook-child-process.yml  [T1204.002]  Suspicious Outlook Child Process
  T1008_suspicious-outlook-macro-created.yml  [T1008,T1137,T1546]  Suspicious Outlook Macro Created
  T1036.007_suspicious-parent-double-extension-file-execution.yml  [T1036.007]  Suspicious Parent Double Extension File Execution
  T1685_suspicious-path-in-keyboard-layout-ime-file-registry-value.yml  [T1685]  Suspicious Path In Keyboard Layout IME File Registry Value
  T1059_suspicious-persistence-via-vmwaretoolboxcmd-exe-vm-state-cha.yml  [T1059]  Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
  T1070.004_suspicious-ping-del-command-combination.yml  [T1070.004]  Suspicious Ping/Del Command Combination
  T1021.001_suspicious-plink-port-forwarding.yml  [T1021.001,T1572]  Suspicious Plink Port Forwarding
  T1059.001_suspicious-powershell-download-and-execute-pattern.yml  [T1059.001]  Suspicious PowerShell Download and Execute Pattern
  T1059.001_suspicious-powershell-encoded-command-patterns.yml  [T1059.001]  Suspicious PowerShell Encoded Command Patterns
  T1059.001_suspicious-powershell-iex-execution-patterns.yml  [T1059.001]  Suspicious PowerShell IEX Execution Patterns
  T1059.001_suspicious-powershell-invocations-generic.yml  [T1059.001]  Suspicious PowerShell Invocations - Generic
  T1059.001_suspicious-powershell-invocations-generic-powershell-module.yml  [T1059.001]  Suspicious PowerShell Invocations - Generic - PowerShell Module
  T1059.001_suspicious-powershell-invocations-specific.yml  [T1059.001]  Suspicious PowerShell Invocations - Specific
  T1059.001_suspicious-powershell-invocations-specific-powershell-module.yml  [T1059.001]  Suspicious PowerShell Invocations - Specific - PowerShell Module
  T1059.001_suspicious-powershell-parameter-substring.yml  [T1059.001]  Suspicious PowerShell Parameter Substring
  T1059.001_suspicious-powershell-parent-process.yml  [T1059.001]  Suspicious PowerShell Parent Process
  T1574_suspicious-printer-driver-empty-manufacturer.yml  [T1574]  Suspicious Printer Driver Empty Manufacturer
  T1059.001_suspicious-printerports-creation-cve-2020-1048.yml  [T1059.001]  Suspicious PrinterPorts Creation (CVE-2020-1048)
  T1685_suspicious-process-access-of-msmpeng-by-werfaultsecure-edr-f.yml  [T1685]  Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
  T1003.001_suspicious-process-access-to-lsass-with-dbgcore-dbghelp-dlls.yml  [T1003.001,T1685]  Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
  T1190_suspicious-process-by-web-server-process.yml  [T1190,T1505.003]  Suspicious Process By Web Server Process
  T1047_suspicious-process-created-via-wmic-exe.yml  [T1047]  Suspicious Process Created Via Wmic.EXE
  suspicious-process-execution-from-fake-recycle-bin-folder.yml  []  Suspicious Process Execution From Fake Recycle.Bin Folder
  T1036.005_suspicious-process-masquerading-as-svchost-exe.yml  [T1036.005]  Suspicious Process Masquerading As SvcHost.EXE
  T1036_suspicious-process-parents.yml  [T1036]  Suspicious Process Parents
  T1003.003_suspicious-process-patterns-ntds-dit-exfil.yml  [T1003.003]  Suspicious Process Patterns NTDS.DIT Exfil
  T1059.003_suspicious-process-spawned-by-centrestack-portal-apppool.yml  [T1059.003,T1505.003]  Suspicious Process Spawned by CentreStack Portal AppPool
  suspicious-processes-spawned-by-java-exe.yml  []  Suspicious Processes Spawned by Java.EXE
  T1190_suspicious-processes-spawned-by-winrm.yml  [T1190]  Suspicious Processes Spawned by WinRM
  T1686.003_suspicious-program-location-whitelisted-in-firewall-via-nets.yml  [T1686.003]  Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
  T1059_suspicious-program-names.yml  [T1059]  Suspicious Program Names
  T1218_suspicious-provlaunch-exe-child-process.yml  [T1218]  Suspicious Provlaunch.EXE Child Process
  T1021.002_suspicious-psexec-execution.yml  [T1021.002]  Suspicious PsExec Execution
  T1021.002_suspicious-psexec-execution-zeek.yml  [T1021.002]  Suspicious PsExec Execution - Zeek
