threatengine.sh Sigma export
format: generic Sigma (one .yml per rule, the raw rule)
rules: 1492

files:
  class-extension-uri-ending-request.yml  []  .Class Extension URI Ending Request
  T1560.001_7zip-compressing-dump-files.yml  [T1560.001]  7Zip Compressing Dump Files
  T1098_a-new-trust-was-created-to-a-domain.yml  [T1098]  A New Trust Was Created To A Domain
  T1686.003_a-rule-has-been-deleted-from-the-windows-firewall-exception.yml  [T1686.003]  A Rule Has Been Deleted From The Windows Firewall Exception List
  T1069.002_adexplorer-writing-complete-ad-snapshot-into-dat-file.yml  [T1069.002,T1087.002,T1482]  ADExplorer Writing Complete AD Snapshot Into .dat File
  T1005_adfs-database-named-pipe-connection-by-uncommon-tool.yml  [T1005]  ADFS Database Named Pipe Connection By Uncommon Tool
  T1070.004_ads-zone-identifier-deleted-by-uncommon-application.yml  [T1070.004]  ADS Zone.Identifier Deleted By Uncommon Application
  T1001.003_adsi-cache-file-creation-by-uncommon-tool.yml  [T1001.003]  ADSI-Cache File Creation By Uncommon Tool
  T1216_awl-bypass-with-winrm-vbs-and-malicious-wsmpty-xsl-wsmtxt-xs.yml  [T1216]  AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl
  T1216_awl-bypass-with-winrm-vbs-and-malicious-wsmpty-xsl-wsmtxt-xs_2.yml  [T1216]  AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
  aws-bucket-deleted.yml  []  AWS Bucket Deleted
  T1685.002_aws-cloudtrail-important-change.yml  [T1685.002]  AWS CloudTrail Important Change
  T1021.007_aws-console-getsignintoken-potential-abuse.yml  [T1021.007,T1550.001]  AWS Console GetSigninToken Potential Abuse
  T1078.004_aws-console-login-monitoring.yml  [T1078.004]  AWS Console Login Monitoring
  T1110_aws-consolelogin-failed-authentication.yml  [T1110]  AWS ConsoleLogin Failed Authentication
  T1486_aws-ec2-disable-ebs-encryption.yml  [T1486,T1565]  AWS EC2 Disable EBS Encryption
  T1525_aws-ecs-task-definition-that-queries-the-credential-endpoint.yml  [T1525]  AWS ECS Task Definition That Queries The Credential Endpoint
  aws-efs-fileshare-modified-or-deleted.yml  []  AWS EFS Fileshare Modified or Deleted
  T1485_aws-efs-fileshare-mount-modified-or-deleted.yml  [T1485]  AWS EFS Fileshare Mount Modified or Deleted
  aws-enableregion-command-monitoring.yml  []  AWS EnableRegion Command Monitoring
  T1098_aws-iam-backdoor-users-keys.yml  [T1098]  AWS IAM Backdoor Users Keys
  T1078_aws-key-pair-import-activity.yml  [T1078]  AWS Key Pair Import Activity
  T1020_aws-rds-master-password-change.yml  [T1020]  AWS RDS Master Password Change
  T1078.004_aws-root-credentials.yml  [T1078.004]  AWS Root Credentials
  T1490_aws-s3-bucket-versioning-disable.yml  [T1490]  AWS S3 Bucket Versioning Disable
  T1078.004_aws-saml-provider-deletion-activity.yml  [T1078.004,T1531]  AWS SAML Provider Deletion Activity
  T1087.004_aws-sts-getcalleridentity-enumeration-via-trufflehog.yml  [T1087.004]  AWS STS GetCallerIdentity Enumeration Via TruffleHog
  T1537_aws-snapshot-backup-exfiltration.yml  [T1537]  AWS Snapshot Backup Exfiltration
  T1078.004_aws-successful-console-login-without-mfa.yml  [T1078.004]  AWS Successful Console Login Without MFA
  T1078_aws-suspicious-saml-activity.yml  [T1078,T1548,T1550,T1550.001]  AWS Suspicious SAML Activity
  T1218_abusing-print-executable.yml  [T1218]  Abusing Print Executable
  T1003_access-to-crypto-currency-wallets-by-uncommon-applications.yml  [T1003]  Access To Crypto Currency Wallets By Uncommon Applications
  T1552.006_access-to-potentially-sensitive-sysvol-files-by-uncommon-app.yml  [T1552.006]  Access To Potentially Sensitive Sysvol Files By Uncommon Applications
  T1552.006_access-to-sysvol-policies-share-by-uncommon-process.yml  [T1552.006]  Access To Sysvol Policies Share By Uncommon Process
  T1555.004_access-to-windows-credential-history-file-by-uncommon-applic.yml  [T1555.004]  Access To Windows Credential History File By Uncommon Applications
  T1555.004_access-to-windows-dpapi-master-keys-by-uncommon-applications.yml  [T1555.004]  Access To Windows DPAPI Master Keys By Uncommon Applications
  T1592.004_access-of-sudoers-file-content.yml  [T1592.004]  Access of Sudoers File Content
  T1555.003_access-to-browser-login-data.yml  [T1555.003]  Access to Browser Login Data
  T1078_account-created-and-deleted-by-non-approved-users.yml  [T1078]  Account Created And Deleted By Non Approved Users
  T1078.004_account-disabled-or-blocked-for-sign-in-attempts.yml  [T1078.004]  Account Disabled or Blocked for Sign in Attempts
  T1110_account-lockout.yml  [T1110]  Account Lockout
  T1078_account-tampering-suspicious-failed-logon-reasons.yml  [T1078]  Account Tampering - Suspicious Failed Logon Reasons
  T1112_activate-suppression-of-windows-security-center-notification.yml  [T1112]  Activate Suppression of Windows Security Center Notifications
  T1069.002_active-directory-database-snapshot-via-adexplorer.yml  [T1069.002,T1087.002,T1482]  Active Directory Database Snapshot Via ADExplorer
  T1087.002_active-directory-structure-export-via-csvde-exe.yml  [T1087.002]  Active Directory Structure Export Via Csvde.EXE
  active-directory-structure-export-via-ldifde-exe.yml  []  Active Directory Structure Export Via Ldifde.EXE
  activity-performed-by-terminated-user.yml  []  Activity Performed by Terminated User
  T1573_activity-from-anonymous-ip-addresses.yml  [T1573]  Activity from Anonymous IP Addresses
  T1573_activity-from-infrequent-country.yml  [T1573]  Activity from Infrequent Country
  T1573_activity-from-suspicious-ip-addresses.yml  [T1573]  Activity from Suspicious IP Addresses
  add-debugger-entry-to-aedebug-for-persistence.yml  []  Add Debugger Entry To AeDebug For Persistence
  T1112_add-disallowrun-execution-to-registry.yml  [T1112]  Add DisallowRun Execution to Registry
  T1059_add-new-download-source-to-winget.yml  [T1059]  Add New Download Source To Winget
  T1547.010_add-port-monitor-persistence-in-registry.yml  [T1547.010]  Add Port Monitor Persistence in Registry
  T1059_add-potential-suspicious-new-download-source-to-winget.yml  [T1059]  Add Potential Suspicious New Download Source To Winget
  add-windows-capability-via-powershell-cmdlet.yml  []  Add Windows Capability Via PowerShell Cmdlet
  add-windows-capability-via-powershell-script.yml  []  Add Windows Capability Via PowerShell Script
  T1552_added-owner-to-application.yml  [T1552]  Added Owner To Application
  T1218_addinutil-exe-execution-from-uncommon-directory.yml  [T1218]  AddinUtil.EXE Execution From Uncommon Directory
  T1134.005_addition-of-sid-history-to-active-directory-object.yml  [T1134.005]  Addition of SID History to Active Directory Object
  T1046_advanced-ip-scanner-file-event.yml  [T1046]  Advanced IP Scanner - File Event
  T1218_agentexecutor-powershell-execution.yml  [T1218]  AgentExecutor PowerShell Execution
  T1112_allow-rdp-remote-assistance-feature.yml  [T1112]  Allow RDP Remote Assistance Feature
  T1059.001_alternate-powershell-hosts-powershell-module.yml  [T1059.001]  Alternate PowerShell Hosts - PowerShell Module
  T1059.001_alternate-powershell-hosts-pipe.yml  [T1059.001]  Alternate PowerShell Hosts Pipe
  T1548.002_always-install-elevated-msi-spawned-cmd-and-powershell.yml  [T1548.002]  Always Install Elevated MSI Spawned Cmd And Powershell
  T1548.002_always-install-elevated-windows-installer.yml  [T1548.002]  Always Install Elevated Windows Installer
  amsi-dll-loaded-via-lolbin-process.yml  []  Amsi.DLL Loaded Via LOLBIN Process
  anydesk-remote-access-software-service-installation.yml  []  Anydesk Remote Access Software Service Installation
  T1219.002_anydesk-temporary-artefact.yml  [T1219.002]  Anydesk Temporary Artefact
  T1190_apache-threading-error.yml  [T1190,T1210]  Apache Threading Error
  T1098.003_app-assigned-to-azure-rbac-microsoft-entra-role.yml  [T1098.003]  App Assigned To Azure RBAC/Microsoft Entra Role
  T1059.001_applocker-prevented-application-or-script-from-running.yml  [T1059.001,T1059.003,T1059.005,T1059.006,T1059.007,T1204.002]  AppLocker Prevented Application or Script from Running
  appx-located-in-uncommon-directory-added-to-deployment-pipel.yml  []  AppX Located in Uncommon Directory Added to Deployment Pipeline
  appx-package-deployment-failed-due-to-signing-requirements.yml  []  AppX Package Deployment Failed Due to Signing Requirements
  T1105_appx-package-installation-attempts-via-appinstaller-exe.yml  [T1105]  AppX Package Installation Attempts Via AppInstaller.EXE
  T1047_application-removed-via-wmic-exe.yml  [T1047]  Application Removed Via Wmic.EXE
  T1047_application-terminated-via-wmic-exe.yml  [T1047]  Application Terminated Via Wmic.EXE
  T1078_application-using-device-code-authentication-flow.yml  [T1078]  Application Using Device Code Authentication Flow
  T1078_applications-that-are-using-ropc-authentication-flow.yml  [T1078]  Applications That Are Using ROPC Authentication Flow
  arbitrary-binary-execution-using-gup-utility.yml  []  Arbitrary Binary Execution Using GUP Utility
  T1202_arbitrary-command-execution-using-wsl.yml  [T1202,T1218]  Arbitrary Command Execution Using WSL
  T1218_arbitrary-dll-or-csproj-code-execution-via-dotnet-exe.yml  [T1218]  Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
  T1567_arbitrary-file-download-via-configsecuritypolicy-exe.yml  [T1567]  Arbitrary File Download Via ConfigSecurityPolicy.EXE
  T1105_arbitrary-file-download-via-gfxdownloadwrapper-exe.yml  [T1105]  Arbitrary File Download Via GfxDownloadWrapper.EXE
  T1218_arbitrary-file-download-via-msedge-proxy-exe.yml  [T1218]  Arbitrary File Download Via MSEDGE_PROXY.EXE
  T1218_arbitrary-file-download-via-msohtmed-exe.yml  [T1218]  Arbitrary File Download Via MSOHTMED.EXE
  T1218_arbitrary-file-download-via-mspub-exe.yml  [T1218]  Arbitrary File Download Via MSPUB.EXE
  T1218_arbitrary-file-download-via-presentationhost-exe.yml  [T1218]  Arbitrary File Download Via PresentationHost.EXE
  T1218_arbitrary-file-download-via-squirrel-exe.yml  [T1218]  Arbitrary File Download Via Squirrel.EXE
  T1218_arbitrary-msi-download-via-devinit-exe.yml  [T1218]  Arbitrary MSI Download Via Devinit.EXE
  T1204_arbitrary-shell-command-execution-via-settingcontent-ms.yml  [T1204,T1566.001]  Arbitrary Shell Command Execution Via Settingcontent-Ms
  T1127_aspnetcompiler-execution.yml  [T1127]  AspNetCompiler Execution
  assembly-dll-creation-via-aspnetcompiler.yml  []  Assembly DLL Creation Via AspNetCompiler
  T1216_assembly-loading-via-cl-loadassembly-ps1.yml  [T1216]  Assembly Loading Via CL_LoadAssembly.ps1
  T1218_atbroker-registry-change.yml  [T1218,T1547]  Atbroker Registry Change
  T1123_audio-capture-via-powershell.yml  [T1123]  Audio Capture via PowerShell
  T1123_audio-capture-via-soundrecorder.yml  [T1123]  Audio Capture via SoundRecorder
  T1078_authentications-to-important-apps-using-single-factor-authen.yml  [T1078]  Authentications To Important Apps Using Single Factor Authentication
  T1119_automated-collection-command-powershell.yml  [T1119]  Automated Collection Command PowerShell
  T1119_automated-collection-command-prompt.yml  [T1119,T1552.001]  Automated Collection Command Prompt
  T1012_azure-ad-health-monitoring-agent-registry-keys-access.yml  [T1012]  Azure AD Health Monitoring Agent Registry Keys Access
  T1012_azure-ad-health-service-agents-registry-keys-access.yml  [T1012]  Azure AD Health Service Agents Registry Keys Access
  T1578_azure-active-directory-hybrid-health-ad-fs-new-server.yml  [T1578]  Azure Active Directory Hybrid Health AD FS New Server
  T1578.003_azure-active-directory-hybrid-health-ad-fs-service-delete.yml  [T1578.003]  Azure Active Directory Hybrid Health AD FS Service Delete
  T1489_azure-application-deleted.yml  [T1489]  Azure Application Deleted
  azure-application-gateway-modified-or-deleted.yml  []  Azure Application Gateway Modified or Deleted
  azure-application-security-group-modified-or-deleted.yml  []  Azure Application Security Group Modified or Deleted
  T1565.001_azure-dns-zone-modified-or-deleted.yml  [T1565.001]  Azure DNS Zone Modified or Deleted
  azure-device-no-longer-managed-or-compliant.yml  []  Azure Device No Longer Managed or Compliant
  T1485_azure-device-or-configuration-modified-or-deleted.yml  [T1485,T1565.001]  Azure Device or Configuration Modified or Deleted
  T1078_azure-domain-federation-settings-modified.yml  [T1078]  Azure Domain Federation Settings Modified
  T1686.001_azure-firewall-modified-or-deleted.yml  [T1686.001]  Azure Firewall Modified or Deleted
  T1686.001_azure-firewall-rule-collection-modified-or-deleted.yml  [T1686.001]  Azure Firewall Rule Collection Modified or Deleted
  azure-firewall-rule-configuration-modified-or-deleted.yml  []  Azure Firewall Rule Configuration Modified or Deleted
  T1552_azure-key-vault-modified-or-deleted.yml  [T1552,T1552.001]  Azure Key Vault Modified or Deleted
  T1552_azure-keyvault-key-modified-or-deleted.yml  [T1552,T1552.001]  Azure Keyvault Key Modified or Deleted
  T1552_azure-keyvault-secrets-modified-or-deleted.yml  [T1552,T1552.001]  Azure Keyvault Secrets Modified or Deleted
  T1078_azure-kubernetes-admission-controller.yml  [T1078,T1552,T1552.007]  Azure Kubernetes Admission Controller
  T1053.003_azure-kubernetes-cronjob.yml  [T1053.003]  Azure Kubernetes CronJob
  T1685_azure-kubernetes-events-deleted.yml  [T1685]  Azure Kubernetes Events Deleted
  T1485_azure-kubernetes-network-policy-change.yml  [T1485,T1489,T1496]  Azure Kubernetes Network Policy Change
  azure-kubernetes-pods-deleted.yml  []  Azure Kubernetes Pods Deleted
  T1485_azure-kubernetes-rolebinding-clusterrolebinding-modified-and.yml  [T1485,T1489,T1496]  Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
  T1485_azure-kubernetes-secret-or-config-object-access.yml  [T1485,T1489,T1496]  Azure Kubernetes Secret or Config Object Access
  T1485_azure-kubernetes-sensitive-role-access.yml  [T1485,T1489,T1496]  Azure Kubernetes Sensitive Role Access
  T1485_azure-kubernetes-service-account-modified-or-deleted.yml  [T1485,T1489,T1496,T1531]  Azure Kubernetes Service Account Modified or Deleted
  T1686.001_azure-network-firewall-policy-modified-or-deleted.yml  [T1686.001]  Azure Network Firewall Policy Modified or Deleted
  azure-network-security-configuration-modified-or-deleted.yml  []  Azure Network Security Configuration Modified or Deleted
  T1059_azure-new-cloudshell-created.yml  [T1059]  Azure New CloudShell Created
  azure-owner-removed-from-application-or-service-principal.yml  []  Azure Owner Removed From Application or Service Principal
  azure-point-to-site-vpn-modified-or-deleted.yml  []  Azure Point-to-site VPN Modified or Deleted
  azure-service-principal-created.yml  []  Azure Service Principal Created
  azure-service-principal-removed.yml  []  Azure Service Principal Removed
  azure-suppression-rule-created.yml  []  Azure Suppression Rule Created
  T1078_azure-unusual-authentication-interruption.yml  [T1078]  Azure Unusual Authentication Interruption
  azure-vpn-connection-modified-or-deleted.yml  []  Azure VPN Connection Modified or Deleted
  azure-virtual-network-device-modified-or-deleted.yml  []  Azure Virtual Network Device Modified or Deleted
  azure-virtual-network-modified-or-deleted.yml  []  Azure Virtual Network Modified or Deleted
  T1197_bits-transfer-job-downloading-file-potential-suspicious-exte.yml  [T1197]  BITS Transfer Job Downloading File Potential Suspicious Extension
  T1197_bits-transfer-job-with-uncommon-or-suspicious-remote-tld.yml  [T1197]  BITS Transfer Job With Uncommon Or Suspicious Remote TLD
  T1059.004_bpftrace-unsafe-option-usage.yml  [T1059.004]  BPFtrace Unsafe Option Usage
  T1070.004_backup-catalog-deleted.yml  [T1070.004]  Backup Catalog Deleted
  T1490_backup-files-deleted.yml  [T1490]  Backup Files Deleted
  T1218_binary-proxy-execution-via-dotnet-trace-exe.yml  [T1218]  Binary Proxy Execution Via Dotnet-Trace.EXE
  T1685_bitbucket-audit-log-configuration-updated.yml  [T1685]  Bitbucket Audit Log Configuration Updated
  T1098_bitbucket-global-permission-changed.yml  [T1098]  Bitbucket Global Permission Changed
  T1021.004_bitbucket-global-ssh-settings-changed.yml  [T1021.004,T1685]  Bitbucket Global SSH Settings Changed
  T1685_bitbucket-global-secret-scanning-rule-deleted.yml  [T1685]  Bitbucket Global Secret Scanning Rule Deleted
  T1082_bitbucket-user-details-export-attempt-detected.yml  [T1082,T1213,T1591.004]  Bitbucket User Details Export Attempt Detected
  T1078.004_bitbucket-user-login-failure.yml  [T1078.004,T1110]  Bitbucket User Login Failure
  T1021.004_bitbucket-user-login-failure-via-ssh.yml  [T1021.004,T1110]  Bitbucket User Login Failure Via SSH
  T1082_bitbucket-user-permissions-export-attempt.yml  [T1082,T1213,T1591.004]  Bitbucket User Permissions Export Attempt
  T1078.004_bitlocker-key-retrieval.yml  [T1078.004]  Bitlocker Key Retrieval
  T1686_bpfdoor-tcp-ports-redirect.yml  [T1686]  Bpfdoor TCP Ports Redirect
  T1185_browser-started-with-remote-debugging.yml  [T1185]  Browser Started with Remote Debugging
  T1127_c-il-code-compilation-via-ilasm-exe.yml  [T1127]  C# IL Code Compilation Via Ilasm.EXE
  T1548_ca-policy-removed-by-non-approved-actor.yml  [T1548,T1556]  CA Policy Removed by Non Approved Actor
  T1548_ca-policy-updated-by-non-approved-actor.yml  [T1548,T1556]  CA Policy Updated by Non Approved Actor
  T1204.002_clr-dll-loaded-via-office-applications.yml  [T1204.002]  CLR DLL Loaded Via Office Applications
  T1546.015_com-hijacking-via-treatas.yml  [T1546.015]  COM Hijacking via TreatAs
  T1218_com-object-execution-via-xwizard-exe.yml  [T1218]  COM Object Execution via Xwizard.EXE
  T1569.002_csexec-service-file-creation.yml  [T1569.002]  CSExec Service File Creation
  T1569.002_csexec-service-installation.yml  [T1569.002]  CSExec Service Installation
  T1190_cve-2022-31659-vmware-workspace-one-access-rce.yml  [T1190]  CVE-2022-31659 VMware Workspace ONE Access RCE
  T1190_cve-2023-1389-potential-exploitation-attempt-unauthenticated.yml  [T1190]  CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21
  T1059_cve-2023-22518-exploitation-attempt-suspicious-confluence-ch.yml  [T1059,T1190]  CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)
  T1190_cve-2023-22518-exploitation-attempt-vulnerable-endpoint-conn.yml  [T1190]  CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)
  T1190_cve-2023-22518-exploitation-attempt-vulnerable-endpoint-conn_2.yml  [T1190]  CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)
  cve-2023-40477-potential-exploitation-winrar-application-cra.yml  []  CVE-2023-40477 Potential Exploitation - WinRAR Application Crash
  T1190_cve-2023-4966-potential-exploitation-attempt-citrix-adc-sens.yml  [T1190]  CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy
  T1190_cve-2023-4966-potential-exploitation-attempt-citrix-adc-sens_2.yml  [T1190]  CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
  cve-2024-1708-screenconnect-path-traversal-exploitation.yml  []  CVE-2024-1708 - ScreenConnect Path Traversal Exploitation
  cab-file-extraction-via-wusa-exe.yml  []  Cab File Extraction Via Wusa.EXE
  T1003_capture-credentials-with-rpcping-exe.yml  [T1003]  Capture Credentials with Rpcping.exe
  T1649_certificate-exported-from-local-certificate-store.yml  [T1649]  Certificate Exported From Local Certificate Store
  T1027_certificate-exported-via-certutil-exe.yml  [T1027]  Certificate Exported Via Certutil.EXE
  T1059.001_certificate-exported-via-powershell.yml  [T1059.001,T1552.004]  Certificate Exported Via PowerShell
  T1552.004_certificate-exported-via-powershell-scriptblock.yml  [T1552.004]  Certificate Exported Via PowerShell - ScriptBlock
  T1649_certificate-private-key-acquired.yml  [T1649]  Certificate Private Key Acquired
  certificate-use-with-no-strong-mapping.yml  []  Certificate Use With No Strong Mapping
  T1556_certificate-based-authentication-enabled.yml  [T1556]  Certificate-Based Authentication Enabled
  T1059.001_change-powershell-policies-to-an-insecure-level.yml  [T1059.001]  Change PowerShell Policies to an Insecure Level
  T1059.001_change-powershell-policies-to-an-insecure-level-powershell.yml  [T1059.001]  Change PowerShell Policies to an Insecure Level - PowerShell
  T1071.001_change-user-agents-with-webrequest.yml  [T1071.001]  Change User Agents with WebRequest
  T1098_change-to-authentication-method.yml  [T1098,T1556]  Change to Authentication Method
  T1574.011_changing-existing-service-imagepath-value-via-reg-exe.yml  [T1574.011]  Changing Existing Service ImagePath Value Via Reg.EXE
  T1222.002_chmod-targeting-sensitive-directories.yml  [T1222.002]  Chmod Targeting Sensitive Directories
  T1176.001_chromium-browser-instance-executed-with-custom-extension.yml  [T1176.001]  Chromium Browser Instance Executed With Custom Extension
  T1495_cisco-denial-of-service.yml  [T1495,T1529,T1565.001]  Cisco Denial of Service
  T1556.004_cisco-dot1x-disabled.yml  [T1556.004,T1685]  Cisco Dot1x Disabled
  cisco-duo-successful-mfa-authentication-via-bypass-code.yml  []  Cisco Duo Successful MFA Authentication Via Bypass Code
  T1070.004_cisco-file-deletion.yml  [T1070.004,T1561.001,T1561.002]  Cisco File Deletion
  T1053_cisco-modify-configuration.yml  [T1053,T1490,T1505,T1565.002]  Cisco Modify Configuration
  T1552.003_cisco-show-commands-input.yml  [T1552.003]  Cisco Show Commands Input
  T1040_cisco-sniffing.yml  [T1040]  Cisco Sniffing
  T1547.001_classes-autorun-keys-modification.yml  [T1547.001]  Classes Autorun Keys Modification
  T1070.003_clear-powershell-history-powershell.yml  [T1070.003]  Clear PowerShell History - PowerShell
  T1070.003_clear-powershell-history-powershell-module.yml  [T1070.003]  Clear PowerShell History - PowerShell Module
  T1685.006_clear-or-disable-kernel-ring-buffer-logs-via-syslog-syscall.yml  [T1685.006]  Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall
  T1059_clfs-sys-loaded-by-process-located-in-a-potential-suspicious.yml  [T1059]  Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
  clickonce-deployment-execution-dfsvc-exe-child-process.yml  []  ClickOnce Deployment Execution - Dfsvc.EXE Child Process
  T1112_clickonce-trust-prompt-tampering.yml  [T1112]  ClickOnce Trust Prompt Tampering
  T1059.002_clipboard-access-via-osascript.yml  [T1059.002,T1115]  Clipboard Access Via OSAScript
  T1115_clipboard-data-collection-via-pbpaste.yml  [T1115]  Clipboard Data Collection Via Pbpaste
  T1090.001_cloudflared-portable-execution.yml  [T1090.001]  Cloudflared Portable Execution
  T1090.001_cloudflared-quick-tunnel-execution.yml  [T1090.001]  Cloudflared Quick Tunnel Execution
  T1090_cloudflared-tunnel-connections-cleanup.yml  [T1090,T1102,T1572]  Cloudflared Tunnel Connections Cleanup
  T1090_cloudflared-tunnel-execution.yml  [T1090,T1102,T1572]  Cloudflared Tunnel Execution
  T1071.001_cloudflared-tunnels-related-dns-requests.yml  [T1071.001,T1572]  Cloudflared Tunnels Related DNS Requests
  T1564.003_cmd-launched-with-hidden-start-flags-to-suspicious-targets.yml  [T1564.003]  Cmd Launched with Hidden Start Flags to Suspicious Targets
  T1218.011_code-execution-via-pcwutl-dll.yml  [T1218.011]  Code Execution via Pcwutl.dll
  T1036_codepage-modification-via-mode-com-to-russian-language.yml  [T1036]  CodePage Modification Via MODE.COM To Russian Language
  T1059.001_command-line-execution-with-suspicious-url-and-appdata-strin.yml  [T1059.001,T1059.003,T1105]  Command Line Execution with Suspicious URL and AppData Strings
  T1547.001_common-autorun-keys-modification.yml  [T1547.001]  Common Autorun Keys Modification
  T1571_communication-to-uncommon-destination-ports.yml  [T1571]  Communication To Uncommon Destination Ports
  T1078.001_commvault-qlogin-with-publicsharinguser-and-guid-password-cv.yml  [T1078.001]  Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
  T1560.001_compress-data-and-lock-with-password-for-exfiltration-with-7.yml  [T1560.001]  Compress Data and Lock With Password for Exfiltration With 7-ZIP
  T1560.001_compress-data-and-lock-with-password-for-exfiltration-with-w.yml  [T1560.001]  Compress Data and Lock With Password for Exfiltration With WINZIP
  T1033_computer-discovery-and-export-via-get-adcomputer-cmdlet.yml  [T1033]  Computer Discovery And Export Via Get-ADComputer Cmdlet
  T1033_computer-discovery-and-export-via-get-adcomputer-cmdlet-powe.yml  [T1033]  Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
  computer-password-change-via-ksetup-exe.yml  []  Computer Password Change Via Ksetup.EXE
  T1047_computer-system-reconnaissance-via-wmic-exe.yml  [T1047]  Computer System Reconnaissance Via Wmic.EXE
  T1059_conhost-spawned-by-uncommon-parent-process.yml  [T1059]  Conhost Spawned By Uncommon Parent Process
  T1614.001_console-codepage-lookup-via-chcp.yml  [T1614.001]  Console CodePage Lookup Via CHCP
  T1027_convertto-securestring-cmdlet-usage-via-commandline.yml  [T1027,T1059.001]  ConvertTo-SecureString Cmdlet Usage Via CommandLine
  T1021.002_copy-from-or-to-admin-share-or-sysvol-folder.yml  [T1021.002,T1039,T1048]  Copy From Or To Admin Share Or Sysvol Folder
  T1003.002_crash-dump-created-by-operating-system.yml  [T1003.002,T1005]  Crash Dump Created By Operating System
  T1112_crashcontrol-crashdump-disabled.yml  [T1112,T1564]  CrashControl CrashDump Disabled
  T1055.001_createremotethread-api-and-loadlibrary.yml  [T1055.001]  CreateRemoteThread API and LoadLibrary
  T1055_created-files-by-microsoft-sync-center.yml  [T1055,T1218]  Created Files by Microsoft Sync Center
  T1136.001_creation-of-an-user-account.yml  [T1136.001]  Creation Of An User Account
  T1574.001_creation-of-non-existent-system-dll.yml  [T1574.001]  Creation Of Non-Existent System DLL
  T1036.005_creation-of-pod-in-system-namespace.yml  [T1036.005]  Creation Of Pod In System Namespace
  creation-of-a-suspicious-ads-file-outside-a-browser-download.yml  []  Creation Of a Suspicious ADS File Outside a Browser Download
  T1574.001_creation-of-werfault-exe-wer-dll-in-unusual-folder.yml  [T1574.001]  Creation of WerFault.exe/Wer.dll in Unusual Folder
  creation-of-a-diagcab.yml  []  Creation of a Diagcab
  T1056.002_credui-dll-loaded-by-uncommon-process.yml  [T1056.002]  CredUI.DLL Loaded By Uncommon Process
  T1003_credential-manager-access-by-uncommon-applications.yml  [T1003]  Credential Manager Access By Uncommon Applications
  T1555.001_credentials-from-password-stores-keychain.yml  [T1555.001]  Credentials from Password Stores - Keychain
  cscript-wscript-potentially-suspicious-child-process.yml  []  Cscript/Wscript Potentially Suspicious Child Process
  curl-web-request-with-potential-custom-user-agent.yml  []  Curl Web Request With Potential Custom User-Agent
  T1071.001_curl-exe-execution-with-custom-useragent.yml  [T1071.001]  Curl.EXE Execution With Custom UserAgent
  T1547.001_currentcontrolset-autorun-keys-modification.yml  [T1547.001]  CurrentControlSet Autorun Keys Modification
  T1547.001_currentversion-autorun-keys-modification.yml  [T1547.001]  CurrentVersion Autorun Keys Modification
  T1547.001_currentversion-nt-autorun-keys-modification.yml  [T1547.001]  CurrentVersion NT Autorun Keys Modification
  T1021.002_dcerpc-smb-spoolss-named-pipe.yml  [T1021.002]  DCERPC SMB Spoolss Named Pipe
  T1218.011_dll-call-by-ordinal-via-rundll32-exe.yml  [T1218.011]  DLL Call by Ordinal Via Rundll32.EXE
  T1574_dll-execution-via-register-cimprovider-exe.yml  [T1574]  DLL Execution Via Register-cimprovider.exe
  T1218_dll-execution-via-rasautou-exe.yml  [T1218]  DLL Execution via Rasautou.exe
  T1070_dll-load-by-system-process-from-suspicious-locations.yml  [T1070]  DLL Load By System Process From Suspicious Locations
  T1218_dll-loaded-via-certoc-exe.yml  [T1218]  DLL Loaded via CertOC.EXE
  T1574.001_dll-names-used-by-svr-for-graphicalproton-backdoor.yml  [T1574.001]  DLL Names Used By SVR For GraphicalProton Backdoor
  T1078.002_dmsa-service-account-created-in-specific-ous-powershell.yml  [T1078.002,T1098]  DMSA Service Account Created in Specific OUs - PowerShell
  T1218.010_dns-query-request-by-regsvr32-exe.yml  [T1218.010,T1559.001]  DNS Query Request By Regsvr32.EXE
  T1219.002_dns-query-to-azurewebsites-net-by-non-browser-process.yml  [T1219.002]  DNS Query To AzureWebsites.NET By Non-Browser Process
  T1071.004_dns-query-to-common-malware-hosting-and-shortener-services.yml  [T1071.004]  DNS Query To Common Malware Hosting and Shortener Services
  T1071.001_dns-query-to-devtunnels-domain.yml  [T1071.001,T1572]  DNS Query To Devtunnels Domain
  T1567.002_dns-query-to-mega-hosting-website.yml  [T1567.002]  DNS Query To MEGA Hosting Website
  T1567.002_dns-query-to-mega-hosting-website-dns-client.yml  [T1567.002]  DNS Query To MEGA Hosting Website - DNS Client
  dns-query-to-put-io-dns-client.yml  []  DNS Query To Put.io - DNS Client
  T1219.002_dns-query-to-remote-access-software-domain-from-non-browser.yml  [T1219.002]  DNS Query To Remote Access Software Domain From Non-Browser App
  T1071.001_dns-query-to-visual-studio-code-tunnels-domain.yml  [T1071.001]  DNS Query To Visual Studio Code Tunnels Domain
  T1048_dns-tor-proxies.yml  [T1048]  DNS TOR Proxies
  T1112_dns-over-https-enabled-by-registry.yml  [T1112,T1140]  DNS-over-HTTPS Enabled by Registry
  T1003.004_dpapi-domain-master-key-backup-attempt.yml  [T1003.004]  DPAPI Domain Master Key Backup Attempt
  T1059_darkgate-autoit3-exe-file-creation-by-uncommon-process.yml  [T1059,T1105]  DarkGate - Autoit3.EXE File Creation By Uncommon Process
  T1059_darkgate-drop-darkgate-loader-in-c-temp-directory.yml  [T1059]  DarkGate - Drop DarkGate Loader In C:\Temp Directory
  T1537_data-exfiltration-to-unsanctioned-apps.yml  [T1537]  Data Exfiltration to Unsanctioned Apps
  T1048.003_data-exfiltration-with-wget.yml  [T1048.003]  Data Exfiltration with Wget
  T1048_data-export-from-mssql-table-via-bcp-exe.yml  [T1048]  Data Export From MSSQL Table Via BCP.EXE
  T1003.001_dbghelp-dbgcore-dll-loaded-by-uncommon-suspicious-process.yml  [T1003.001]  Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process
  default-credentials-usage.yml  []  Default Credentials Usage
  T1053.005_defrag-deactivation.yml  [T1053.005]  Defrag Deactivation
  T1053_defrag-deactivation-security.yml  [T1053]  Defrag Deactivation - Security
  delete-defender-scan-shellex-context-menu-registry-key.yml  []  Delete Defender Scan ShellEx Context Menu Registry Key
  T1485_deleted-data-overwritten-via-cipher-exe.yml  [T1485]  Deleted Data Overwritten Via Cipher.EXE
  T1021.001_denied-access-to-remote-desktop.yml  [T1021.001]  Denied Access To Remote Desktop
  deployment-appx-package-was-blocked-by-applocker.yml  []  Deployment AppX Package Was Blocked By AppLocker
  deployment-of-the-appx-package-was-blocked-by-the-policy.yml  []  Deployment Of The AppX Package Was Blocked By The Policy
  T1547.009_desktop-ini-created-by-uncommon-process.yml  [T1547.009]  Desktop.INI Created by Uncommon Process
  T1518_detected-windows-software-discovery.yml  [T1518]  Detected Windows Software Discovery
  T1518_detected-windows-software-discovery-powershell.yml  [T1518]  Detected Windows Software Discovery - PowerShell
  T1059.001_detection-of-powershell-execution-via-sqlps-exe.yml  [T1059.001,T1127]  Detection of PowerShell Execution via Sqlps.exe
  T1200_device-installation-blocked.yml  [T1200]  Device Installation Blocked
  T1078.004_device-registration-or-join-without-mfa.yml  [T1078.004]  Device Registration or Join Without MFA
  T1218_devicecredentialdeployment-execution.yml  [T1218]  DeviceCredentialDeployment Execution
  T1203_dfsvc-exe-network-connection-to-non-local-ips.yml  [T1203]  Dfsvc.EXE Network Connection To Non-Local IPs
  T1547.001_direct-autorun-keys-modification.yml  [T1547.001]  Direct Autorun Keys Modification
  T1018_directorysearcher-powershell-exploitation.yml  [T1018]  DirectorySearcher Powershell Exploitation
  T1070.005_disable-administrative-share-creation-at-startup.yml  [T1070.005]  Disable Administrative Share Creation at Startup
  T1685_disable-exploit-guard-network-protection-on-windows-defender.yml  [T1685]  Disable Exploit Guard Network Protection on Windows Defender
  T1112_disable-internal-tools-or-feature-in-registry.yml  [T1112]  Disable Internal Tools or Feature in Registry
  T1686.003_disable-microsoft-defender-firewall-via-registry.yml  [T1686.003]  Disable Microsoft Defender Firewall via Registry