  T1021.001_suspicious-rdp-redirect-using-tscon.yml  [T1021.001,T1563.002]  Suspicious RDP Redirect Using TSCON
  T1553_suspicious-razerinstaller-explorer-subprocess.yml  [T1553]  Suspicious RazerInstaller Explorer Subprocess
  T1059.005_suspicious-reconnaissance-activity-via-gathernetworkinfo-vbs.yml  [T1059.005,T1615]  Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
  T1048_suspicious-redirection-to-local-admin-share.yml  [T1048]  Suspicious Redirection to Local Admin Share
  T1486_suspicious-reg-add-bitlocker.yml  [T1486]  Suspicious Reg Add BitLocker
  T1112_suspicious-registry-modification-from-ads-via-regini-exe.yml  [T1112]  Suspicious Registry Modification From ADS Via Regini.EXE
  T1218.010_suspicious-regsvr32-execution-from-remote-share.yml  [T1218.010]  Suspicious Regsvr32 Execution From Remote Share
  T1059_suspicious-remote-child-process-from-outlook.yml  [T1059,T1202]  Suspicious Remote Child Process From Outlook
  T1003.001_suspicious-renamed-comsvcs-dll-loaded-by-rundll32.yml  [T1003.001]  Suspicious Renamed Comsvcs DLL Loaded By Rundll32
  T1218.008_suspicious-response-file-execution-via-odbcconf-exe.yml  [T1218.008]  Suspicious Response File Execution Via Odbcconf.EXE
  T1059.004_suspicious-reverse-shell-command-line.yml  [T1059.004]  Suspicious Reverse Shell Command Line
  T1547.001_suspicious-run-key-from-download.yml  [T1547.001]  Suspicious Run Key from Download
  T1218.011_suspicious-rundll32-activity-invoking-sys-file.yml  [T1218.011]  Suspicious Rundll32 Activity Invoking Sys File
  T1218.011_suspicious-rundll32-execution-with-image-extension.yml  [T1218.011]  Suspicious Rundll32 Execution With Image Extension
  T1055_suspicious-rundll32-invoking-inline-vbscript.yml  [T1055]  Suspicious Rundll32 Invoking Inline VBScript
  T1190_suspicious-sql-error-messages.yml  [T1190]  Suspicious SQL Error Messages
  T1003_suspicious-system-user-process-creation.yml  [T1003,T1027,T1134]  Suspicious SYSTEM User Process Creation
  T1053.005_suspicious-scheduled-task-creation.yml  [T1053.005]  Suspicious Scheduled Task Creation
  T1053.005_suspicious-scheduled-task-creation-involving-temp-folder.yml  [T1053.005]  Suspicious Scheduled Task Creation Involving Temp Folder
  T1053.005_suspicious-scheduled-task-update.yml  [T1053.005]  Suspicious Scheduled Task Update
  T1053_suspicious-scheduled-task-write-to-system32-tasks.yml  [T1053]  Suspicious Scheduled Task Write to System32 Tasks
  T1053.005_suspicious-schtasks-execution-appdata-folder.yml  [T1053.005,T1059.001]  Suspicious Schtasks Execution AppData Folder
  T1053.005_suspicious-schtasks-schedule-types.yml  [T1053.005]  Suspicious Schtasks Schedule Types
  T1059.005_suspicious-scripting-in-a-wmi-consumer.yml  [T1059.005]  Suspicious Scripting in a WMI Consumer
  T1555_suspicious-serv-u-process-pattern.yml  [T1555]  Suspicious Serv-U Process Pattern
  T1202_suspicious-service-binary-directory.yml  [T1202]  Suspicious Service Binary Directory
  T1543.003_suspicious-service-dacl-modification-via-set-service-cmdlet.yml  [T1543.003]  Suspicious Service DACL Modification Via Set-Service Cmdlet
  T1574.011_suspicious-service-dacl-modification-via-set-service-cmdlet.yml  [T1574.011]  Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
  T1543.003_suspicious-service-installation.yml  [T1543.003]  Suspicious Service Installation
  T1543.003_suspicious-service-installation-script.yml  [T1543.003]  Suspicious Service Installation Script
  T1543.003_suspicious-service-path-modification.yml  [T1543.003]  Suspicious Service Path Modification
  T1218.011_suspicious-shellexec-rundll-call-via-ordinal.yml  [T1218.011]  Suspicious ShellExec_RunDLL Call Via Ordinal
  suspicious-shells-spawn-by-java-utility-keytool.yml  []  Suspicious Shells Spawn by Java Utility Keytool
  T1546.011_suspicious-shim-database-patching-activity.yml  [T1546.011]  Suspicious Shim Database Patching Activity
  T1078_suspicious-signins-from-a-non-registered-device.yml  [T1078]  Suspicious SignIns From A Non Registered Device