  T1489_disable-or-stop-services.yml  [T1489,T1685]  Disable Or Stop Services
  T1685_disable-privacy-settings-experience-in-registry.yml  [T1685]  Disable Privacy Settings Experience in Registry
  T1685_disable-security-tools.yml  [T1685]  Disable Security Tools
  T1685_disable-tamper-protection-on-windows-defender.yml  [T1685]  Disable Tamper Protection on Windows Defender
  T1686.003_disable-windows-firewall-by-registry.yml  [T1686.003]  Disable Windows Firewall by Registry
  T1112_disable-windows-security-center-notifications.yml  [T1112]  Disable Windows Security Center Notifications
  T1556_disabled-mfa-to-bypass-authentication-mechanisms.yml  [T1556]  Disabled MFA to Bypass Authentication Mechanisms
  T1686_disabling-security-tools.yml  [T1686]  Disabling Security Tools
  T1686_disabling-security-tools-builtin.yml  [T1686]  Disabling Security Tools - Builtin
  disk-image-creation-via-hdiutil-macos.yml  []  Disk Image Creation Via Hdiutil - MacOS
  T1560.001_disk-image-mounting-via-hdiutil-macos.yml  [T1560.001,T1566.001]  Disk Image Mounting Via Hdiutil - MacOS
  T1218_diskshadow-child-process-spawned.yml  [T1218]  Diskshadow Child Process Spawned
  T1218_diskshadow-script-mode-execution-from-potential-suspicious-l.yml  [T1218]  Diskshadow Script Mode - Execution From Potential Suspicious Location
  T1218_diskshadow-script-mode-uncommon-script-extension-execution.yml  [T1218]  Diskshadow Script Mode - Uncommon Script Extension Execution
  T1218_diskshadow-script-mode-execution.yml  [T1218]  Diskshadow Script Mode Execution
  T1685_dism-remove-online-package.yml  [T1685]  Dism Remove Online Package
  T1564.001_displaying-hidden-files-feature-disabled.yml  [T1564.001]  Displaying Hidden Files Feature Disabled
  T1190_django-framework-exceptions.yml  [T1190]  Django Framework Exceptions
  T1218.007_dllunregisterserver-function-call-via-msiexec-exe.yml  [T1218.007]  DllUnregisterServer Function Call Via Msiexec.EXE
  T1218_dllhost-exe-initiated-network-connection-to-non-local-ip-add.yml  [T1218,T1559.001]  Dllhost.EXE Initiated Network Connection To Non-Local IP Address
  T1482_domain-trust-discovery-via-dsquery.yml  [T1482]  Domain Trust Discovery Via Dsquery
  T1204.002_dotnet-assembly-dll-loaded-via-office-application.yml  [T1204.002]  DotNET Assembly DLL Loaded Via Office Application
  T1105_download-file-to-potentially-suspicious-directory-via-wget.yml  [T1105]  Download File To Potentially Suspicious Directory Via Wget
  T1105_download-from-suspicious-dyndns-hosts.yml  [T1105,T1568]  Download from Suspicious Dyndns Hosts
  T1218.008_driver-dll-installation-via-odbcconf-exe.yml  [T1218.008]  Driver/DLL Installation Via Odbcconf.EXE
  driverquery-exe-execution.yml  []  DriverQuery.EXE Execution
  drop-binaries-into-spool-drivers-color-folder.yml  []  Drop Binaries Into Spool Drivers Color Folder
  T1556.002_dropping-of-password-filter-dll.yml  [T1556.002]  Dropping Of Password Filter DLL
  T1555_dump-credentials-from-windows-credential-manager-with-powers.yml  [T1555]  Dump Credentials from Windows Credential Manager With PowerShell
  dump-ntds-dit-to-suspicious-location.yml  []  Dump Ntds.dit To Suspicious Location
  T1003.001_dumpminitool-execution.yml  [T1003.001,T1036]  DumpMinitool Execution
  T1003.001_dumping-process-via-sqldumper-exe.yml  [T1003.001]  Dumping Process via Sqldumper.exe
  T1027.004_dynamic-net-compilation-via-csc-exe.yml  [T1027.004]  Dynamic .NET Compilation Via Csc.EXE
  T1027.004_dynamic-net-compilation-via-csc-exe-hunting.yml  [T1027.004]  Dynamic .NET Compilation Via Csc.EXE - Hunting
  T1059.012_esxi-account-creation-via-esxcli.yml  [T1059.012,T1136]  ESXi Account Creation Via ESXCLI
  T1007_esxi-network-configuration-discovery-via-esxcli.yml  [T1007,T1033,T1059.012]  ESXi Network Configuration Discovery Via ESXCLI
  T1007_esxi-storage-information-discovery-via-esxcli.yml  [T1007,T1033,T1059.012]  ESXi Storage Information Discovery Via ESXCLI
  T1059.012_esxi-syslog-configuration-change-via-esxcli.yml  [T1059.012,T1685,T1690]  ESXi Syslog Configuration Change Via ESXCLI
  T1007_esxi-system-information-discovery-via-esxcli.yml  [T1007,T1033,T1059.012]  ESXi System Information Discovery Via ESXCLI
  T1059.012_esxi-vm-kill-via-esxcli.yml  [T1059.012,T1529]  ESXi VM Kill Via ESXCLI
  T1007_esxi-vm-list-discovery-via-esxcli.yml  [T1007,T1033,T1059.012]  ESXi VM List Discovery Via ESXCLI
  T1007_esxi-vsan-information-discovery-via-esxcli.yml  [T1007,T1033,T1059.012]  ESXi VSAN Information Discovery Via ESXCLI
  T1505.004_etw-logging-processing-option-disabled-on-iis-server.yml  [T1505.004,T1685.001]  ETW Logging/Processing Option Disabled On IIS Server
  T1685.001_evtx-created-in-uncommon-location.yml  [T1685.001]  EVTX Created In Uncommon Location
  T1059_elevated-system-shell-spawned.yml  [T1059]  Elevated System Shell Spawned
  T1059_elevated-system-shell-spawned-from-uncommon-parent-location.yml  [T1059]  Elevated System Shell Spawned From Uncommon Parent Location
  enable-bpf-kprobes-tracing.yml  []  Enable BPF Kprobes Tracing
  enable-local-manifest-installation-with-winget.yml  []  Enable Local Manifest Installation With Winget
  T1559.002_enable-microsoft-dynamic-data-exchange.yml  [T1559.002]  Enable Microsoft Dynamic Data Exchange
  T1685_enable-remote-connection-between-anonymous-computer-allowano.yml  [T1685]  Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
  T1021.006_enable-windows-remote-management.yml  [T1021.006]  Enable Windows Remote Management
  T1574.012_enabling-cor-profiler-environment-variables.yml  [T1574.012]  Enabling COR Profiler Environment Variables
  T1528_end-user-consent-blocked.yml  [T1528]  End User Consent Blocked
  T1033_enumerate-all-information-with-whoami-exe.yml  [T1033]  Enumerate All Information With Whoami.EXE
  T1555_enumerate-credentials-from-windows-credential-manager-with-p.yml  [T1555]  Enumerate Credentials from Windows Credential Manager With PowerShell
  T1552.002_enumeration-for-3rd-party-creds-from-cli.yml  [T1552.002]  Enumeration for 3rd Party Creds From CLI
  T1552.002_enumeration-for-credentials-in-registry.yml  [T1552.002]  Enumeration for Credentials in Registry
  T1003_esentutl-gather-credentials.yml  [T1003,T1003.003]  Esentutl Gather Credentials
  T1005_esentutl-steals-browser-information.yml  [T1005]  Esentutl Steals Browser Information
  T1070_eventlog-evtx-file-deleted.yml  [T1070]  EventLog EVTX File Deleted
  T1552_eventlog-query-requests-by-builtin-utilities.yml  [T1552]  EventLog Query Requests By Builtin Utilities
  T1685.005_eventlog-cleared.yml  [T1685.005]  Eventlog Cleared
  T1105_executable-from-webdav.yml  [T1105]  Executable from Webdav
  T1059.001_execute-code-with-pester-bat.yml  [T1059.001,T1216]  Execute Code with Pester.bat
  T1059.001_execute-code-with-pester-bat-as-parent.yml  [T1059.001,T1216]  Execute Code with Pester.bat as Parent
  T1218_execute-files-with-msdeploy-exe.yml  [T1218]  Execute Files with Msdeploy.exe
  T1564.004_execute-from-alternate-data-streams.yml  [T1564.004]  Execute From Alternate Data Streams
  T1021.006_execute-invoke-command-on-remote-host.yml  [T1021.006]  Execute Invoke-command on Remote Host
  T1505.003_execution-from-webserver-root-folder.yml  [T1505.003]  Execution From Webserver Root Folder
  execution-of-script-located-in-potentially-suspicious-direct.yml  []  Execution Of Script Located In Potentially Suspicious Directory
  execution-of-suspicious-file-type-extension.yml  []  Execution of Suspicious File Type Extension
  T1203_exploit-for-cve-2017-0261.yml  [T1203,T1204.002,T1566.001]  Exploit for CVE-2017-0261
  T1036_explorer-process-tree-break.yml  [T1036]  Explorer Process Tree Break
  T1078_external-remote-rdp-logon-from-public-ip.yml  [T1078,T1110,T1133]  External Remote RDP Logon from Public IP
  T1552.001_extracting-information-with-powershell.yml  [T1552.001]  Extracting Information with PowerShell
  T1190_f5-big-ip-icontrol-rest-api-command-execution-proxy.yml  [T1190]  F5 BIG-IP iControl Rest API Command Execution - Proxy
  T1190_f5-big-ip-icontrol-rest-api-command-execution-webserver.yml  [T1190]  F5 BIG-IP iControl Rest API Command Execution - Webserver
  T1048_ftp-connection-open-attempt-via-winscp-cli.yml  [T1048]  FTP Connection Open Attempt Via Winscp CLI
  T1590.002_failed-dns-zone-transfer.yml  [T1590.002]  Failed DNS Zone Transfer
  T1078_failed-logon-from-public-ip.yml  [T1078,T1133,T1190]  Failed Logon From Public IP
  T1003_file-access-of-signal-desktop-sensitive-data.yml  [T1003]  File Access Of Signal Desktop Sensitive Data
  file-decryption-using-gpg4win.yml  []  File Decryption Using Gpg4win
  T1070.004_file-deleted-via-sysinternals-sdelete.yml  [T1070.004]  File Deleted Via Sysinternals SDelete
  T1105_file-download-from-browser-process-via-inline-url.yml  [T1105]  File Download From Browser Process Via Inline URL
  file-download-from-ip-url-via-curl-exe.yml  []  File Download From IP URL Via Curl.EXE
  T1218_file-download-using-protocolhandler-exe.yml  [T1218]  File Download Using ProtocolHandler.exe
  T1036.003_file-download-via-bitsadmin.yml  [T1036.003,T1105,T1197]  File Download Via Bitsadmin
  T1105_file-download-via-curl-exe.yml  [T1105]  File Download Via Curl.EXE
  T1218_file-download-via-installutil-exe.yml  [T1218]  File Download Via InstallUtil.EXE
  T1105_file-download-via-nscurl-macos.yml  [T1105]  File Download Via Nscurl - MacOS
  T1105_file-download-via-certoc-exe.yml  [T1105]  File Download via CertOC.EXE
  T1027_file-encoded-to-base64-via-certutil-exe.yml  [T1027]  File Encoded To Base64 Via Certutil.EXE
  file-encryption-using-gpg4win.yml  []  File Encryption Using Gpg4win
  T1490_file-recovery-from-backup-via-wbadmin-exe.yml  [T1490]  File Recovery From Backup Via Wbadmin.EXE
  T1070.006_file-time-attribute-change.yml  [T1070.006]  File Time Attribute Change
  T1070.006_file-time-attribute-change-linux.yml  [T1070.006]  File Time Attribute Change - Linux
  T1222.001_file-or-folder-permissions-modifications.yml  [T1222.001]  File or Folder Permissions Modifications
  T1036.005_files-with-system-dll-name-in-unsuspected-locations.yml  [T1036.005]  Files With System DLL Name In Unsuspected Locations
  T1036.005_files-with-system-process-name-in-unsuspected-locations.yml  [T1036.005]  Files With System Process Name In Unsuspected Locations
  T1070_filter-driver-unloaded-via-fltmc-exe.yml  [T1070,T1685,T1685.001]  Filter Driver Unloaded Via Fltmc.EXE
  T1027.003_findstr-launching-lnk-file.yml  [T1027.003,T1036,T1202]  Findstr Launching .lnk File
  T1686.003_firewall-disabled-via-netsh-exe.yml  [T1686.003]  Firewall Disabled via Netsh.EXE
  T1686.003_firewall-rule-deleted-via-netsh-exe.yml  [T1686.003]  Firewall Rule Deleted Via Netsh.EXE
  firewall-rule-update-via-netsh-exe.yml  []  Firewall Rule Update Via Netsh.EXE
  T1686_flush-iptables-ufw-chain.yml  [T1686]  Flush Iptables Ufw Chain
  T1074.001_folder-compress-to-potentially-suspicious-output-via-compres.yml  [T1074.001]  Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
  T1685.001_forest-blizzard-apt-javascript-constrained-file-creation.yml  [T1685.001]  Forest Blizzard APT - JavaScript Constrained File Creation
  T1059_forfiles-command-execution.yml  [T1059]  Forfiles Command Execution
  T1685_fortigate-firewall-address-object-added.yml  [T1685]  FortiGate - Firewall Address Object Added
  T1136.001_fortigate-new-administrator-account-created.yml  [T1136.001]  FortiGate - New Administrator Account Created
  T1685_fortigate-new-firewall-policy-added.yml  [T1685]  FortiGate - New Firewall Policy Added
  T1136.001_fortigate-new-local-user-created.yml  [T1136.001]  FortiGate - New Local User Created
  T1133_fortigate-new-vpn-ssl-web-portal-added.yml  [T1133]  FortiGate - New VPN SSL Web Portal Added
  fortigate-user-group-modified.yml  []  FortiGate - User Group Modified
  T1133_fortigate-vpn-ssl-settings-modified.yml  [T1133]  FortiGate - VPN SSL Settings Modified
  T1548.002_function-call-from-undocumented-com-interface-editionupgrade.yml  [T1548.002]  Function Call From Undocumented COM Interface EditionUpgradeManager
  T1098_gcp-access-policy-deleted.yml  [T1098]  GCP Access Policy Deleted
  T1548_gcp-break-glass-container-workload-deployed.yml  [T1548]  GCP Break-glass Container Workload Deployed
  gathernetworkinfo-vbs-reconnaissance-script-output.yml  []  GatherNetworkInfo.VBS Reconnaissance Script Output
  T1033_get-aduser-enumeration-using-useraccountcontrol-flags.yml  [T1033]  Get-ADUser Enumeration Using UserAccountControl Flags
  T1213.003_github-delete-action-invoked.yml  [T1213.003]  Github Delete Action Invoked
  T1020_github-fork-private-repositories-setting-enabled-cleared.yml  [T1020,T1537]  Github Fork Private Repositories Setting Enabled/Cleared
  T1098.001_github-outside-collaborator-detected.yml  [T1098.001,T1098.003,T1213.003]  Github Outside Collaborator Detected
  T1020_github-repository-organization-transferred.yml  [T1020,T1537]  Github Repository/Organization Transferred
  T1078.004_github-ssh-certificate-configuration-changed.yml  [T1078.004]  Github SSH Certificate Configuration Changed
  T1071_github-self-hosted-runner-execution.yml  [T1071,T1102.002]  Github Self-Hosted Runner Execution
  T1219.002_gotoassist-temporary-installation-artefact.yml  [T1219.002]  GoToAssist Temporary Installation Artefact
  google-cloud-dns-zone-modified-or-deleted.yml  []  Google Cloud DNS Zone Modified or Deleted
  T1685_google-cloud-firewall-modified-or-deleted.yml  [T1685]  Google Cloud Firewall Modified or Deleted
  T1078_google-cloud-kubernetes-admission-controller.yml  [T1078,T1552,T1552.007]  Google Cloud Kubernetes Admission Controller
  google-cloud-kubernetes-cronjob.yml  []  Google Cloud Kubernetes CronJob
  google-cloud-kubernetes-rolebinding.yml  []  Google Cloud Kubernetes RoleBinding
  google-cloud-kubernetes-secrets-modified-or-deleted.yml  []  Google Cloud Kubernetes Secrets Modified or Deleted
  T1565_google-cloud-re-identifies-sensitive-information.yml  [T1565]  Google Cloud Re-identifies Sensitive Information
  google-cloud-sql-database-modified-or-deleted.yml  []  Google Cloud SQL Database Modified or Deleted
  T1531_google-cloud-service-account-disabled-or-deleted.yml  [T1531]  Google Cloud Service Account Disabled or Deleted
  google-cloud-service-account-modified.yml  []  Google Cloud Service Account Modified
  google-cloud-storage-buckets-modified-or-deleted.yml  []  Google Cloud Storage Buckets Modified or Deleted
  google-cloud-vpn-tunnel-modified-or-deleted.yml  []  Google Cloud VPN Tunnel Modified or Deleted
  T1074_google-full-network-traffic-packet-capture.yml  [T1074]  Google Full Network Traffic Packet Capture
  T1098.003_google-workspace-application-access-level-modified.yml  [T1098.003]  Google Workspace Application Access Level Modified
  google-workspace-application-removed.yml  []  Google Workspace Application Removed
  T1078_google-workspace-government-attack-warning.yml  [T1078]  Google Workspace Government Attack Warning
  T1098_google-workspace-granted-domain-api-access.yml  [T1098]  Google Workspace Granted Domain API Access
  google-workspace-mfa-disabled.yml  []  Google Workspace MFA Disabled
  T1114.003_google-workspace-out-of-domain-email-forwarding.yml  [T1114.003]  Google Workspace Out Of Domain Email Forwarding
  google-workspace-role-modified-or-deleted.yml  []  Google Workspace Role Modified or Deleted
  google-workspace-role-privilege-deleted.yml  []  Google Workspace Role Privilege Deleted
  T1098_google-workspace-user-granted-admin-privileges.yml  [T1098]  Google Workspace User Granted Admin Privileges
  T1615_gpresult-display-group-policy-information.yml  [T1615]  Gpresult Display Group Policy Information
  T1218_gpscript-execution.yml  [T1218]  Gpscript Execution
  T1098.003_granting-of-permissions-to-an-account.yml  [T1098.003]  Granting Of Permissions To An Account
  T1070.004_greedy-file-deletion-using-del.yml  [T1070.004]  Greedy File Deletion Using Del
  T1531_group-has-been-deleted-via-groupdel.yml  [T1531]  Group Has Been Deleted Via Groupdel
  T1033_group-membership-reconnaissance-via-whoami-exe.yml  [T1033]  Group Membership Reconnaissance Via Whoami.EXE
  T1484.001_group-policy-abuse-for-privilege-addition.yml  [T1484.001]  Group Policy Abuse for Privilege Addition
  T1078.004_guest-user-invited-by-non-approved-inviters.yml  [T1078.004]  Guest User Invited By Non Approved Inviters
  T1078_guest-users-invited-to-tenant-by-non-approved-inviters.yml  [T1078]  Guest Users Invited To Tenant By Non Approved Inviters
  T1132.001_gzip-archive-decode-via-powershell.yml  [T1132.001]  Gzip Archive Decode Via PowerShell
  T1218.001_hh-exe-initiated-http-network-connection.yml  [T1218.001]  HH.EXE Initiated HTTP Network Connection
  T1071.001_http-request-with-empty-user-agent.yml  [T1071.001]  HTTP Request With Empty User Agent
  http-request-to-low-reputation-tld-or-suspicious-file-extens.yml  []  HTTP Request to Low Reputation TLD or Suspicious File Extension
  T1134.001_hacktool-impersonate-execution.yml  [T1134.001,T1134.003]  HackTool - Impersonate Execution
  T1059.003_hacktool-jlaive-in-memory-assembly-execution.yml  [T1059.003]  HackTool - Jlaive In-Memory Assembly Execution
  hacktool-lazagne-execution.yml  []  HackTool - LaZagne Execution
  hacktool-sharpldapmonitor-execution.yml  []  HackTool - SharpLDAPmonitor Execution
  T1021.006_hacktool-winrm-access-via-evil-winrm.yml  [T1021.006]  HackTool - WinRM Access Via Evil-WinRM
  T1047_hardware-model-reconnaissance-via-wmic-exe.yml  [T1047]  Hardware Model Reconnaissance Via Wmic.EXE
  T1040_harvesting-of-wifi-credentials-via-netsh-exe.yml  [T1040]  Harvesting Of Wifi Credentials Via Netsh.EXE
  T1059.001_headless-process-launched-via-conhost-exe.yml  [T1059.001,T1059.003]  Headless Process Launched Via Conhost.EXE
  T1564.004_hidden-executable-in-ntfs-alternate-data-stream.yml  [T1564.004]  Hidden Executable In NTFS Alternate Data Stream
  T1105_hidden-flag-set-on-file-directory-via-chflags-macos.yml  [T1105,T1218,T1552.001,T1564.004]  Hidden Flag Set On File/Directory Via Chflags - MacOS
  T1059.001_hidden-powershell-in-link-file-pattern.yml  [T1059.001]  Hidden Powershell in Link File Pattern
  T1564.002_hidden-user-creation.yml  [T1564.002]  Hidden User Creation
  T1564.001_hiding-files-with-attrib-exe.yml  [T1564.001]  Hiding Files with Attrib.exe
  T1564.002_hiding-user-account-via-specialaccounts-registry-key-command.yml  [T1564.002]  Hiding User Account Via SpecialAccounts Registry Key - CommandLine
  T1137_ie-change-domain-zone.yml  [T1137]  IE Change Domain Zone
  T1505.003_iis-native-code-module-command-line-installation.yml  [T1505.003]  IIS Native-Code Module Command Line Installation
  T1070_iis-webserver-access-logs-deleted.yml  [T1070]  IIS WebServer Access Logs Deleted
  T1070_iis-webserver-log-deletion-via-commandline-utilities.yml  [T1070]  IIS WebServer Log Deletion via CommandLine Utilities
  T1557_isatap-router-address-was-set.yml  [T1557,T1565.002]  ISATAP Router Address Was Set
  T1566.001_iso-image-mounted.yml  [T1566.001]  ISO Image Mounted
  T1566.001_iso-or-image-mount-indicator-in-recent-files.yml  [T1566.001]  ISO or Image Mount Indicator in Recent Files
  T1218_ie4uinit-lolbin-use-from-invalid-path.yml  [T1218]  Ie4uinit Lolbin Use From Invalid Path
  T1105_import-ldap-data-interchange-format-file-via-ldifde-exe.yml  [T1105,T1218]  Import LDAP Data Interchange Format File Via Ldifde.EXE
  T1059.001_import-powershell-modules-from-suspicious-directories.yml  [T1059.001]  Import PowerShell Modules From Suspicious Directories
  T1059.001_import-powershell-modules-from-suspicious-directories-proccr.yml  [T1059.001]  Import PowerShell Modules From Suspicious Directories - ProcCreation
  T1112_imports-registry-key-from-a-file.yml  [T1112]  Imports Registry Key From a File
  T1114.003_inbox-rules-creation-or-update-activity-via-exchangepowershe.yml  [T1114.003,T1564.008]  Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet
  T1114.003_inbox-rules-creation-or-update-activity-in-o365.yml  [T1114.003,T1564.008]  Inbox Rules Creation Or Update Activity in O365
  T1078_increased-failed-authentications-of-any-type.yml  [T1078]  Increased Failed Authentications Of Any Type
  T1685.006_indicator-removal-on-host-clear-mac-system-logs.yml  [T1685.006]  Indicator Removal on Host - Clear Mac System Logs
  T1202_indirect-command-execution-from-script-file-via-bash-exe.yml  [T1202]  Indirect Command Execution From Script File Via Bash.EXE
  T1202_indirect-command-execution-via-sftp-proxycommand.yml  [T1202]  Indirect Command Execution via SFTP ProxyCommand
  T1202_indirect-inline-command-execution-via-bash-exe.yml  [T1202]  Indirect Inline Command Execution Via Bash.EXE
  T1218_infdefaultinstall-exe-inf-execution.yml  [T1218]  InfDefaultInstall.exe .inf Execution
  T1190_ingress-egress-security-group-modification.yml  [T1190]  Ingress/Egress Security Group Modification
  insecure-proxy-doh-transfer-via-curl-exe.yml  []  Insecure Proxy/DOH Transfer Via Curl.EXE
  insecure-transfer-via-curl-exe.yml  []  Insecure Transfer Via Curl.EXE
  T1059_install-new-package-via-winget-local-manifest.yml  [T1059]  Install New Package Via Winget Local Manifest
  T1219.002_installation-of-teamviewer-desktop.yml  [T1219.002]  Installation of TeamViewer Desktop
  T1036_interactive-bash-suspicious-children.yml  [T1036,T1059.004]  Interactive Bash Suspicious Children
  T1078_interactive-logon-to-server-systems.yml  [T1078]  Interactive Logon to Server Systems
  T1547.001_internet-explorer-autorun-keys-modification.yml  [T1547.001]  Internet Explorer Autorun Keys Modification
  internet-explorer-disablefirstruncustomize-enabled.yml  []  Internet Explorer DisableFirstRunCustomize Enabled
  T1027.010_invocation-of-crypto-classes-from-the-cryptography-powershel.yml  [T1027.010,T1059.001]  Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace
  T1003.003_invocation-of-active-directory-diagnostic-tool-ntdsutil-exe.yml  [T1003.003]  Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
  T1027_invoke-obfuscation-compress-obfuscation.yml  [T1027,T1059.001]  Invoke-Obfuscation COMPRESS OBFUSCATION
  T1027_invoke-obfuscation-compress-obfuscation-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
  T1027_invoke-obfuscation-compress-obfuscation-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
  T1027_invoke-obfuscation-compress-obfuscation-security.yml  [T1027,T1059.001]  Invoke-Obfuscation COMPRESS OBFUSCATION - Security
  T1027_invoke-obfuscation-compress-obfuscation-system.yml  [T1027,T1059.001]  Invoke-Obfuscation COMPRESS OBFUSCATION - System
  T1027_invoke-obfuscation-rundll-launcher-powershell.yml  [T1027,T1059.001]  Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
  T1027_invoke-obfuscation-rundll-launcher-powershell-module.yml  [T1027,T1059.001]  Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
  T1027_invoke-obfuscation-rundll-launcher-security.yml  [T1027,T1059.001]  Invoke-Obfuscation RUNDLL LAUNCHER - Security
  T1027_invoke-obfuscation-rundll-launcher-system.yml  [T1027,T1059.001]  Invoke-Obfuscation RUNDLL LAUNCHER - System
  jamf-mdm-potential-suspicious-child-process.yml  []  JAMF MDM Potential Suspicious Child Process
  T1203_java-running-with-remote-debugging.yml  [T1203]  Java Running with Remote Debugging
  T1553.003_kapeka-backdoor-configuration-persistence.yml  [T1553.003]  Kapeka Backdoor Configuration Persistence
  T1558.003_kerberoasting-activity-initial-query.yml  [T1558.003]  Kerberoasting Activity - Initial Query
  T1558.003_kerberos-network-traffic-rc4-ticket-encryption.yml  [T1558.003]  Kerberos Network Traffic RC4 Ticket Encryption
  T1078_kubernetes-admission-controller-modification.yml  [T1078,T1552,T1552.007]  Kubernetes Admission Controller Modification
  kubernetes-cronjob-job-modification.yml  []  Kubernetes CronJob/Job Modification
  T1070_kubernetes-events-deleted.yml  [T1070]  Kubernetes Events Deleted
  T1609_kubernetes-potential-enumeration-activity.yml  [T1609,T1613]  Kubernetes Potential Enumeration Activity
  kubernetes-rolebinding-modification.yml  []  Kubernetes Rolebinding Modification
  kubernetes-secrets-modified-or-deleted.yml  []  Kubernetes Secrets Modified or Deleted
  T1567_lolbas-data-exfiltration-by-datasvcutil-exe.yml  [T1567]  LOLBAS Data Exfiltration by DataSvcUtil.exe
  lolbin-execution-from-abnormal-drive.yml  []  LOLBIN Execution From Abnormal Drive
  T1689_lsa-ppl-protection-setting-modification-via-commandline.yml  [T1689]  LSA PPL Protection Setting Modification via CommandLine
  T1003.001_lsass-access-from-non-system-account.yml  [T1003.001]  LSASS Access From Non System Account
  T1003.001_lsass-access-from-program-in-potentially-suspicious-folder.yml  [T1003.001]  LSASS Access From Program In Potentially Suspicious Folder
  T1543.001_launch-agent-daemon-execution-via-launchctl.yml  [T1543.001,T1543.004,T1569.001]  Launch Agent/Daemon Execution Via Launchctl
  T1216.001_launch-vsdevshell-ps1-proxy-execution.yml  [T1216.001]  Launch-VsDevShell.PS1 Proxy Execution
  T1140_linux-base64-encoded-pipe-to-shell.yml  [T1140]  Linux Base64 Encoded Pipe to Shell
  T1140_linux-base64-encoded-shebang-in-cli.yml  [T1140]  Linux Base64 Encoded Shebang In CLI
  T1548_linux-doas-conf-file-creation.yml  [T1548]  Linux Doas Conf File Creation
  T1685.006_linux-logs-clearing-attempts.yml  [T1685.006]  Linux Logs Clearing Attempts
  T1140_linux-shell-pipe-to-shell.yml  [T1140]  Linux Shell Pipe to Shell
  livekd-driver-creation.yml  []  LiveKD Driver Creation
  T1190_loadbalancer-security-group-modification.yml  [T1190]  LoadBalancer Security Group Modification
  T1003_loaded-module-enumeration-via-tasklist-exe.yml  [T1003]  Loaded Module Enumeration Via Tasklist.EXE
  local-file-read-using-curl-exe.yml  []  Local File Read Using Curl.EXE
  T1105_local-network-connection-initiated-by-script-interpreter.yml  [T1105]  Local Network Connection Initiated By Script Interpreter
  logged-on-user-password-change-via-ksetup-exe.yml  []  Logged-On User Password Change Via Ksetup.EXE
  T1078.004_login-to-disabled-account.yml  [T1078.004]  Login to Disabled Account
  T1078_logon-from-a-risky-ip-address.yml  [T1078]  Logon from a Risky IP Address
  T1218_lolbin-runexehelper-use-as-proxy.yml  [T1218]  Lolbin Runexehelper Use As Proxy
  T1218_lolbin-unregmp2-exe-use-as-proxy.yml  [T1218]  Lolbin Unregmp2.exe Use As Proxy
  T1071.004_low-reputation-effective-top-level-domain-etld.yml  [T1071.004]  Low Reputation Effective Top-Level Domain (eTLD)
  T1047_mitre-bzar-indicators-for-execution.yml  [T1047,T1053.002,T1569.002]  MITRE BZAR Indicators for Execution
  T1547.004_mitre-bzar-indicators-for-persistence.yml  [T1547.004]  MITRE BZAR Indicators for Persistence
  T1059.005_mmc-loading-script-engines-dlls.yml  [T1059.005,T1218.014]  MMC Loading Script Engines DLLs
  T1505.002_msexchange-transport-agent-installation.yml  [T1505.002]  MSExchange Transport Agent Installation
  T1505.002_msexchange-transport-agent-installation-builtin.yml  [T1505.002]  MSExchange Transport Agent Installation - Builtin
  msi-installation-from-suspicious-locations.yml  []  MSI Installation From Suspicious Locations
  T1218_msi-installation-from-web.yml  [T1218,T1218.007]  MSI Installation From Web
  T1485_mssql-destructive-query.yml  [T1485]  MSSQL Destructive Query
  T1110_mssql-server-failed-logon-from-external-network.yml  [T1110]  MSSQL Server Failed Logon From External Network
  T1546.014_macos-emond-launch-daemon.yml  [T1546.014]  MacOS Emond Launch Daemon
  T1059.002_macos-scripting-interpreter-applescript.yml  [T1059.002]  MacOS Scripting Interpreter AppleScript
  T1020_mail-forwarding-redirecting-activity-in-o365.yml  [T1020,T1114.003,T1564.008]  Mail Forwarding/Redirecting Activity In O365
  T1020_mail-forwarding-redirecting-activity-via-exchangepowershell.yml  [T1020,T1114.003,T1564.008]  Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet
  T1068_malicious-driver-load-by-name.yml  [T1068,T1543.003]  Malicious Driver Load By Name
  T1218_malicious-pe-execution-by-microsoft-visual-studio-debugger.yml  [T1218]  Malicious PE Execution by Microsoft Visual Studio Debugger
  T1059.001_malicious-powershell-keywords.yml  [T1059.001]  Malicious PowerShell Keywords
  T1136.002_manipulation-of-user-computer-or-group-security-principals-a.yml  [T1136.002]  Manipulation of User Computer or Group Security Principals Across AD
  T1059_manual-execution-of-script-inside-of-a-compressed-file.yml  [T1059]  Manual Execution of Script Inside of a Compressed File
  T1036.003_masquerading-as-linux-crond-process.yml  [T1036.003]  Masquerading as Linux Crond Process
  T1219.002_mesh-agent-service-installation.yml  [T1219.002]  Mesh Agent Service Installation
  T1078_microsoft-365-impossible-travel-activity.yml  [T1078]  Microsoft 365 - Impossible Travel Activity
  T1486_microsoft-365-potential-ransomware-activity.yml  [T1486]  Microsoft 365 - Potential Ransomware Activity
  T1485_microsoft-365-unusual-volume-of-file-deletion.yml  [T1485]  Microsoft 365 - Unusual Volume of File Deletion
  T1199_microsoft-365-user-restricted-from-sending-email.yml  [T1199]  Microsoft 365 - User Restricted from Sending Email
  T1204.002_microsoft-excel-add-in-loaded-from-uncommon-location.yml  [T1204.002]  Microsoft Excel Add-In Loaded From Uncommon Location
  T1112_microsoft-office-trusted-location-updated.yml  [T1112]  Microsoft Office Trusted Location Updated
  T1055_microsoft-sync-center-suspicious-network-connections.yml  [T1055,T1218]  Microsoft Sync Center Suspicious Network Connections
  T1528_microsoft-teams-sensitive-file-access-by-uncommon-applicatio.yml  [T1528]  Microsoft Teams Sensitive File Access By Uncommon Applications
  T1204.002_microsoft-vba-for-outlook-addin-loaded-via-outlook.yml  [T1204.002]  Microsoft VBA For Outlook Addin Loaded Via Outlook
  T1127_microsoft-workflow-compiler-execution.yml  [T1127,T1218]  Microsoft Workflow Compiler Execution
  T1484.001_modify-group-policy-settings.yml  [T1484.001]  Modify Group Policy Settings
  T1484.001_modify-group-policy-settings-scriptblocklogging.yml  [T1484.001]  Modify Group Policy Settings - ScriptBlockLogging
  T1686_modify-system-firewall.yml  [T1686]  Modify System Firewall
  T1053.003_modifying-crontab.yml  [T1053.003]  Modifying Crontab
  T1197_monitoring-for-persistence-via-bits.yml  [T1197]  Monitoring For Persistence Via BITS
  T1564_mount-execution-with-hidepid-parameter.yml  [T1564]  Mount Execution With Hidepid Parameter
  T1105_msiexec-web-install.yml  [T1105,T1218.007]  MsiExec Web Install
  T1218.007_msiexec-quiet-installation.yml  [T1218.007]  Msiexec Quiet Installation
  T1220_msxsl-exe-execution.yml  [T1220]  Msxsl.EXE Execution
  multi-factor-authentication-disabled-for-user-account.yml  []  Multi Factor Authentication Disabled For User Account
  T1078.004_multifactor-authentication-denied.yml  [T1078.004,T1110,T1621]  Multifactor Authentication Denied
  T1078.004_multifactor-authentication-interrupted.yml  [T1078.004,T1110,T1621]  Multifactor Authentication Interrupted
  T1110_ntlm-brute-force.yml  [T1110]  NTLM Brute Force
  T1550.002_ntlmv1-logon-between-client-and-server.yml  [T1550.002]  NTLMv1 Logon Between Client and Server
  netsupport-manager-service-install.yml  []  NetSupport Manager Service Install
  T1059.001_netcat-the-powershell-version.yml  [T1059.001,T1095]  Netcat The Powershell Version
  T1686.003_netsh-allow-group-policy-on-microsoft-defender-firewall.yml  [T1686.003]  Netsh Allow Group Policy on Microsoft Defender Firewall
  T1041_network-communication-initiated-to-portmap-io-domain.yml  [T1041,T1090.002]  Network Communication Initiated To Portmap.IO Domain
  T1218.010_network-connection-initiated-by-regsvr32-exe.yml  [T1218.010,T1559.001]  Network Connection Initiated By Regsvr32.EXE
  T1105_network-connection-initiated-from-users-public-folder.yml  [T1105]  Network Connection Initiated From Users\Public Folder
  T1102_network-connection-initiated-to-azurewebsites-net-by-non-bro.yml  [T1102,T1102.001]  Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
  T1567_network-connection-initiated-to-btunnels-domains.yml  [T1567,T1572]  Network Connection Initiated To BTunnels Domains