  T1027.010_suspicious-space-characters-in-runmru-registry-path-clickfix.yml  [T1027.010,T1204.004]  Suspicious Space Characters in RunMRU Registry Path - ClickFix
  T1027.010_suspicious-space-characters-in-typedpaths-registry-path-file.yml  [T1027.010,T1204.004]  Suspicious Space Characters in TypedPaths Registry Path - FileFix
  T1021.003_suspicious-speech-runtime-binary-child-process.yml  [T1021.003,T1218]  Suspicious Speech Runtime Binary Child Process
  T1202_suspicious-splwow64-without-params.yml  [T1202]  Suspicious Splwow64 Without Params
  T1068_suspicious-spool-service-child-process.yml  [T1068,T1203]  Suspicious Spool Service Child Process
  T1204.002_suspicious-startup-folder-persistence.yml  [T1204.002,T1547.001]  Suspicious Startup Folder Persistence
  T1685.001_suspicious-svchost-process-access.yml  [T1685.001]  Suspicious Svchost Process Access
  T1068_suspicious-sysmon-as-execution-parent.yml  [T1068]  Suspicious Sysmon as Execution Parent
  T1219.002_suspicious-tscon-start-as-system.yml  [T1219.002]  Suspicious TSCON Start as SYSTEM
  T1528_suspicious-teams-application-related-objectacess-event.yml  [T1528]  Suspicious Teams Application Related ObjectAcess Event
  T1021.005_suspicious-ultravnc-execution.yml  [T1021.005]  Suspicious UltraVNC Execution
  T1685_suspicious-uninstall-of-windows-defender-feature-via-powersh.yml  [T1685]  Suspicious Uninstall of Windows Defender Feature via PowerShell
  T1003.001_suspicious-unsigned-dbghelp-dbgcore-dll-loaded.yml  [T1003.001]  Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
  T1574.001_suspicious-unsigned-thor-scanner-execution.yml  [T1574.001]  Suspicious Unsigned Thor Scanner Execution
  suspicious-usage-of-shellexec-rundll.yml  []  Suspicious Usage Of ShellExec_RunDLL
  T1127_suspicious-use-of-csharp-interactive-console.yml  [T1127]  Suspicious Use of CSharp Interactive Console
  T1071.001_suspicious-user-agent.yml  [T1071.001]  Suspicious User Agent
  T1547.001_suspicious-vbscript-un2452-pattern.yml  [T1547.001]  Suspicious VBScript UN2452 Pattern
  T1219_suspicious-velociraptor-child-process.yml  [T1219]  Suspicious Velociraptor Child Process
  T1490_suspicious-volume-shadow-copy-vss-ps-dll-load.yml  [T1490]  Suspicious Volume Shadow Copy VSS_PS.dll Load
  T1490_suspicious-volume-shadow-copy-vssapi-dll-load.yml  [T1490]  Suspicious Volume Shadow Copy Vssapi.dll Load
  T1047_suspicious-wmic-execution-via-office-process.yml  [T1047,T1204.002,T1218.010]  Suspicious WMIC Execution Via Office Process
  T1048.003_suspicious-webdav-client-execution-via-rundll32-exe.yml  [T1048.003]  Suspicious WebDav Client Execution Via Rundll32.EXE
  T1136.001_suspicious-windows-anonymous-logon-local-account-created.yml  [T1136.001,T1136.002]  Suspicious Windows ANONYMOUS LOGON Local Account Created
  T1685_suspicious-windows-defender-registry-key-tampering-via-reg-e.yml  [T1685]  Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
  T1489_suspicious-windows-service-tampering.yml  [T1489,T1685]  Suspicious Windows Service Tampering
  T1505.003_suspicious-windows-strings-in-uri.yml  [T1505.003]  Suspicious Windows Strings In URI
  T1685_suspicious-windows-trace-etw-session-tamper-via-logman-exe.yml  [T1685,T1685.005]  Suspicious Windows Trace ETW Session Tamper Via Logman.EXE
  T1036_suspicious-windows-update-agent-empty-cmdline.yml  [T1036]  Suspicious Windows Update Agent Empty Cmdline
  T1047_suspicious-wmiprvse-child-process.yml  [T1047,T1204.002,T1218.010]  Suspicious WmiPrvSE Child Process
  T1587_suspicious-word-cab-file-write-cve-2021-40444.yml  [T1587]  Suspicious Word Cab File Write CVE-2021-40444
  T1204.001_symlink-etc-passwd.yml  [T1204.001]  Symlink Etc Passwd
  T1012_syskey-registry-keys-access.yml  [T1012]  SysKey Registry Keys Access
  T1685_sysinternals-pssuspend-suspicious-execution.yml  [T1685]  Sysinternals PsSuspend Suspicious Execution
  T1685.006_syslog-clearing-or-removal-via-system-utilities.yml  [T1685.006]  Syslog Clearing or Removal Via System Utilities