  T1567_network-connection-initiated-to-cloudflared-tunnels-domains.yml  [T1567,T1572]  Network Connection Initiated To Cloudflared Tunnels Domains
  T1567.001_network-connection-initiated-to-devtunnels-domain.yml  [T1567.001,T1572]  Network Connection Initiated To DevTunnels Domain
  T1567_network-connection-initiated-to-visual-studio-code-tunnels-d.yml  [T1567,T1572]  Network Connection Initiated To Visual Studio Code Tunnels Domain
  new-aws-lambda-function-url-configuration-created.yml  []  New AWS Lambda Function URL Configuration Created
  T1112_new-bginfo-exe-custom-db-path-registry-configuration.yml  [T1112]  New BgInfo.EXE Custom DB Path Registry Configuration
  T1112_new-bginfo-exe-custom-vbscript-registry-configuration.yml  [T1112]  New BgInfo.EXE Custom VBScript Registry Configuration
  T1112_new-bginfo-exe-custom-wmi-query-registry-configuration.yml  [T1112]  New BgInfo.EXE Custom WMI Query Registry Configuration
  T1548_new-ca-policy-by-non-approved-actor.yml  [T1548]  New CA Policy by Non-approved Actor
  T1218_new-capture-session-launched-via-dxcap-exe.yml  [T1218]  New Capture Session Launched Via DXCap.EXE
  T1547.009_new-custom-shim-database-created.yml  [T1547.009]  New Custom Shim Database Created
  T1546.009_new-dll-added-to-appcertdlls-registry-key.yml  [T1546.009]  New DLL Added to AppCertDlls Registry Key
  T1546.010_new-dll-added-to-appinit-dlls-registry-key.yml  [T1546.010]  New DLL Added to AppInit_DLLs Registry Key
  T1218.008_new-dll-registered-via-odbcconf-exe.yml  [T1218.008]  New DLL Registered Via Odbcconf.EXE
  T1078.002_new-dmsa-service-account-created-in-specific-ous.yml  [T1078.002,T1098]  New DMSA Service Account Created in Specific OUs
  T1484.002_new-federated-domain-added.yml  [T1484.002]  New Federated Domain Added
  T1136.003_new-federated-domain-added-exchange.yml  [T1136.003]  New Federated Domain Added - Exchange
  T1490_new-file-exclusion-added-to-time-machine-via-tmutil-macos.yml  [T1490]  New File Exclusion Added To Time Machine Via Tmutil - MacOS
  T1686.003_new-firewall-rule-added-in-windows-firewall-exception-list-v.yml  [T1686.003]  New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
  T1686.003_new-firewall-rule-added-via-netsh-exe.yml  [T1686.003]  New Firewall Rule Added Via Netsh.EXE
  T1003.005_new-generic-credentials-added-via-cmdkey-exe.yml  [T1003.005]  New Generic Credentials Added Via Cmdkey.EXE
  T1543.003_new-kernel-driver-via-sc-exe.yml  [T1543.003]  New Kernel Driver Via SC.EXE
  T1505.004_new-module-module-added-to-iis-server.yml  [T1505.004,T1685.001]  New Module Module Added To IIS Server
  T1078.002_new-msds-delegatedmanagedserviceaccount-dmsa-object-created.yml  [T1078.002,T1098]  New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created
  T1686.001_new-network-route-added.yml  [T1686.001]  New Network Route Added
  T1040_new-network-trace-capture-started-via-netsh-exe.yml  [T1040]  New Network Trace Capture Started Via Netsh.EXE
  T1008_new-outlook-macro-created.yml  [T1008,T1137,T1546]  New Outlook Macro Created
  T1543.003_new-pdqdeploy-service-client-side.yml  [T1543.003]  New PDQDeploy Service - Client Side
  T1543.003_new-pdqdeploy-service-server-side.yml  [T1543.003]  New PDQDeploy Service - Server Side
  T1090_new-port-forwarding-rule-added-via-netsh-exe.yml  [T1090]  New Port Forwarding Rule Added Via Netsh.EXE
  T1090_new-portproxy-registry-entry-added.yml  [T1090]  New PortProxy Registry Entry Added
  T1047_new-process-created-via-wmic-exe.yml  [T1047]  New Process Created Via Wmic.EXE
  T1021.001_new-remote-desktop-connection-initiated-via-mstsc-exe.yml  [T1021.001]  New Remote Desktop Connection Initiated Via Mstsc.EXE
  T1556_new-root-certificate-authority-added.yml  [T1556]  New Root Certificate Authority Added
  T1553.004_new-root-certificate-installed-via-certmgr-exe.yml  [T1553.004]  New Root Certificate Installed Via CertMgr.EXE
  T1553.004_new-root-certificate-installed-via-certutil-exe.yml  [T1553.004]  New Root Certificate Installed Via Certutil.EXE
  T1490_new-root-or-ca-or-authroot-certificate-to-store.yml  [T1490]  New Root or CA or AuthRoot Certificate to Store
  T1218_new-self-extracting-package-created-via-iexpress-exe.yml  [T1218]  New Self Extracting Package Created Via IExpress.EXE
  T1136.001_new-user-created-via-net-exe.yml  [T1136.001]  New User Created Via Net.EXE
  new-virtual-smart-card-created-via-tpmvscmgr-exe.yml  []  New Virtual Smart Card Created Via TpmVscMgr.EXE
  T1036_new-or-renamed-user-account-with-character.yml  [T1036]  New or Renamed User Account with '$' Character
  T1059.007_node-process-executions.yml  [T1059.007,T1127]  Node Process Executions
  T1059.004_nohup-execution.yml  [T1059.004]  Nohup Execution
  T1036.008_non-dll-extension-file-renamed-with-dll-extension.yml  [T1036.008]  Non-DLL Extension File Renamed With DLL Extension
  T1195.002_notepad-updater-dns-query-to-uncommon-domains.yml  [T1195.002,T1557]  Notepad++ Updater DNS Query to Uncommon Domains
  T1059.001_nslookup-powershell-download-cradle.yml  [T1059.001]  Nslookup PowerShell Download Cradle
  nslookup-powershell-download-cradle-processcreation.yml  []  Nslookup PowerShell Download Cradle - ProcessCreation
  T1003.003_ntdsutil-abuse.yml  [T1003.003]  Ntdsutil Abuse
  T1098_number-of-resource-creation-or-deployment-activities.yml  [T1098]  Number Of Resource Creation Or Deployment Activities
  obfuscated-ip-download-activity.yml  []  Obfuscated IP Download Activity
  obfuscated-ip-via-cli.yml  []  Obfuscated IP Via CLI
  office-application-initiated-network-connection-over-uncommo.yml  []  Office Application Initiated Network Connection Over Uncommon Ports
  T1203_office-application-initiated-network-connection-to-non-local.yml  [T1203]  Office Application Initiated Network Connection To Non-Local IP
  T1137.002_office-application-startup-office-test.yml  [T1137.002]  Office Application Startup - Office Test
  T1547.001_office-autorun-keys-modification.yml  [T1547.001]  Office Autorun Keys Modification
  okta-2023-breach-indicator-of-compromise.yml  []  Okta 2023 Breach Indicator Of Compromise
  okta-api-token-created.yml  []  Okta API Token Created
  okta-api-token-revoked.yml  []  Okta API Token Revoked
  okta-admin-functions-access-through-proxy.yml  []  Okta Admin Functions Access Through Proxy
  T1098.003_okta-admin-role-assigned-to-an-user-or-group.yml  [T1098.003]  Okta Admin Role Assigned to an User or Group
  okta-admin-role-assignment-created.yml  []  Okta Admin Role Assignment Created
  okta-application-modified-or-deleted.yml  []  Okta Application Modified or Deleted
  okta-application-sign-on-policy-modified-or-deleted.yml  []  Okta Application Sign-On Policy Modified or Deleted
  T1098.001_okta-identity-provider-created.yml  [T1098.001]  Okta Identity Provider Created
  T1556.006_okta-mfa-reset-or-deactivated.yml  [T1556.006]  Okta MFA Reset or Deactivated
  okta-network-zone-deactivated-or-deleted.yml  []  Okta Network Zone Deactivated or Deleted
  okta-policy-rule-modified-or-deleted.yml  []  Okta Policy Rule Modified or Deleted
  okta-security-threat-detected.yml  []  Okta Security Threat Detected
  T1199_okta-session-impersonation-granted-from-untrusted-domain.yml  [T1199,T1484.002]  Okta Session Impersonation Granted From Untrusted Domain
  okta-unauthorized-access-to-app.yml  []  Okta Unauthorized Access to App
  T1531_okta-user-account-locked-out.yml  [T1531]  Okta User Account Locked Out
  old-tls1-0-tls1-1-protocol-version-enabled.yml  []  Old TLS1.0/TLS1.1 Protocol Version Enabled
  onenote-attachment-file-dropped-in-suspicious-location.yml  []  OneNote Attachment File Dropped In Suspicious Location
  T1021.004_openedr-spawning-command-shell.yml  [T1021.004,T1059.003,T1219]  OpenEDR Spawning Command Shell
  T1021.004_openssh-server-listening-on-socket.yml  [T1021.004]  OpenSSH Server Listening On Socket
  T1059.002_osacompile-execution-by-potentially-suspicious-applet-osascr.yml  [T1059.002]  Osacompile Execution By Potentially Suspicious Applet/Osascript
  T1218.011_outbound-network-connection-to-public-ip-via-winlogon.yml  [T1218.011]  Outbound Network Connection To Public IP Via Winlogon
  T1137_outlook-security-settings-updated-registry.yml  [T1137]  Outlook Security Settings Updated - Registry
  T1569.002_paexec-service-installation.yml  [T1569.002]  PAExec Service Installation
  T1072_pdq-deploy-remote-adminstartion-tool-execution.yml  [T1072]  PDQ Deploy Remote Adminstartion Tool Execution
  psscriptpolicytest-creation-by-uncommon-process.yml  []  PSScriptPolicyTest Creation By Uncommon Process
  T1114_pst-export-alert-using-new-compliancesearchaction.yml  [T1114]  PST Export Alert Using New-ComplianceSearchAction
  T1114_pst-export-alert-using-ediscovery-alert.yml  [T1114]  PST Export Alert Using eDiscovery Alert
  T1003_pua-aws-trufflehog-execution.yml  [T1003,T1555]  PUA - AWS TruffleHog Execution
  T1087.002_pua-adfind-exe-execution.yml  [T1087.002]  PUA - AdFind.EXE Execution
  T1046_pua-advanced-ip-scanner-execution.yml  [T1046,T1135]  PUA - Advanced IP Scanner Execution
  T1590_pua-advanced-ip-port-scanner-update-check.yml  [T1590]  PUA - Advanced IP/Port Scanner Update Check
  T1046_pua-advanced-port-scanner-execution.yml  [T1046,T1135]  PUA - Advanced Port Scanner Execution
  T1059.003_pua-advancedrun-execution.yml  [T1059.003,T1134.002,T1564.003]  PUA - AdvancedRun Execution
  T1021.002_pua-csexec-default-named-pipe.yml  [T1021.002,T1569.002]  PUA - CSExec Default Named Pipe
  T1056.002_pua-mouse-lock-execution.yml  [T1056.002]  PUA - Mouse Lock Execution
  T1046_pua-nimscan-execution.yml  [T1046]  PUA - NimScan Execution
  T1569.002_pua-nircmd-execution.yml  [T1569.002]  PUA - NirCmd Execution
  T1046_pua-nmap-zenmap-execution.yml  [T1046]  PUA - Nmap/Zenmap Execution
  T1569.002_pua-paexec-default-named-pipe.yml  [T1569.002]  PUA - PAExec Default Named Pipe
  T1595_pua-pingcastle-execution.yml  [T1595]  PUA - PingCastle Execution
  T1027_pua-potential-pe-metadata-tamper-using-rcedit.yml  [T1027,T1027.005,T1036,T1036.003]  PUA - Potential PE Metadata Tamper Using Rcedit
  T1543_pua-process-hacker-execution.yml  [T1543,T1564,T1622]  PUA - Process Hacker Execution
  T1072_pua-radmin-viewer-utility-execution.yml  [T1072]  PUA - Radmin Viewer Utility Execution
  T1021.002_pua-remcom-default-named-pipe.yml  [T1021.002,T1569.002]  PUA - RemCom Default Named Pipe
  T1046_pua-softperfect-netscan-execution.yml  [T1046]  PUA - SoftPerfect Netscan Execution
  T1588.002_pua-sysinternals-tools-execution-registry.yml  [T1588.002]  PUA - Sysinternals Tools Execution - Registry
  T1543_pua-system-informer-driver-load.yml  [T1543]  PUA - System Informer Driver Load
  T1082_pua-system-informer-execution.yml  [T1082,T1543,T1564]  PUA - System Informer Execution
  T1083_pua-trufflehog-execution.yml  [T1083,T1552.001]  PUA - TruffleHog Execution
  T1083_pua-trufflehog-execution-linux.yml  [T1083,T1552.001]  PUA - TruffleHog Execution - Linux
  T1555.003_pua-webbrowserpassview-execution.yml  [T1555.003]  PUA - WebBrowserPassView Execution
  T1550.002_pass-the-hash-activity-2.yml  [T1550.002]  Pass the Hash Activity 2
  T1201_password-policy-enumerated.yml  [T1201]  Password Policy Enumerated
  T1027_password-protected-zip-file-opened.yml  [T1027]  Password Protected ZIP File Opened
  T1021.002_password-provided-in-command-line-of-net-exe.yml  [T1021.002,T1078]  Password Provided In Command Line Of Net.EXE
  T1078.004_password-reset-by-user-account.yml  [T1078.004]  Password Reset By User Account
  T1047_password-set-to-never-expire-via-wmi.yml  [T1047,T1098]  Password Set to Never Expire via WMI
  T1546.002_path-to-screensaver-binary-modified.yml  [T1546.002]  Path To Screensaver Binary Modified
  T1190_path-traversal-exploitation-attempts.yml  [T1190]  Path Traversal Exploitation Attempts
  T1059_payload-decoded-and-decrypted-via-built-in-utilities.yml  [T1059,T1140,T1204]  Payload Decoded and Decrypted via Built-in Utilities
  T1113_periodic-backup-for-system-registry-hives-enabled.yml  [T1113]  Periodic Backup For System Registry Hives Enabled
  T1059_perl-inline-command-execution.yml  [T1059]  Perl Inline Command Execution
  T1069.001_permission-check-via-accesschk-exe.yml  [T1069.001]  Permission Check Via Accesschk.EXE
  T1552.006_permission-misconfiguration-reconnaissance-via-findstr-exe.yml  [T1552.006]  Permission Misconfiguration Reconnaissance Via Findstr.EXE
  persistence-via-disk-cleanup-handler-autorun.yml  []  Persistence Via Disk Cleanup Handler - Autorun
  T1553.003_persistence-via-new-sip-provider.yml  [T1553.003]  Persistence Via New SIP Provider
  T1548.003_persistence-via-sudoers-d-files.yml  [T1548.003]  Persistence Via Sudoers.d Files
  persistence-via-typedpaths-commandline.yml  []  Persistence Via TypedPaths - CommandLine
  T1059_php-inline-command-execution.yml  [T1059]  Php Inline Command Execution
  T1040_pktmon-exe-execution.yml  [T1040]  PktMon.EXE Execution
  T1046_pnscan-binary-data-transmission-activity.yml  [T1046]  Pnscan Binary Data Transmission Activity
  T1021.001_port-forwarding-activity-via-ssh-exe.yml  [T1021.001,T1021.004,T1572]  Port Forwarding Activity Via SSH.EXE
  T1486_portable-gpg-exe-execution.yml  [T1486]  Portable Gpg.EXE Execution
  T1207_possible-dc-shadow-attack.yml  [T1207]  Possible DC Shadow Attack
  possible-printnightmare-print-driver-install-cve-2021-1675.yml  []  Possible PrintNightmare Print Driver Install - CVE-2021-1675
  T1087.002_potential-ad-user-enumeration-from-non-machine-account.yml  [T1087.002]  Potential AD User Enumeration From Non-Machine Account
  T1685_potential-amsi-bypass-script-using-null-bits.yml  [T1685]  Potential AMSI Bypass Script Using NULL Bits
  T1685_potential-amsi-bypass-using-null-bits.yml  [T1685]  Potential AMSI Bypass Using NULL Bits
  T1059.001_potential-apt-fin7-exploitation-activity.yml  [T1059.001,T1059.003]  Potential APT FIN7 Exploitation Activity
  T1218.010_potential-apt-c-12-bluemushroom-dll-load-activity-via-regsvr.yml  [T1218.010]  Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32
  potential-as-rep-roasting-via-kerberos-tgt-requests.yml  []  Potential AS-REP Roasting via Kerberos TGT Requests
  T1574.001_potential-avkkid-dll-sideloading.yml  [T1574.001]  Potential AVKkid.DLL Sideloading
  T1059.004_potential-abuse-of-linux-magic-system-request-key.yml  [T1059.004,T1489,T1499,T1529]  Potential Abuse of Linux Magic System Request Key
  T1134.001_potential-access-token-abuse.yml  [T1134.001]  Potential Access Token Abuse
  potential-active-directory-enumeration-using-ad-module-procc.yml  []  Potential Active Directory Enumeration Using AD Module - ProcCreation
  potential-active-directory-enumeration-using-ad-module-psmod.yml  []  Potential Active Directory Enumeration Using AD Module - PsModule
  potential-active-directory-enumeration-using-ad-module-psscr.yml  []  Potential Active Directory Enumeration Using AD Module - PsScript
  T1069.002_potential-active-directory-reconnaissance-enumeration-via-ld.yml  [T1069.002,T1087.002,T1482]  Potential Active Directory Reconnaissance/Enumeration Via LDAP
  T1219.002_potential-amazon-ssm-agent-hijacking.yml  [T1219.002]  Potential Amazon SSM Agent Hijacking
  T1574.001_potential-antivirus-software-dll-sideloading.yml  [T1574.001]  Potential Antivirus Software DLL Sideloading
  T1027.004_potential-application-whitelisting-bypass-via-dnx-exe.yml  [T1027.004,T1218]  Potential Application Whitelisting Bypass via Dnx.EXE
  T1059_potential-arbitrary-command-execution-via-ftp-exe.yml  [T1059,T1202]  Potential Arbitrary Command Execution Via FTP.EXE
  T1202_potential-arbitrary-dll-load-using-winword.yml  [T1202]  Potential Arbitrary DLL Load Using Winword
  T1202_potential-arbitrary-file-download-via-cmdl32-exe.yml  [T1202,T1218]  Potential Arbitrary File Download Via Cmdl32.EXE
  T1071.001_potential-base64-encoded-user-agent.yml  [T1071.001]  Potential Base64 Encoded User-Agent
  T1036.005_potential-binary-impersonating-sysinternals-tools.yml  [T1036.005,T1202,T1218]  Potential Binary Impersonating Sysinternals Tools
  potential-binary-or-script-dropper-via-powershell.yml  []  Potential Binary Or Script Dropper Via PowerShell