  T1685_sysmon-application-crashed.yml  [T1685]  Sysmon Application Crashed
  sysmon-blocked-executable.yml  []  Sysmon Blocked Executable
  sysmon-blocked-file-shredding.yml  []  Sysmon Blocked File Shredding
  T1112_sysmon-channel-reference-deletion.yml  [T1112]  Sysmon Channel Reference Deletion
  T1564_sysmon-configuration-error.yml  [T1564]  Sysmon Configuration Error
  T1564_sysmon-configuration-modification.yml  [T1564]  Sysmon Configuration Modification
  T1518.001_sysmon-discovery-via-default-driver-altitude-using-findstr-e.yml  [T1518.001]  Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
  T1685_sysmon-driver-altitude-change.yml  [T1685]  Sysmon Driver Altitude Change
  T1070_sysmon-driver-unloaded-via-fltmc-exe.yml  [T1070,T1685,T1685.001]  Sysmon Driver Unloaded Via Fltmc.EXE
  T1574.001_system-control-panel-item-loaded-from-uncommon-location.yml  [T1574.001]  System Control Panel Item Loaded From Uncommon Location
  T1036_system-file-execution-location-anomaly.yml  [T1036]  System File Execution Location Anomaly
  T1490_system-restore-registry-modification-via-commandline.yml  [T1490]  System Restore Registry Modification via CommandLine
  T1021.002_t1047-wmiprvse-wbemcomn-dll-hijack.yml  [T1021.002,T1047]  T1047 Wmiprvse Wbemcomn DLL Hijack
  T1055.001_taidoor-rat-dll-load.yml  [T1055.001]  TAIDOOR RAT DLL Load
  T1685_tamper-windows-defender-psclassic.yml  [T1685]  Tamper Windows Defender - PSClassic
  T1685_tamper-windows-defender-scriptblocklogging.yml  [T1685]  Tamper Windows Defender - ScriptBlockLogging
  T1685_tamper-windows-defender-remove-mppreference.yml  [T1685]  Tamper Windows Defender Remove-MpPreference
  T1685_tamper-windows-defender-remove-mppreference-scriptblockloggi.yml  [T1685]  Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging
  T1685_tamper-with-sophos-av-registry-keys.yml  [T1685]  Tamper With Sophos AV Registry Keys
  T1685_taskkill-symantec-endpoint-protection.yml  [T1685]  Taskkill Symantec Endpoint Protection
  T1036_taskmgr-as-local-system.yml  [T1036]  Taskmgr as LOCAL_SYSTEM
  T1574.001_tasks-folder-evasion.yml  [T1574.001]  Tasks Folder Evasion
  T1195.002_teampcp-litellm-supply-chain-attack-persistence-indicators.yml  [T1195.002,T1543.002]  TeamPCP LiteLLM Supply Chain Attack Persistence Indicators
  T1078.004_temporary-access-pass-added-to-an-account.yml  [T1078.004]  Temporary Access Pass Added To An Account
  T1070_terminal-server-client-connection-history-cleared-registry.yml  [T1070,T1112]  Terminal Server Client Connection History Cleared - Registry
  T1190_terminal-service-process-spawn.yml  [T1190,T1210]  Terminal Service Process Spawn
  T1190_terramaster-tos-cve-2020-28188.yml  [T1190]  TerraMaster TOS CVE-2020-28188
  T1003.001_time-travel-debugging-utility-usage.yml  [T1003.001,T1218]  Time Travel Debugging Utility Usage
  T1003.001_time-travel-debugging-utility-usage-image.yml  [T1003.001,T1218]  Time Travel Debugging Utility Usage - Image
  T1078_too-many-global-admins.yml  [T1078]  Too Many Global Admins
  T1090.003_tor-client-browser-execution.yml  [T1090.003]  Tor Client/Browser Execution
  T1559_trickbot-malware-activity.yml  [T1559]  Trickbot Malware Activity
  triple-cross-ebpf-rootkit-default-lockfile.yml  []  Triple Cross eBPF Rootkit Default LockFile
  T1053.003_triple-cross-ebpf-rootkit-default-persistence.yml  [T1053.003]  Triple Cross eBPF Rootkit Default Persistence
  triple-cross-ebpf-rootkit-execve-hijack.yml  []  Triple Cross eBPF Rootkit Execve Hijack
  T1014_triple-cross-ebpf-rootkit-install-commands.yml  [T1014]  Triple Cross eBPF Rootkit Install Commands
  T1059.001_tropictrooper-campaign-november-2018.yml  [T1059.001]  TropicTrooper Campaign November 2018
  T1112_trust-access-disable-for-vbapplications.yml  [T1112]  Trust Access Disable For VBApplications
  T1548.002_trusted-path-bypass-via-windows-directory-spoofing.yml  [T1548.002,T1574.007]  Trusted Path Bypass via Windows Directory Spoofing
  T1543.003_turla-service-install.yml  [T1543.003]  Turla Service Install