  T1106_potential-binary-proxy-execution-via-cdb-exe.yml  [T1106,T1127,T1218]  Potential Binary Proxy Execution Via Cdb.EXE
  T1218_potential-binary-proxy-execution-via-vsdiagnostics-exe.yml  [T1218]  Potential Binary Proxy Execution Via VSDiagnostics.EXE
  T1555.003_potential-browser-data-stealing.yml  [T1555.003]  Potential Browser Data Stealing
  T1574.001_potential-ccleanerdu-dll-sideloading.yml  [T1574.001]  Potential CCleanerDU.DLL Sideloading
  T1574.001_potential-ccleanerreactivator-dll-sideloading.yml  [T1574.001]  Potential CCleanerReactivator.DLL Sideloading
  T1546.015_potential-com-object-hijacking-via-treatas-subkey-registry.yml  [T1546.015]  Potential COM Object Hijacking Via TreatAs Subkey - Registry
  T1105_potential-com-objects-download-cradles-usage-ps-script.yml  [T1105]  Potential COM Objects Download Cradles Usage - PS Script
  T1105_potential-com-objects-download-cradles-usage-process-creatio.yml  [T1105]  Potential COM Objects Download Cradles Usage - Process Creation
  T1190_potential-cve-2021-27905-exploitation-attempt.yml  [T1190]  Potential CVE-2021-27905 Exploitation Attempt
  T1558.003_potential-cve-2021-42278-exploitation-attempt.yml  [T1558.003]  Potential CVE-2021-42278 Exploitation Attempt
  T1558.003_potential-cve-2021-42287-exploitation-attempt.yml  [T1558.003]  Potential CVE-2021-42287 Exploitation Attempt
  T1059.006_potential-cve-2022-22954-exploitation-attempt-vmware-workspa.yml  [T1059.006,T1190]  Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution
  T1190_potential-cve-2023-2283-exploitation.yml  [T1190]  Potential CVE-2023-2283 Exploitation
  potential-cve-2023-23397-exploitation-attempt-smb.yml  []  Potential CVE-2023-23397 Exploitation Attempt - SMB
  T1190_potential-cve-2023-27997-exploitation-indicators.yml  [T1190]  Potential CVE-2023-27997 Exploitation Indicators
  potential-cve-2023-36874-exploitation-uncommon-report-wer-lo.yml  []  Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location
  potential-cve-2023-36884-exploitation-file-downloads.yml  []  Potential CVE-2023-36884 Exploitation - File Downloads
  potential-cve-2023-36884-exploitation-dropped-file.yml  []  Potential CVE-2023-36884 Exploitation Dropped File
  T1210_potential-cve-2023-46214-exploitation-attempt.yml  [T1210]  Potential CVE-2023-46214 Exploitation Attempt
  potential-cve-2024-3400-exploitation-palo-alto-globalprotect.yml  []  Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation
  T1068_potential-cve-2024-35250-exploitation-activity.yml  [T1068]  Potential CVE-2024-35250 Exploitation Activity
  T1574.001_potential-chrome-frame-helper-dll-sideloading.yml  [T1574.001]  Potential Chrome Frame Helper DLL Sideloading
  T1036_potential-command-line-path-traversal-evasion-attempt.yml  [T1036]  Potential Command Line Path Traversal Evasion Attempt
  T1027_potential-commandline-obfuscation-using-unicode-characters.yml  [T1027]  Potential CommandLine Obfuscation Using Unicode Characters
  T1140_potential-commandline-obfuscation-using-escape-characters.yml  [T1140]  Potential Commandline Obfuscation Using Escape Characters
  T1007_potential-configuration-and-service-reconnaissance-via-reg-e.yml  [T1007,T1012]  Potential Configuration And Service Reconnaissance Via Reg.EXE
  potential-cookies-session-hijacking.yml  []  Potential Cookies Session Hijacking
  T1003.001_potential-credential-dumping-activity-via-lsass.yml  [T1003.001]  Potential Credential Dumping Activity Via LSASS
  T1003_potential-credential-dumping-attempt-using-new-networkprovid.yml  [T1003]  Potential Credential Dumping Attempt Using New NetworkProvider - REG
  T1003.001_potential-credential-dumping-attempt-via-powershell.yml  [T1003.001]  Potential Credential Dumping Attempt Via PowerShell
  T1059.001_potential-dll-file-download-via-powershell-invoke-webrequest.yml  [T1059.001,T1105]  Potential DLL File Download Via PowerShell Invoke-WebRequest
  T1055.001_potential-dll-injection-or-execution-using-tracker-exe.yml  [T1055.001]  Potential DLL Injection Or Execution Using Tracker.exe
  potential-dll-injection-via-acccheckconsole.yml  []  Potential DLL Injection Via AccCheckConsole
  T1218_potential-dll-sideloading-activity-via-extexport-exe.yml  [T1218]  Potential DLL Sideloading Activity Via ExtExport.EXE
  T1574.001_potential-dll-sideloading-of-dbgcore-dll.yml  [T1574.001]  Potential DLL Sideloading Of DBGCORE.DLL
  T1574.001_potential-dll-sideloading-of-dbghelp-dll.yml  [T1574.001]  Potential DLL Sideloading Of DBGHELP.DLL
  T1574.001_potential-dll-sideloading-of-dbgmodel-dll.yml  [T1574.001]  Potential DLL Sideloading Of DbgModel.DLL
  T1574.001_potential-dll-sideloading-of-libcurl-dll-via-gup-exe.yml  [T1574.001]  Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
  T1574.001_potential-dll-sideloading-of-mpsvc-dll.yml  [T1574.001]  Potential DLL Sideloading Of MpSvc.DLL
  T1574.001_potential-dll-sideloading-of-mscorsvc-dll.yml  [T1574.001]  Potential DLL Sideloading Of MsCorSvc.DLL
  T1055_potential-dll-sideloading-using-coregen-exe.yml  [T1055,T1218]  Potential DLL Sideloading Using Coregen.exe
  T1574.001_potential-dll-sideloading-via-classicexplorer32-dll.yml  [T1574.001]  Potential DLL Sideloading Via ClassicExplorer32.dll
  T1574.001_potential-dll-sideloading-via-deviceenroller-exe.yml  [T1574.001]  Potential DLL Sideloading Via DeviceEnroller.EXE
  T1574.001_potential-dll-sideloading-via-jsschhlp.yml  [T1574.001]  Potential DLL Sideloading Via JsSchHlp
  T1048.003_potential-data-exfiltration-over-smtp-via-send-mailmessage-c.yml  [T1048.003]  Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet
  potential-data-exfiltration-via-audio-file.yml  []  Potential Data Exfiltration Via Audio File
  T1105_potential-data-exfiltration-via-curl-exe.yml  [T1105,T1567]  Potential Data Exfiltration Via Curl.EXE
  T1036.003_potential-defense-evasion-via-binary-rename.yml  [T1036.003]  Potential Defense Evasion Via Binary Rename
  T1106_potential-direct-syscall-of-ntopenprocess.yml  [T1106]  Potential Direct Syscall of NtOpenProcess
  T1083_potential-discovery-activity-using-find-linux.yml  [T1083]  Potential Discovery Activity Using Find - Linux
  T1083_potential-discovery-activity-using-find-macos.yml  [T1083]  Potential Discovery Activity Using Find - MacOS
  potential-discovery-activity-via-dnscmd-exe.yml  []  Potential Discovery Activity Via Dnscmd.EXE
  T1059_potential-dosfuscation-activity.yml  [T1059]  Potential Dosfuscation Activity
  T1105_potential-download-upload-activity-using-type-command.yml  [T1105]  Potential Download/Upload Activity Using Type Command
  T1059.005_potential-dropper-script-execution-via-wscript-cscript-mshta.yml  [T1059.005,T1059.007]  Potential Dropper Script Execution Via WScript/CScript/MSHTA
  potential-encrypted-registry-blob-related-to-snake-malware.yml  []  Potential Encrypted Registry Blob Related To SNAKE Malware
  T1003_potential-exploitation-of-cve-2025-5054-or-cve-2025-4598.yml  [T1003,T1548]  Potential Exploitation of CVE-2025-5054 or CVE-2025-4598
  T1036_potential-fake-instance-of-hxtsr-exe-executed.yml  [T1036]  Potential Fake Instance Of Hxtsr.EXE Executed
  T1218_potential-file-download-via-ms-appinstaller-protocol-handler.yml  [T1218]  Potential File Download Via MS-AppInstaller Protocol Handler
  T1574.001_potential-goopdate-dll-sideloading.yml  [T1574.001]  Potential Goopdate.DLL Sideloading
  T1595_potential-hello-world-scraper-botnet-activity.yml  [T1595]  Potential Hello-World Scraper Botnet Activity
  T1564.004_potential-hidden-directory-creation-via-ntfs-index-allocatio.yml  [T1564.004]  Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream
  T1564.004_potential-hidden-directory-creation-via-ntfs-index-allocatio_2.yml  [T1564.004]  Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
  T1036_potential-homoglyph-attack-using-lookalike-characters.yml  [T1036,T1036.003]  Potential Homoglyph Attack Using Lookalike Characters
  T1036_potential-homoglyph-attack-using-lookalike-characters-in-fil.yml  [T1036,T1036.003]  Potential Homoglyph Attack Using Lookalike Characters in Filename
  T1059.007_potential-in-memory-download-and-compile-of-payloads.yml  [T1059.007,T1105]  Potential In-Memory Download And Compile Of Payloads
  T1620_potential-in-memory-execution-using-reflection-assembly.yml  [T1620]  Potential In-Memory Execution Using Reflection.Assembly
  T1566_potential-initial-access-via-dll-search-order-hijacking.yml  [T1566,T1566.001,T1574,T1574.001]  Potential Initial Access via DLL Search Order Hijacking
  T1059_potential-kamikakabot-activity-lure-document-execution.yml  [T1059]  Potential KamiKakaBot Activity - Lure Document Execution
  potential-kamikakabot-activity-shutdown-schedule-task-creati.yml  []  Potential KamiKakaBot Activity - Shutdown Schedule Task Creation
  T1056.001_potential-keylogger-activity.yml  [T1056.001]  Potential Keylogger Activity
  T1021.006_potential-lateral-movement-via-windows-remote-shell.yml  [T1021.006]  Potential Lateral Movement via Windows Remote Shell
  T1574.001_potential-libvlc-dll-sideloading.yml  [T1574.001]  Potential Libvlc.DLL Sideloading
  T1219.002_potential-linux-amazon-ssm-agent-hijacking.yml  [T1219.002]  Potential Linux Amazon SSM Agent Hijacking
  T1055.009_potential-linux-process-code-injection-via-dd-utility.yml  [T1055.009]  Potential Linux Process Code Injection Via DD Utility
  T1059_potential-moveit-transfer-cve-2023-34362-exploitation-dynami.yml  [T1059]  Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE
  potential-malicious-appx-package-installation-attempts.yml  []  Potential Malicious AppX Package Installation Attempts
  potential-memory-dumping-activity-via-livekd.yml  []  Potential Memory Dumping Activity Via LiveKD
  T1574.001_potential-mfdetours-dll-sideloading.yml  [T1574.001]  Potential Mfdetours.DLL Sideloading
  T1127_potential-mftrace-exe-abuse.yml  [T1127]  Potential Mftrace.EXE Abuse
  T1218_potential-mpclient-dll-sideloading-via-offlinescannershell-e.yml  [T1218]  Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
  T1040_potential-network-sniffing-activity-using-network-tools.yml  [T1040]  Potential Network Sniffing Activity Using Network Tools
  T1027.010_potential-obfuscated-ordinal-call-via-rundll32.yml  [T1027.010]  Potential Obfuscated Ordinal Call Via Rundll32
  T1040_potential-packet-capture-activity-via-start-neteventsession.yml  [T1040]  Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock
  T1550.002_potential-pass-the-hash-activity.yml  [T1550.002]  Potential Pass the Hash Activity
  T1552.001_potential-password-reconnaissance-via-findstr-exe.yml  [T1552.001]  Potential Password Reconnaissance Via Findstr.EXE
  T1218_potential-password-spraying-attempt-using-dsacls-exe.yml  [T1218]  Potential Password Spraying Attempt Using Dsacls.EXE
  potential-peach-sandstorm-apt-c2-communication-activity.yml  []  Potential Peach Sandstorm APT C2 Communication Activity
  T1036.003_potential-pendingfilerenameoperations-tampering.yml  [T1036.003]  Potential PendingFileRenameOperations Tampering
  potential-persistence-attempt-via-errorhandler-cmd.yml  []  Potential Persistence Attempt Via ErrorHandler.Cmd
  T1543.003_potential-persistence-attempt-via-existing-service-tampering.yml  [T1543.003,T1574.011]  Potential Persistence Attempt Via Existing Service Tampering
  T1547.001_potential-persistence-attempt-via-run-keys-using-reg-exe.yml  [T1547.001]  Potential Persistence Attempt Via Run Keys Using Reg.EXE
  T1546.015_potential-persistence-using-debugpath.yml  [T1546.015]  Potential Persistence Using DebugPath
  T1546.011_potential-persistence-via-appcompat-registerapprestart-layer.yml  [T1546.011]  Potential Persistence Via AppCompat RegisterAppRestart Layer
  T1112_potential-persistence-via-custom-protocol-handler.yml  [T1112]  Potential Persistence Via Custom Protocol Handler
  potential-persistence-via-disk-cleanup-handler-registry.yml  []  Potential Persistence Via Disk Cleanup Handler - Registry
  T1112_potential-persistence-via-event-viewer-events-asp.yml  [T1112]  Potential Persistence Via Event Viewer Events.asp
  T1037.001_potential-persistence-via-logon-scripts-registry.yml  [T1037.001]  Potential Persistence Via Logon Scripts - Registry
  T1053.005_potential-persistence-via-microsoft-compatibility-appraiser.yml  [T1053.005]  Potential Persistence Via Microsoft Compatibility Appraiser
  T1546.007_potential-persistence-via-netsh-helper-dll.yml  [T1546.007]  Potential Persistence Via Netsh Helper DLL
  T1546.007_potential-persistence-via-netsh-helper-dll-registry.yml  [T1546.007]  Potential Persistence Via Netsh Helper DLL - Registry
  potential-persistence-via-new-amsi-providers-registry.yml  []  Potential Persistence Via New AMSI Providers - Registry
  potential-persistence-via-notepad-plugins.yml  []  Potential Persistence Via Notepad++ Plugins
  T1546.013_potential-persistence-via-powershell-user-profile-using-add.yml  [T1546.013]  Potential Persistence Via PowerShell User Profile Using Add-Content
  T1546.015_potential-persistence-via-scrobj-dll-com-hijacking.yml  [T1546.015]  Potential Persistence Via Scrobj.dll COM Hijacking
  T1546.011_potential-persistence-via-shim-database-modification.yml  [T1546.011]  Potential Persistence Via Shim Database Modification
  T1059_potential-persistence-via-vmwaretoolboxcmd-exe-vm-state-chan.yml  [T1059]  Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
  T1137.006_potential-persistence-via-visual-studio-tools-for-office.yml  [T1137.006]  Potential Persistence Via Visual Studio Tools for Office
  T1187_potential-petitpotam-attack-via-efs-rpc-calls.yml  [T1187,T1557.001]  Potential PetitPotam Attack Via EFS RPC Calls
  T1059.003_potential-pikabot-infection-suspicious-command-combinations.yml  [T1059.003,T1105,T1218]  Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE
  T1552.001_potential-powershell-console-history-access-attempt-via-hist.yml  [T1552.001]  Potential PowerShell Console History Access Attempt via History File
  T1059.001_potential-powershell-downgrade-attack.yml  [T1059.001]  Potential PowerShell Downgrade Attack
  potential-powershell-execution-policy-tampering.yml  []  Potential PowerShell Execution Policy Tampering
  T1685_potential-privileged-system-service-operation-seloaddriverpr.yml  [T1685]  Potential Privileged System Service Operation - SeLoadDriverPrivilege
  T1216_potential-process-execution-proxy-via-cl-invocation-ps1.yml  [T1216]  Potential Process Execution Proxy Via CL_Invocation.ps1
  T1055.012_potential-process-hollowing-activity.yml  [T1055.012]  Potential Process Hollowing Activity
  T1047_potential-product-class-reconnaissance-via-wmic-exe.yml  [T1047,T1082]  Potential Product Class Reconnaissance Via Wmic.EXE
  T1047_potential-product-reconnaissance-via-wmic-exe.yml  [T1047]  Potential Product Reconnaissance Via Wmic.EXE
  T1218_potential-provlaunch-exe-binary-proxy-execution-abuse.yml  [T1218]  Potential Provlaunch.EXE Binary Proxy Execution Abuse
  T1574.001_potential-python-dll-sideloading.yml  [T1574.001]  Potential Python DLL SideLoading
  T1210_potential-rdp-exploit-cve-2019-0708.yml  [T1210]  Potential RDP Exploit CVE-2019-0708
  potential-rdp-session-hijacking-activity.yml  []  Potential RDP Session Hijacking Activity
  T1070_potential-ransomware-or-unauthorized-mbr-tampering-via-bcded.yml  [T1070,T1542.003]  Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
  T1016_potential-recon-activity-via-nltest-exe.yml  [T1016,T1482]  Potential Recon Activity Via Nltest.EXE
  T1059.005_potential-reconnaissance-activity-via-gathernetworkinfo-vbs.yml  [T1059.005,T1615]  Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
  T1036_potential-reflectdebugger-content-execution-via-werfault-exe.yml  [T1036]  Potential ReflectDebugger Content Execution Via WerFault.EXE
  T1218_potential-register-app-vbs-lolscript-abuse.yml  [T1218]  Potential Register_App.Vbs LOLScript Abuse
  T1574_potential-registry-persistence-attempt-via-dbgmanageddebugge.yml  [T1574]  Potential Registry Persistence Attempt Via DbgManagedDebugger
  T1007_potential-registry-reconnaissance-via-powershell-script.yml  [T1007,T1012]  Potential Registry Reconnaissance Via PowerShell Script