  T1548.002_uac-bypass-abusing-winsat-path-parsing-file.yml  [T1548.002]  UAC Bypass Abusing Winsat Path Parsing - File
  T1548.002_uac-bypass-abusing-winsat-path-parsing-process.yml  [T1548.002]  UAC Bypass Abusing Winsat Path Parsing - Process
  T1548.002_uac-bypass-abusing-winsat-path-parsing-registry.yml  [T1548.002]  UAC Bypass Abusing Winsat Path Parsing - Registry
  T1548.002_uac-bypass-tools-using-computerdefaults.yml  [T1548.002]  UAC Bypass Tools Using ComputerDefaults
  T1548.002_uac-bypass-using-net-code-profiler-on-mmc.yml  [T1548.002]  UAC Bypass Using .NET Code Profiler on MMC
  T1548.002_uac-bypass-using-changepk-and-slui.yml  [T1548.002]  UAC Bypass Using ChangePK and SLUI
  T1548.002_uac-bypass-using-consent-and-comctl32-file.yml  [T1548.002]  UAC Bypass Using Consent and Comctl32 - File
  T1548.002_uac-bypass-using-consent-and-comctl32-process.yml  [T1548.002]  UAC Bypass Using Consent and Comctl32 - Process
  T1548.002_uac-bypass-using-disk-cleanup.yml  [T1548.002]  UAC Bypass Using Disk Cleanup
  T1548.002_uac-bypass-using-dismhost.yml  [T1548.002]  UAC Bypass Using DismHost
  uac-bypass-using-event-viewer-recentviews.yml  []  UAC Bypass Using Event Viewer RecentViews
  uac-bypass-using-eventvwr.yml  []  UAC Bypass Using EventVwr
  T1548.002_uac-bypass-using-idiagnostic-profile.yml  [T1548.002]  UAC Bypass Using IDiagnostic Profile
  T1548.002_uac-bypass-using-idiagnostic-profile-file.yml  [T1548.002]  UAC Bypass Using IDiagnostic Profile - File
  T1548.002_uac-bypass-using-ieinstal-file.yml  [T1548.002]  UAC Bypass Using IEInstal - File
  T1548.002_uac-bypass-using-ieinstal-process.yml  [T1548.002]  UAC Bypass Using IEInstal - Process
  T1548.002_uac-bypass-using-iscsicpl-imageload.yml  [T1548.002]  UAC Bypass Using Iscsicpl - ImageLoad
  T1548.002_uac-bypass-using-msconfig-token-modification-file.yml  [T1548.002]  UAC Bypass Using MSConfig Token Modification - File
  T1548.002_uac-bypass-using-msconfig-token-modification-process.yml  [T1548.002]  UAC Bypass Using MSConfig Token Modification - Process
  T1548.002_uac-bypass-using-ntfs-reparse-point-file.yml  [T1548.002]  UAC Bypass Using NTFS Reparse Point - File
  T1548.002_uac-bypass-using-ntfs-reparse-point-process.yml  [T1548.002]  UAC Bypass Using NTFS Reparse Point - Process
  T1548.002_uac-bypass-using-pkgmgr-and-dism.yml  [T1548.002]  UAC Bypass Using PkgMgr and DISM
  T1548.002_uac-bypass-using-wow64-logger-dll-hijack.yml  [T1548.002]  UAC Bypass Using WOW64 Logger DLL Hijack
  T1548.002_uac-bypass-using-windows-media-player-file.yml  [T1548.002]  UAC Bypass Using Windows Media Player - File
  T1548.002_uac-bypass-using-windows-media-player-process.yml  [T1548.002]  UAC Bypass Using Windows Media Player - Process
  T1548.002_uac-bypass-using-windows-media-player-registry.yml  [T1548.002]  UAC Bypass Using Windows Media Player - Registry
  T1548.002_uac-bypass-via-wsreset.yml  [T1548.002]  UAC Bypass Via Wsreset
  T1548.002_uac-bypass-wsreset.yml  [T1548.002]  UAC Bypass WSReset
  T1548.002_uac-bypass-with-fake-dll.yml  [T1548.002,T1574.001]  UAC Bypass With Fake DLL
  T1548.002_uac-bypass-via-event-viewer.yml  [T1548.002]  UAC Bypass via Event Viewer
  T1548.002_uac-bypass-via-icmluautil.yml  [T1548.002]  UAC Bypass via ICMLuaUtil
  T1548.002_uac-bypass-via-sdclt.yml  [T1548.002]  UAC Bypass via Sdclt
  T1542.001_uefi-persistence-via-wpbbin-filecreation.yml  [T1542.001]  UEFI Persistence Via Wpbbin - FileCreation
  T1542.001_uefi-persistence-via-wpbbin-processcreation.yml  [T1542.001]  UEFI Persistence Via Wpbbin - ProcessCreation
  T1059.001_unc2452-process-creation-patterns.yml  [T1059.001]  UNC2452 Process Creation Patterns
  unc4841-barracuda-esg-exploitation-indicators.yml  []  UNC4841 - Barracuda ESG Exploitation Indicators
  T1140_unc4841-download-compressed-files-from-temp-sh-using-wget.yml  [T1140]  UNC4841 - Download Compressed Files From Temp.sh Using Wget