  T1218.010_potential-regsvr32-commandline-flag-anomaly.yml  [T1218.010]  Potential Regsvr32 Commandline Flag Anomaly
  T1609_potential-remote-command-execution-in-pod-container.yml  [T1609]  Potential Remote Command Execution In Pod Container
  T1219.002_potential-remote-desktop-connection-to-non-domain-host.yml  [T1219.002]  Potential Remote Desktop Connection to Non-Domain Host
  T1021_potential-remote-desktop-tunneling.yml  [T1021]  Potential Remote Desktop Tunneling
  T1546.003_potential-remote-wmi-activescripteventconsumers-activity.yml  [T1546.003]  Potential Remote WMI ActiveScriptEventConsumers Activity
  T1574.001_potential-rjvplatform-dll-sideloading-from-default-location.yml  [T1574.001]  Potential RjvPlatform.DLL Sideloading From Default Location
  T1574.001_potential-roboform-dll-sideloading.yml  [T1574.001]  Potential RoboForm.DLL Sideloading
  potential-ruby-reverse-shell.yml  []  Potential Ruby Reverse Shell
  T1059.003_potential-sap-netweaver-webshell-creation.yml  [T1059.003,T1190]  Potential SAP NetWeaver Webshell Creation
  T1059.003_potential-sap-netweaver-webshell-creation-linux.yml  [T1059.003,T1190]  Potential SAP NetWeaver Webshell Creation - Linux
  T1558.003_potential-spn-enumeration-via-setspn-exe.yml  [T1558.003]  Potential SPN Enumeration Via Setspn.EXE
  T1216_potential-script-proxy-execution-via-cl-mutexverifiers-ps1.yml  [T1216]  Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
  T1027.005_potential-secure-deletion-with-sdelete.yml  [T1027.005,T1070.004,T1485,T1553.002]  Potential Secure Deletion with SDelete
  potential-sentinelone-shell-context-menu-scan-command-tamper.yml  []  Potential SentinelOne Shell Context Menu Scan Command Tampering
  potential-shelldispatch-dll-functionality-abuse.yml  []  Potential ShellDispatch.DLL Functionality Abuse
  T1574.001_potential-shelldispatch-dll-sideloading.yml  [T1574.001]  Potential ShellDispatch.DLL Sideloading
  T1055_potential-shellcode-injection.yml  [T1055]  Potential Shellcode Injection
  T1546.011_potential-shim-database-persistence-via-sdbinst-exe.yml  [T1546.011]  Potential Shim Database Persistence via Sdbinst.EXE
  T1609_potential-sidecar-injection-into-running-deployment.yml  [T1609]  Potential Sidecar Injection Into Running Deployment
  T1574.001_potential-solidpdfcreator-dll-sideloading.yml  [T1574.001]  Potential SolidPDFCreator.DLL Sideloading
  T1082_potential-suspicious-activity-using-secedit.yml  [T1082,T1505.005,T1546.007,T1546.008,T1547.001,T1547.002,T1547.010,T1547.014,T1556.002,T1557,T1564.002,T1574.007,T1685,T1685.001]  Potential Suspicious Activity Using SeCEdit
  T1204.002_potential-suspicious-browser-launch-from-document-reader-pro.yml  [T1204.002]  Potential Suspicious Browser Launch From Document Reader Process
  T1565.001_potential-suspicious-change-to-sensitive-critical-files.yml  [T1565.001]  Potential Suspicious Change To Sensitive/Critical Files
  T1059.001_potential-suspicious-powershell-keywords.yml  [T1059.001]  Potential Suspicious PowerShell Keywords
  potential-suspicious-powershell-module-file-created.yml  []  Potential Suspicious PowerShell Module File Created
  T1112_potential-suspicious-registry-file-imported-via-reg-exe.yml  [T1112]  Potential Suspicious Registry File Imported Via Reg.EXE
  potential-suspicious-windows-feature-enabled.yml  []  Potential Suspicious Windows Feature Enabled
  potential-suspicious-windows-feature-enabled-proccreation.yml  []  Potential Suspicious Windows Feature Enabled - ProcCreation
  T1548.002_potential-uac-bypass-via-sdclt-exe.yml  [T1548.002]  Potential UAC Bypass Via Sdclt.EXE
  T1018_potential-unconstrained-delegation-discovery-via-get-adcompu.yml  [T1018,T1558,T1589.002]  Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
  T1047_potential-unquoted-service-path-reconnaissance-via-wmic-exe.yml  [T1047]  Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
  T1574.001_potential-vivaldi-elf-dll-sideloading.yml  [T1574.001]  Potential Vivaldi_elf.DLL Sideloading
  T1047_potential-wmi-lateral-movement-wmiprvse-spawned-powershell.yml  [T1047,T1059.001]  Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
  T1574.001_potential-wwlib-dll-sideloading.yml  [T1574.001]  Potential WWlib.DLL Sideloading
  T1574.001_potential-wazuh-security-platform-dll-sideloading.yml  [T1574.001]  Potential Wazuh Security Platform DLL Sideloading
  T1505.003_potential-webshell-creation-on-static-website.yml  [T1505.003]  Potential Webshell Creation On Static Website
  potential-xcsset-malware-infection.yml  []  Potential XCSSET Malware Infection
  T1059_potential-xterm-reverse-shell.yml  [T1059]  Potential Xterm Reverse Shell
  T1218_potentially-over-permissive-permissions-granted-using-dsacls.yml  [T1218]  Potentially Over Permissive Permissions Granted Using Dsacls.EXE
  T1003.001_potentially-suspicious-accessmask-requested-from-lsass.yml  [T1003.001]  Potentially Suspicious AccessMask Requested From LSASS
  T1090.004_potentially-suspicious-azure-front-door-connection.yml  [T1090.004,T1102.002]  Potentially Suspicious Azure Front Door Connection
  T1218_potentially-suspicious-cmd-shell-output-redirect.yml  [T1218]  Potentially Suspicious CMD Shell Output Redirect
  T1218_potentially-suspicious-cabinet-file-expansion.yml  [T1218]  Potentially Suspicious Cabinet File Expansion
  potentially-suspicious-call-to-win32-nteventlogfile-class-ps.yml  []  Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript
  potentially-suspicious-child-process-of-clickonce-applicatio.yml  []  Potentially Suspicious Child Process Of ClickOnce Application
  T1218_potentially-suspicious-child-process-of-diskshadow-exe.yml  [T1218]  Potentially Suspicious Child Process Of DiskShadow.EXE
  T1202_potentially-suspicious-child-process-of-vscode.yml  [T1202,T1218]  Potentially Suspicious Child Process Of VsCode
  T1203_potentially-suspicious-child-process-of-winrar-exe.yml  [T1203]  Potentially Suspicious Child Process Of WinRAR.EXE
  T1203_potentially-suspicious-child-process-of-keyscrambler-exe.yml  [T1203,T1574.001]  Potentially Suspicious Child Process of KeyScrambler.exe
  T1528_potentially-suspicious-command-targeting-teams-sensitive-fil.yml  [T1528]  Potentially Suspicious Command Targeting Teams Sensitive Files
  T1560.001_potentially-suspicious-compression-tool-parameters.yml  [T1560.001]  Potentially Suspicious Compression Tool Parameters
  potentially-suspicious-dmp-hdmp-file-creation.yml  []  Potentially Suspicious DMP/HDMP File Creation
  T1112_potentially-suspicious-desktop-background-change-using-reg-e.yml  [T1112,T1491.001]  Potentially Suspicious Desktop Background Change Using Reg.EXE
  T1112_potentially-suspicious-desktop-background-change-via-registr.yml  [T1112,T1491.001]  Potentially Suspicious Desktop Background Change Via Registry
  potentially-suspicious-electron-application-commandline.yml  []  Potentially Suspicious Electron Application CommandLine
  T1087_potentially-suspicious-eventlog-recon-activity-using-log-que.yml  [T1087,T1552]  Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
  T1036_potentially-suspicious-execution-from-tmp-folder.yml  [T1036]  Potentially Suspicious Execution From Tmp Folder
  potentially-suspicious-execution-of-pdqdeployrunner.yml  []  Potentially Suspicious Execution Of PDQDeployRunner
  T1218.009_potentially-suspicious-execution-of-regasm-regsvcs-from-unco.yml  [T1218.009]  Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
  T1218.009_potentially-suspicious-execution-of-regasm-regsvcs-with-unco.yml  [T1218.009]  Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
  T1105_potentially-suspicious-file-creation-by-openedr-s-itsmservic.yml  [T1105,T1219,T1570]  Potentially Suspicious File Creation by OpenEDR's ITSMService
  T1003.001_potentially-suspicious-grantedaccess-flags-on-lsass.yml  [T1003.001]  Potentially Suspicious GrantedAccess Flags On LSASS
  T1059.007_potentially-suspicious-inline-javascript-execution-via-nodej.yml  [T1059.007]  Potentially Suspicious Inline JavaScript Execution via NodeJS Binary
  T1528_potentially-suspicious-jwt-token-search-via-cli.yml  [T1528,T1552.001]  Potentially Suspicious JWT Token Search Via CLI
  T1059_potentially-suspicious-ntfs-symlink-behavior-modification.yml  [T1059,T1222.001]  Potentially Suspicious NTFS Symlink Behavior Modification
  potentially-suspicious-named-pipe-created-via-mkfifo.yml  []  Potentially Suspicious Named Pipe Created Via Mkfifo
  T1070.004_potentially-suspicious-ping-copy-command-combination.yml  [T1070.004]  Potentially Suspicious Ping/Copy Command Combination
  T1059.001_potentially-suspicious-powershell-child-processes.yml  [T1059.001]  Potentially Suspicious PowerShell Child Processes
  T1059.001_potentially-suspicious-powershell-script-execution-from-temp.yml  [T1059.001]  Potentially Suspicious Powershell Script Execution From Temp Folder
  T1218.010_potentially-suspicious-regsvr32-http-ftp-pattern.yml  [T1218.010]  Potentially Suspicious Regsvr32 HTTP/FTP Pattern
  T1218.011_potentially-suspicious-rundll32-activity.yml  [T1218.011]  Potentially Suspicious Rundll32 Activity
  T1071_potentially-suspicious-rundll32-exe-execution-of-udl-file.yml  [T1071,T1218.011]  Potentially Suspicious Rundll32.EXE Execution of UDL File
  T1218_potentially-suspicious-self-extraction-directive-file-create.yml  [T1218]  Potentially Suspicious Self Extraction Directive File Created
  T1090_potentially-suspicious-usage-of-qemu.yml  [T1090,T1572]  Potentially Suspicious Usage Of Qemu
  T1490_potentially-suspicious-volume-shadow-copy-vsstrace-dll-load.yml  [T1490]  Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
  potentially-suspicious-wdac-policy-file-creation.yml  []  Potentially Suspicious WDAC Policy File Creation
  T1059.001_potentially-suspicious-webdav-lnk-execution.yml  [T1059.001,T1204]  Potentially Suspicious WebDAV LNK Execution
  potentially-suspicious-windows-app-activity.yml  []  Potentially Suspicious Windows App Activity
  T1218_potentially-suspicious-wuauclt-network-connection.yml  [T1218]  Potentially Suspicious Wuauclt Network Connection
  T1070_powershell-console-history-logs-deleted.yml  [T1070]  PowerShell Console History Logs Deleted
  T1059.001_powershell-core-dll-loaded-by-non-powershell-process.yml  [T1059.001]  PowerShell Core DLL Loaded By Non PowerShell Process
  powershell-core-dll-loaded-via-office-application.yml  []  PowerShell Core DLL Loaded Via Office Application
  T1059.001_powershell-create-local-user.yml  [T1059.001,T1136.001]  PowerShell Create Local User
  T1070.005_powershell-deleted-mounted-share.yml  [T1070.005]  PowerShell Deleted Mounted Share
  T1059.001_powershell-downgrade-attack-powershell.yml  [T1059.001]  PowerShell Downgrade Attack - PowerShell
  T1059.001_powershell-download-pattern.yml  [T1059.001]  PowerShell Download Pattern
  T1115_powershell-get-clipboard.yml  [T1115]  PowerShell Get Clipboard
  T1115_powershell-get-clipboard-cmdlet-via-cli.yml  [T1115]  PowerShell Get-Clipboard Cmdlet Via CLI
  powershell-hotfix-enumeration.yml  []  PowerShell Hotfix Enumeration
  T1048.003_powershell-icmp-exfiltration.yml  [T1048.003]  PowerShell ICMP Exfiltration
  T1059.001_powershell-msi-install-via-windowsinstaller-com-from-remote.yml  [T1059.001,T1105,T1218]  PowerShell MSI Install via WindowsInstaller COM From Remote Location
  powershell-module-file-created-by-non-powershell-process.yml  []  PowerShell Module File Created By Non-PowerShell Process
  T1546.013_powershell-profile-modification.yml  [T1546.013]  PowerShell Profile Modification
  T1059.001_powershell-remote-session-creation.yml  [T1059.001]  PowerShell Remote Session Creation
  T1059.001_powershell-script-run-in-appdata.yml  [T1059.001]  PowerShell Script Run in AppData
  T1020_powershell-script-with-file-hostname-resolving-capabilities.yml  [T1020]  PowerShell Script With File Hostname Resolving Capabilities
  T1218.007_powershell-wmi-win32-product-install-msi.yml  [T1218.007]  PowerShell WMI Win32_Product Install MSI
  powershell-write-eventlog-usage.yml  []  PowerShell Write-EventLog Usage
  T1053.005_powershell-create-scheduled-task.yml  [T1053.005]  Powershell Create Scheduled Task
  T1685_powershell-defender-exclusion.yml  [T1685]  Powershell Defender Exclusion
  T1497.001_powershell-detect-virtualization-environment.yml  [T1497.001]  Powershell Detect Virtualization Environment
  T1083_powershell-directory-enumeration.yml  [T1083]  Powershell Directory Enumeration
  T1059.003_powershell-execute-batch-script.yml  [T1059.003]  Powershell Execute Batch Script
  T1059.001_powershell-executed-from-headless-conhost-process.yml  [T1059.001,T1059.003,T1564.003]  Powershell Executed From Headless ConHost Process
  T1059.001_powershell-inline-execution-from-a-file.yml  [T1059.001]  Powershell Inline Execution From A File
  T1056.001_powershell-keylogging.yml  [T1056.001]  Powershell Keylogging
  T1114.001_powershell-local-email-collection.yml  [T1114.001]  Powershell Local Email Collection
  T1098_powershell-localaccount-manipulation.yml  [T1098]  Powershell LocalAccount Manipulation
  T1059.001_powershell-msxml-com-object.yml  [T1059.001]  Powershell MsXml COM Object
  T1083_powershell-sensitive-file-discovery.yml  [T1083]  Powershell Sensitive File Discovery
  T1564.004_powershell-store-file-in-alternate-data-stream.yml  [T1564.004]  Powershell Store File In Alternate Data Stream
  T1070.006_powershell-timestomp.yml  [T1070.006]  Powershell Timestomp
  T1027.009_powershell-token-obfuscation-powershell.yml  [T1027.009]  Powershell Token Obfuscation - Powershell
  T1546.003_powershell-wmi-persistence.yml  [T1546.003]  Powershell WMI Persistence
  T1059.001_powershell-xml-execute-command.yml  [T1059.001]  Powershell XML Execute Command
  T1592.004_print-history-file-contents.yml  [T1592.004]  Print History File Contents
  T1552.004_private-keys-reconnaissance-via-commandline-tools.yml  [T1552.004]  Private Keys Reconnaissance Via CommandLine Tools
  T1078.004_privileged-account-creation.yml  [T1078.004]  Privileged Account Creation
  T1003.001_procdump-execution.yml  [T1003.001,T1036]  Procdump Execution
  T1055_process-creation-using-sysnative-folder.yml  [T1055]  Process Creation Using Sysnative Folder
  process-deletion-of-its-own-executable.yml  []  Process Deletion of Its Own Executable
  process-launched-without-image-name.yml  []  Process Launched Without Image Name
  T1218_process-memory-dump-via-dotnet-dump.yml  [T1218]  Process Memory Dump Via Dotnet-Dump
  T1068_process-monitor-driver-creation-by-non-sysinternals-binary.yml  [T1068]  Process Monitor Driver Creation By Non-Sysinternals Binary
  T1218_process-proxy-execution-via-squirrel-exe.yml  [T1218]  Process Proxy Execution Via Squirrel.EXE
  T1047_process-reconnaissance-via-wmic-exe.yml  [T1047]  Process Reconnaissance Via Wmic.EXE
  T1123_processes-accessing-the-microphone-and-webcam.yml  [T1123]  Processes Accessing the Microphone and Webcam
  T1218_program-executed-using-proxy-local-command-via-ssh-exe.yml  [T1218]  Program Executed Using Proxy/Local Command Via SSH.EXE
  T1584_program-executions-in-suspicious-folders.yml  [T1584,T1587]  Program Executions in Suspicious Folders
  T1202_proxy-execution-via-vshadow.yml  [T1202]  Proxy Execution via Vshadow
  psexec-service-execution.yml  []  PsExec Service Execution
  T1569.002_psexec-service-installation.yml  [T1569.002]  PsExec Service Installation
  T1569.002_psexec-tool-execution-from-suspicious-locations-pipename.yml  [T1569.002]  PsExec Tool Execution From Suspicious Locations - PipeName
  T1021_psexec-execution.yml  [T1021,T1569]  Psexec Execution
  publisher-attachment-file-dropped-in-suspicious-location.yml  []  Publisher Attachment File Dropped In Suspicious Location
  T1216.001_pubprn-vbs-proxy-execution.yml  [T1216.001]  Pubprn.vbs Proxy Execution
  T1046_python-initiated-connection.yml  [T1046]  Python Initiated Connection
  T1059_python-inline-command-execution.yml  [T1059]  Python Inline Command Execution
  T1059.006_python-path-configuration-file-creation-linux.yml  [T1059.006]  Python Path Configuration File Creation - Linux