  T1140_unc4841-download-tar-file-from-untrusted-direct-ip-via-wget.yml  [T1140]  UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
  unc4841-email-exfiltration-file-pattern.yml  []  UNC4841 - Email Exfiltration File Pattern
  T1140_unc4841-ssl-certificate-exfiltration-via-openssl.yml  [T1140]  UNC4841 - SSL Certificate Exfiltration Via Openssl
  T1202_uncommon-child-process-of-setres-exe.yml  [T1202,T1218]  Uncommon Child Process Of Setres.EXE
  T1685_uncommon-extension-in-keyboard-layout-ime-file-registry-valu.yml  [T1685]  Uncommon Extension In Keyboard Layout IME File Registry Value
  T1587.001_uncommon-file-created-in-office-startup-folder.yml  [T1587.001]  Uncommon File Created In Office Startup Folder
  T1195.002_uncommon-file-created-by-notepad-updater-gup-exe.yml  [T1195.002,T1557]  Uncommon File Created by Notepad++ Updater Gup.EXE
  uncommon-file-creation-by-mysql-daemon-process.yml  []  Uncommon File Creation By Mysql Daemon Process
  uncommon-filesystem-load-attempt-by-format-com.yml  []  Uncommon FileSystem Load Attempt By Format.com
  T1112_uncommon-microsoft-office-trusted-location-added.yml  [T1112]  Uncommon Microsoft Office Trusted Location Added
  T1105_uncommon-network-connection-initiated-by-certutil-exe.yml  [T1105]  Uncommon Network Connection Initiated By Certutil.EXE
  T1053.005_uncommon-one-time-only-scheduled-task-at-00-00.yml  [T1053.005]  Uncommon One Time Only Scheduled Task At 00:00
  T1036.005_uncommon-svchost-command-line-parameter.yml  [T1036.005,T1055,T1055.012]  Uncommon Svchost Command Line Parameter
  T1037.001_uncommon-userinit-child-process.yml  [T1037.001]  Uncommon Userinit Child Process
  T1078_unfamiliar-sign-in-properties.yml  [T1078]  Unfamiliar Sign-In Properties
  T1685_uninstall-crowdstrike-falcon-sensor.yml  [T1685]  Uninstall Crowdstrike Falcon Sensor
  T1685_uninstall-sysinternals-sysmon.yml  [T1685]  Uninstall Sysinternals Sysmon
  T1574.001_unsigned-binary-loaded-from-suspicious-location.yml  [T1574.001]  Unsigned Binary Loaded From Suspicious Location
  T1574.001_unsigned-mfdetours-dll-sideloading.yml  [T1574.001]  Unsigned Mfdetours.DLL Sideloading
  T1133_unusual-child-process-of-dns-exe.yml  [T1133]  Unusual Child Process of dns.exe
  T1133_unusual-file-deletion-by-dns-exe.yml  [T1133]  Unusual File Deletion by Dns.exe
  T1564.004_unusual-file-download-from-direct-ip-address.yml  [T1564.004]  Unusual File Download from Direct IP Address
  T1133_unusual-file-modification-by-dns-exe.yml  [T1133]  Unusual File Modification by dns.exe
  T1071.001_ursnif-malware-download-url-pattern.yml  [T1071.001]  Ursnif Malware Download URL Pattern
  T1059_ursnif-redirection-of-discovery-commands.yml  [T1059]  Ursnif Redirection Of Discovery Commands
  T1588.002_usage-of-renamed-sysinternals-tools-registryset.yml  [T1588.002]  Usage of Renamed Sysinternals Tools - RegistrySet
  T1078.004_use-of-legacy-authentication-protocols.yml  [T1078.004,T1110]  Use of Legacy Authentication Protocols
  T1124_use-of-w32tm-as-timer.yml  [T1124]  Use of W32tm as Timer
  T1098_user-added-to-highly-privileged-group.yml  [T1098]  User Added To Highly Privileged Group
  T1078.004_user-added-to-privilege-role.yml  [T1078.004]  User Added To Privilege Role
  T1021.001_user-added-to-remote-desktop-users-group.yml  [T1021.001,T1133,T1136.001]  User Added to Remote Desktop Users Group
  T1558.003_user-couldn-t-call-a-privileged-service-lsaregisterlogonproc.yml  [T1558.003]  User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'
  user-risk-and-mfa-registration-policy-updated.yml  []  User Risk and MFA Registration Policy Updated
  T1112_user-shell-folders-registry-modification-via-commandline.yml  [T1112,T1547.001]  User Shell Folders Registry Modification via CommandLine
  T1078.004_users-added-to-global-or-device-admin-roles.yml  [T1078.004]  Users Added to Global or Device Admin Roles
  T1574.008_using-settingsynchost-exe-as-lolbin.yml  [T1574.008]  Using SettingSyncHost.exe as LOLBin
  T1204.002_vba-dll-loaded-via-office-application.yml  [T1204.002]  VBA DLL Loaded Via Office Application