  T1059.006_python-path-configuration-file-creation-macos.yml  [T1059.006]  Python Path Configuration File Creation - MacOS
  T1059.006_python-path-configuration-file-creation-windows.yml  [T1059.006]  Python Path Configuration File Creation - Windows
  T1190_python-sql-exceptions.yml  [T1190]  Python SQL Exceptions
  T1059_python-spawning-pretty-tty-via-pty-module.yml  [T1059]  Python Spawning Pretty TTY Via PTY Module
  T1048.003_python-webserver-execution-linux.yml  [T1048.003]  Python WebServer Execution - Linux
  query-usage-to-exfil-data.yml  []  Query Usage To Exfil Data
  T1021.001_rdp-enable-or-disable-via-win32-terminalservicesetting-wmi-c.yml  [T1021.001,T1047]  RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
  T1112_rdp-sensitive-settings-changed-to-zero.yml  [T1112]  RDP Sensitive Settings Changed to Zero
  T1190_rds-database-security-group-modification.yml  [T1190]  RDS Database Security Group Modification
  T1218_register-app-vbs-proxy-execution.yml  [T1218]  REGISTER_APP.VBS Proxy Execution
  T1003_rare-subscription-level-operations-in-azure.yml  [T1003]  Rare Subscription-level Operations In Azure
  T1567.002_rclone-activity-via-proxy.yml  [T1567.002]  Rclone Activity via Proxy
  T1567.002_rclone-config-file-creation.yml  [T1567.002]  Rclone Config File Creation
  T1059.003_read-contents-from-stdin-via-cmd-exe.yml  [T1059.003]  Read Contents From Stdin Via Cmd.EXE
  rebuild-performance-counter-values-via-lodctr-exe.yml  []  Rebuild Performance Counter Values Via Lodctr.EXE
  T1057_recon-command-output-piped-to-findstr-exe.yml  [T1057]  Recon Command Output Piped To Findstr.EXE
  T1119_recon-information-for-export-with-command-prompt.yml  [T1119]  Recon Information for Export with Command Prompt
  T1119_recon-information-for-export-with-powershell.yml  [T1119]  Recon Information for Export with PowerShell
  T1218.009_regasm-exe-initiating-network-connection-to-public-ip.yml  [T1218.009]  RegAsm.EXE Initiating Network Connection To Public IP
  register-new-ifiltre-for-persistence.yml  []  Register New IFiltre For Persistence
  T1112_registry-explorer-policy-modification.yml  [T1112]  Registry Explorer Policy Modification
  T1112_registry-hide-function-from-user.yml  [T1112]  Registry Hide Function from User
  T1012_registry-manipulation-via-wmi-stdregprov.yml  [T1012,T1047,T1112]  Registry Manipulation via WMI Stdregprov
  T1059.005_registry-modification-attempt-via-vbscript.yml  [T1059.005,T1112]  Registry Modification Attempt Via VBScript
  T1059.005_registry-modification-attempt-via-vbscript-powershell.yml  [T1059.005,T1112]  Registry Modification Attempt Via VBScript - PowerShell
  T1112_registry-modification-of-ms-settings-protocol-handler.yml  [T1112,T1546.001,T1548.002]  Registry Modification of MS-settings Protocol Handler
  T1137_registry-modification-to-hidden-file-extension.yml  [T1137]  Registry Modification to Hidden File Extension
  T1027.010_registry-set-with-crypto-classes-from-the-cryptography-power.yml  [T1027.010,T1059.001,T1547.001]  Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
  T1059.005_registry-tampering-by-potentially-suspicious-processes.yml  [T1059.005,T1112]  Registry Tampering by Potentially Suspicious Processes
  T1574.012_registry-free-process-scope-cor-profiler.yml  [T1574.012]  Registry-Free Process Scope COR_PROFILER
  T1574_regsvr32-dll-execution-with-uncommon-extension.yml  [T1574]  Regsvr32 DLL Execution With Uncommon Extension
  T1218.010_regsvr32-execution-from-potential-suspicious-location.yml  [T1218.010]  Regsvr32 Execution From Potential Suspicious Location
  T1218_regsvr32-exe-calling-of-dllregisterserver-export-function-im.yml  [T1218]  Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly
  T1569.002_remcom-service-file-creation.yml  [T1569.002]  RemCom Service File Creation
  T1569.002_remcom-service-installation.yml  [T1569.002]  RemCom Service Installation
  T1219.002_remote-access-tool-action1-arbitrary-code-execution-and-remo.yml  [T1219.002]  Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions
  remote-access-tool-ammy-admin-agent-execution.yml  []  Remote Access Tool - Ammy Admin Agent Execution
  T1219.002_remote-access-tool-anydesk-execution.yml  [T1219.002]  Remote Access Tool - AnyDesk Execution
  remote-access-tool-anydesk-execution-with-known-revoked-sign.yml  []  Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
  T1219.002_remote-access-tool-anydesk-incoming-connection.yml  [T1219.002]  Remote Access Tool - AnyDesk Incoming Connection
  T1219.002_remote-access-tool-anydesk-piped-password-via-cli.yml  [T1219.002]  Remote Access Tool - AnyDesk Piped Password Via CLI
  remote-access-tool-cmd-exe-execution-via-anyviewer.yml  []  Remote Access Tool - Cmd.EXE Execution via AnyViewer
  T1219.002_remote-access-tool-gotoassist-execution.yml  [T1219.002]  Remote Access Tool - GoToAssist Execution
  T1219.002_remote-access-tool-logmein-execution.yml  [T1219.002]  Remote Access Tool - LogMeIn Execution
  T1219.002_remote-access-tool-meshagent-command-execution-via-meshcentr.yml  [T1219.002]  Remote Access Tool - MeshAgent Command Execution via MeshCentral
  T1219.002_remote-access-tool-netsupport-execution.yml  [T1219.002]  Remote Access Tool - NetSupport Execution
  remote-access-tool-netsupport-execution-from-unusual-locatio.yml  []  Remote Access Tool - NetSupport Execution From Unusual Location
  T1219.002_remote-access-tool-potential-meshagent-execution-macos.yml  [T1219.002]  Remote Access Tool - Potential MeshAgent Execution - MacOS
  T1219.002_remote-access-tool-potential-meshagent-execution-windows.yml  [T1219.002]  Remote Access Tool - Potential MeshAgent Execution - Windows
  remote-access-tool-rurat-execution-from-unusual-location.yml  []  Remote Access Tool - RURAT Execution From Unusual Location
  T1219.002_remote-access-tool-screenconnect-execution.yml  [T1219.002]  Remote Access Tool - ScreenConnect Execution
  T1133_remote-access-tool-screenconnect-installation-execution.yml  [T1133]  Remote Access Tool - ScreenConnect Installation Execution
  T1219.002_remote-access-tool-screenconnect-potential-suspicious-remote.yml  [T1219.002]  Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
  remote-access-tool-screenconnect-remote-command-execution-hu.yml  []  Remote Access Tool - ScreenConnect Remote Command Execution - Hunting
  T1219.002_remote-access-tool-simple-help-execution.yml  [T1219.002]  Remote Access Tool - Simple Help Execution
  T1105_remote-access-tool-tacticalrmm-agent-registration-to-potenti.yml  [T1105,T1219]  Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
  T1219.002_remote-access-tool-ultraviewer-execution.yml  [T1219.002]  Remote Access Tool - UltraViewer Execution
  T1543.003_remote-access-tool-services-have-been-installed-security.yml  [T1543.003,T1569.002]  Remote Access Tool Services Have Been Installed - Security
  T1543.003_remote-access-tool-services-have-been-installed-system.yml  [T1543.003,T1569.002]  Remote Access Tool Services Have Been Installed - System
  T1216_remote-code-execute-via-winrm-vbs.yml  [T1216]  Remote Code Execute via Winrm.vbs
  T1204.002_remote-dll-load-via-rundll32-exe.yml  [T1204.002]  Remote DLL Load Via Rundll32.EXE
  T1105_remote-file-download-via-desktopimgdownldr-utility.yml  [T1105]  Remote File Download Via Desktopimgdownldr Utility
  T1105_remote-file-download-via-findstr-exe.yml  [T1105,T1218,T1552.001,T1564.004]  Remote File Download Via Findstr.EXE
  T1021.006_remote-powershell-session-host-process-winrm.yml  [T1021.006,T1059.001]  Remote PowerShell Session Host Process (WinRM)
  T1012_remote-registry-management-using-reg-utility.yml  [T1012,T1112,T1552.002]  Remote Registry Management Using Reg Utility
  T1021.002_remote-service-activity-via-svcctl-named-pipe.yml  [T1021.002]  Remote Service Activity via SVCCTL Named Pipe
  T1053.002_remote-task-creation-via-atsvc-named-pipe.yml  [T1053.002]  Remote Task Creation via ATSVC Named Pipe
  T1053.002_remote-task-creation-via-atsvc-named-pipe-zeek.yml  [T1053.002]  Remote Task Creation via ATSVC Named Pipe - Zeek
  T1055_remote-thread-created-in-shell-application.yml  [T1055]  Remote Thread Created In Shell Application
  T1055_remote-thread-creation-by-uncommon-source-image.yml  [T1055]  Remote Thread Creation By Uncommon Source Image
  T1055.003_remote-thread-creation-in-uncommon-target-image.yml  [T1055.003]  Remote Thread Creation In Uncommon Target Image
  T1059.001_remote-thread-creation-via-powershell.yml  [T1059.001]  Remote Thread Creation Via PowerShell
  T1059.001_remote-thread-creation-via-powershell-in-uncommon-target.yml  [T1059.001,T1218.011]  Remote Thread Creation Via PowerShell In Uncommon Target
  remote-utilities-host-service-install.yml  []  Remote Utilities Host Service Install
  T1685_removal-of-index-value-to-hide-schedule-task-registry.yml  [T1685]  Removal Of Index Value to Hide Schedule Task - Registry
  T1685_removal-of-sd-value-to-hide-schedule-task-registry.yml  [T1685]  Removal Of SD Value to Hide Schedule Task - Registry
  T1112_removal-of-potential-com-hijacking-registry-keys.yml  [T1112]  Removal of Potential COM Hijacking Registry Keys
  T1531_remove-account-from-domain-admin-group.yml  [T1531]  Remove Account From Domain Admin Group
  T1222.002_remove-immutable-file-attribute.yml  [T1222.002]  Remove Immutable File Attribute
  T1222.002_remove-immutable-file-attribute-auditd.yml  [T1222.002]  Remove Immutable File Attribute - Auditd
  remove-scheduled-cron-task-job.yml  []  Remove Scheduled Cron Task/Job
  renamed-autohotkey-exe-execution.yml  []  Renamed AutoHotkey.EXE Execution
  T1553_renamed-boinc-client-execution.yml  [T1553]  Renamed BOINC Client Execution
  T1059_renamed-curl-exe-execution.yml  [T1059,T1202]  Renamed CURL.EXE Execution
  T1059_renamed-ftp-exe-execution.yml  [T1059,T1202]  Renamed FTP.EXE Execution
  renamed-microsoft-teams-execution.yml  []  Renamed Microsoft Teams Execution
  renamed-remote-utilities-rat-rurat-execution.yml  []  Renamed Remote Utilities RAT (RURAT) Execution
  T1105_replace-exe-usage.yml  [T1105]  Replace.exe Usage
  T1218.008_response-file-execution-via-odbcconf-exe.yml  [T1218.008]  Response File Execution Via Odbcconf.EXE
  T1218.011_rhadamanthys-stealer-module-launch-via-rundll32-exe.yml  [T1218.011]  Rhadamanthys Stealer Module Launch Via Rundll32.EXE
  T1078_root-account-enable-via-dsenableroot.yml  [T1078,T1078.001,T1078.003]  Root Account Enable Via Dsenableroot
  T1553.004_root-certificate-installed-powershell.yml  [T1553.004]  Root Certificate Installed - PowerShell
  T1059_ruby-inline-command-execution.yml  [T1059]  Ruby Inline Command Execution
  T1190_ruby-on-rails-framework-exceptions.yml  [T1190]  Ruby on Rails Framework Exceptions
  T1112_run-once-task-configuration-in-registry.yml  [T1112]  Run Once Task Configuration in Registry
  T1218.011_rundll32-execution-with-uncommon-dll-extension.yml  [T1218.011]  Rundll32 Execution With Uncommon DLL Extension
  T1218.011_rundll32-installscreensaver-execution.yml  [T1218.011]  Rundll32 InstallScreenSaver Execution
  T1218.011_rundll32-internet-connection.yml  [T1218.011]  Rundll32 Internet Connection
  rundll32-spawned-via-explorer-exe.yml  []  Rundll32 Spawned Via Explorer.EXE
  T1218_rundll32-exe-calling-dllregisterserver-export-function-expli.yml  [T1218]  Rundll32.EXE Calling DllRegisterServer Export Function Explicitly
  T1010_scm-database-handle-failure.yml  [T1010]  SCM Database Handle Failure
  T1548_scm-database-privileged-operation.yml  [T1548]  SCM Database Privileged Operation
  T1218.011_scr-file-write-event.yml  [T1218.011]  SCR File Write Event
  T1070_ses-identity-has-been-deleted.yml  [T1070]  SES Identity Has Been Deleted
  T1021.002_smb-spoolss-name-piped-usage.yml  [T1021.002]  SMB Spoolss Name Piped Usage
  T1570_smb-over-quic-via-net-exe.yml  [T1570]  SMB over QUIC Via Net.EXE
  T1570_smb-over-quic-via-powershell-script.yml  [T1570]  SMB over QUIC Via PowerShell Script
  T1059.001_sql-client-tools-powershell-session-detection.yml  [T1059.001,T1127]  SQL Client Tools PowerShell Session Detection
  T1589_sshd-error-message-cve-2018-15473.yml  [T1589]  SSHD Error Message CVE-2018-15473
  T1053.005_schedule-task-creation-from-env-variable-or-potentially-susp.yml  [T1053.005]  Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
  T1053.003_scheduled-cron-task-job-linux.yml  [T1053.003]  Scheduled Cron Task/Job - Linux
  T1053.003_scheduled-cron-task-job-macos.yml  [T1053.003]  Scheduled Cron Task/Job - MacOs
  T1053.005_scheduled-task-creation-from-potential-suspicious-parent-loc.yml  [T1053.005]  Scheduled Task Creation From Potential Suspicious Parent Location
  T1053.005_scheduled-task-creation-with-curl-and-powershell-execution-c.yml  [T1053.005,T1105,T1218]  Scheduled Task Creation with Curl and PowerShell Execution Combo
  T1053.005_scheduled-task-executed-from-a-suspicious-location.yml  [T1053.005]  Scheduled Task Executed From A Suspicious Location
  T1053.005_scheduled-task-executed-uncommon-lolbin.yml  [T1053.005]  Scheduled Task Executed Uncommon LOLBIN
  T1053.005_scheduled-task-executing-payload-from-registry.yml  [T1053.005,T1059.001]  Scheduled Task Executing Payload from Registry
  T1113_screen-capture-activity-via-psr-exe.yml  [T1113]  Screen Capture Activity Via Psr.EXE
  T1219.002_screenconnect-temporary-installation-artefact.yml  [T1219.002]  ScreenConnect Temporary Installation Artefact
  screenconnect-user-database-modification.yml  []  ScreenConnect User Database Modification
  screenconnect-user-database-modification-security.yml  []  ScreenConnect User Database Modification - Security
  T1218.011_screensaver-registry-key-set.yml  [T1218.011]  ScreenSaver Registry Key Set
  T1685_scripted-diagnostics-turn-off-check-enabled-registry.yml  [T1685]  Scripted Diagnostics Turn Off Check Enabled - Registry
  T1218.010_scripting-commandline-process-spawned-regsvr32.yml  [T1218.010]  Scripting/CommandLine Process Spawned Regsvr32
  T1548.002_sdclt-child-processes.yml  [T1548.002]  Sdclt Child Processes
  T1518.001_security-software-discovery-macos.yml  [T1518.001]  Security Software Discovery - MacOs
  T1518.001_security-software-discovery-via-powershell-script.yml  [T1518.001]  Security Software Discovery Via Powershell Script
  T1518.001_security-tools-keyword-lookup-via-findstr-exe.yml  [T1518.001]  Security Tools Keyword Lookup Via Findstr.EXE
  T1218_self-extraction-directive-file-created-in-potentially-suspic.yml  [T1218]  Self Extraction Directive File Created In Potentially Suspicious Location
  T1112_service-binary-in-user-controlled-folder.yml  [T1112]  Service Binary in User Controlled Folder
  T1543.003_service-installation-in-suspicious-folder.yml  [T1543.003]  Service Installation in Suspicious Folder
  T1047_service-reconnaissance-via-wmic-exe.yml  [T1047]  Service Reconnaissance Via Wmic.EXE
  T1574.011_service-registry-permissions-weakness-check.yml  [T1574.011]  Service Registry Permissions Weakness Check
  T1574.011_service-security-descriptor-tampering-via-sc-exe.yml  [T1574.011]  Service Security Descriptor Tampering Via Sc.EXE
  T1047_service-started-stopped-via-wmic-exe.yml  [T1047]  Service Started/Stopped Via Wmic.EXE
  T1047_service-startup-type-change-via-wmic-exe.yml  [T1047,T1685]  Service Startup Type Change Via Wmic.EXE
  T1685_service-startuptype-change-via-powershell-set-service.yml  [T1685]  Service StartupType Change Via PowerShell Set-Service
  T1685_service-startuptype-change-via-sc-exe.yml  [T1685]  Service StartupType Change Via Sc.EXE
  T1543.003_servicedll-hijack.yml  [T1543.003]  ServiceDll Hijack
  T1546.009_session-manager-autorun-keys-modification.yml  [T1546.009,T1547.001]  Session Manager Autorun Keys Modification
  T1574.005_setup16-exe-execution-with-custom-lst-file.yml  [T1574.005]  Setup16.EXE Execution With Custom .Lst File
  T1003_shadow-copies-creation-using-operating-systems-utilities.yml  [T1003,T1003.002,T1003.003]  Shadow Copies Creation Using Operating Systems Utilities
  T1190_sharepoint-toolshell-cve-2025-53770-exploitation-web-iis.yml  [T1190]  SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
  T1083_shell-invocation-via-apt-linux.yml  [T1083]  Shell Invocation via