  T1547.001_vbscript-payload-stored-in-registry.yml  [T1547.001]  VBScript Payload Stored in Registry
  T1574.001_vmmap-unsigned-dbghelp-dll-potential-sideloading.yml  [T1574.001]  VMMap Unsigned Dbghelp.DLL Potential Sideloading
  T1059_vmtoolsd-suspicious-child-process.yml  [T1059]  VMToolsd Suspicious Child Process
  T1190_vmware-vcenter-server-file-upload-cve-2021-22005.yml  [T1190]  VMware vCenter Server File Upload CVE-2021-22005
  veeam-backup-servers-credential-dumping-script-execution.yml  []  Veeam Backup Servers Credential Dumping Script Execution
  T1005_veeambackup-database-credentials-dump-via-sqlcmd-exe.yml  [T1005]  VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
  T1059_vim-gtfobin-abuse-linux.yml  [T1059,T1083]  Vim GTFOBin Abuse - Linux
  T1027.004_visual-basic-command-line-compiler-usage.yml  [T1027.004]  Visual Basic Command Line Compiler Usage
  T1003.002_volumeshadowcopy-symlink-creation-via-mklink.yml  [T1003.002,T1003.003]  VolumeShadowCopy Symlink Creation Via Mklink
  T1685_vulnerable-driver-blocklist-registry-tampering-via-commandli.yml  [T1685]  Vulnerable Driver Blocklist Registry Tampering Via CommandLine
  T1068_vulnerable-driver-load.yml  [T1068,T1543.003]  Vulnerable Driver Load
  T1543.003_vulnerable-hacksys-extreme-vulnerable-driver-load.yml  [T1543.003]  Vulnerable HackSys Extreme Vulnerable Driver Load
  T1548_vulnerable-netlogon-secure-channel-connection-allowed.yml  [T1548]  Vulnerable Netlogon Secure Channel Connection Allowed
  T1543.003_vulnerable-winring0-driver-load.yml  [T1543.003]  Vulnerable WinRing0 Driver Load
  T1547_winekey-registry-modification.yml  [T1547]  WINEKEY Registry Modification
  T1546.003_wmi-persistence-command-line-event-consumer.yml  [T1546.003]  WMI Persistence - Command Line Event Consumer
  T1546.003_wmi-persistence-script-event-consumer-file-write.yml  [T1546.003]  WMI Persistence - Script Event Consumer File Write
  T1047_wmimplant-hack-tool.yml  [T1047,T1059.001]  WMImplant Hack Tool
  T1202_wsl-kali-linux-usage.yml  [T1202]  WSL Kali-Linux Usage
  T1059.005_wscript-or-cscript-dropper-file.yml  [T1059.005,T1059.007]  WScript or CScript Dropper - File
  wab-execution-from-non-default-location.yml  []  Wab Execution From Non Default Location
  wab-wabmig-unusual-parent-or-child-processes.yml  []  Wab/Wabmig Unusual Parent Or Child Processes
  T1071.001_wannacry-killswitch-domain.yml  [T1071.001]  Wannacry Killswitch Domain
  T1112_wdigest-credguard-registry-modification.yml  [T1112]  Wdigest CredGuard Registry Modification
  T1112_wdigest-enable-uselogoncredential.yml  [T1112]  Wdigest Enable UseLogonCredential
  T1685_weak-encryption-enabled-and-kerberoast.yml  [T1685]  Weak Encryption Enabled and Kerberoast
  T1018_webshell-detection-with-command-line-keywords.yml  [T1018,T1033,T1087,T1505.003]  Webshell Detection With Command Line Keywords
  T1018_webshell-hacking-activity-patterns.yml  [T1018,T1033,T1087,T1505.003]  Webshell Hacking Activity Patterns
  T1505.003_webshell-regeorg-detection-via-web-logs.yml  [T1505.003]  Webshell ReGeorg Detection Via Web Logs
  T1505.003_webshell-tool-reconnaissance-activity.yml  [T1505.003]  Webshell Tool Reconnaissance Activity
  T1003.001_werfault-lsass-process-memory-dump.yml  [T1003.001]  WerFault LSASS Process Memory Dump
  T1033_whoami-as-parameter.yml  [T1033]  WhoAmI as Parameter
  T1033_whoami-exe-execution-from-privileged-process.yml  [T1033]  Whoami.EXE Execution From Privileged Process
  T1685_win-defender-restored-quarantine-file.yml  [T1685]  Win Defender Restored Quarantine File
  T1557.001_windivert-driver-load.yml  [T1557.001,T1599.001]  WinDivert Driver Load
  T1547.001_winrar-creating-files-in-startup-locations.yml  [T1547.001]  WinRAR Creating Files in Startup Locations
  T1685_windows-amsi-related-registry-tampering-via-commandline.yml  [T1685]  Windows AMSI Related Registry Tampering Via CommandLine
  T1036_windows-binaries-write-suspicious-extensions.yml  [T1036]  Windows Binaries Write Suspicious Extensions
  T1685_windows-credential-guard-disabled-registry.yml  [T1685]  Windows Credential Guard Disabled - Registry
  T1685_windows-credential-guard-registry-tampering-via-commandline.yml  [T1685]  Windows Credential Guard Registry Tampering Via CommandLine
  T1685_windows-credential-guard-related-registry-value-deleted-regi.yml  [T1685]  Windows Credential Guard Related Registry Value Deleted - Registry
  T1059_windows-defender-amsi-trigger-detected.yml  [T1059]  Windows Defender AMSI Trigger Detected
  T1685_windows-defender-configuration-changes.yml  [T1685]  Windows Defender Configuration Changes
  T1685_windows-defender-context-menu-removed.yml  [T1685]  Windows Defender Context Menu Removed
  T1685_windows-defender-definition-files-removed.yml  [T1685]  Windows Defender Definition Files Removed
  T1685_windows-defender-exploit-guard-tamper.yml  [T1685]  Windows Defender Exploit Guard Tamper
  T1685_windows-defender-grace-period-expired.yml  [T1685]  Windows Defender Grace Period Expired
  T1685_windows-defender-malware-and-pua-scanning-disabled.yml  [T1685]  Windows Defender Malware And PUA Scanning Disabled
  T1685_windows-defender-real-time-protection-disabled.yml  [T1685]  Windows Defender Real-time Protection Disabled
  T1685_windows-defender-service-disabled-registry.yml  [T1685]  Windows Defender Service Disabled - Registry
  T1059_windows-defender-threat-detected.yml  [T1059]  Windows Defender Threat Detected
  T1685_windows-defender-threat-severity-default-action-modified.yml  [T1685]  Windows Defender Threat Severity Default Action Modified
  T1685_windows-defender-virus-scanning-feature-disabled.yml  [T1685]  Windows Defender Virus Scanning Feature Disabled
  T1112_windows-event-log-access-tampering-via-registry.yml  [T1112,T1547.001]  Windows Event Log Access Tampering Via Registry
  T1685.001_windows-eventlog-autologger-session-registry-modification-vi.yml  [T1685.001]  Windows EventLog Autologger Session Registry Modification Via CommandLine
  T1685_windows-filtering-platform-blocked-connection-from-edr-agent.yml  [T1685]  Windows Filtering Platform Blocked Connection From EDR Agent Binary
  T1685_windows-hypervisor-enforced-code-integrity-disabled.yml  [T1685]  Windows Hypervisor Enforced Code Integrity Disabled
  T1021.002_windows-internet-hosted-webdav-share-mount-via-net-exe.yml  [T1021.002]  Windows Internet Hosted WebDav Share Mount Via Net.EXE
  T1098.005_windows-laps-credential-dump-from-entra-id.yml  [T1098.005]  Windows LAPS Credential Dump From Entra ID
  T1059_windows-shell-scripting-application-file-write-to-suspicious.yml  [T1059]  Windows Shell/Scripting Application File Write to Suspicious Folder
  T1059.001_windows-shell-scripting-processes-spawning-suspicious-progra.yml  [T1059.001,T1059.005,T1218]  Windows Shell/Scripting Processes Spawning Suspicious Programs
  T1059_windows-suspicious-child-process-from-node-js-react2shell.yml  [T1059,T1190]  Windows Suspicious Child Process from Node.js - React2Shell
  T1685_windows-vulnerable-driver-blocklist-disabled.yml  [T1685]  Windows Vulnerable Driver Blocklist Disabled
  T1071.001_windows-webdav-user-agent.yml  [T1071.001]  Windows WebDAV User Agent
  T1505.003_windows-webshell-strings.yml  [T1505.003]  Windows Webshell Strings
  T1547.004_winlogon-notify-key-logon-persistence.yml  [T1547.004]  Winlogon Notify Key Logon Persistence
  T1021.006_winrs-local-command-execution.yml  [T1021.006,T1218]  Winrs Local Command Execution
  T1021.002_wmiprvse-wbemcomn-dll-hijack.yml  [T1021.002,T1047]  Wmiprvse Wbemcomn DLL Hijack
  wusa-exe-executed-by-parent-process-located-in-suspicious-lo.yml  []  Wusa.EXE Executed By Parent Process Located In Suspicious Location
  T1574.001_xwizard-exe-execution-from-non-default-location.yml  [T1574.001]  Xwizard.EXE Execution From Non-Default Location
  T1021.002_smbexec-py-service-installation.yml  [T1021.002,T1569.002]  smbexec.py Service Installation
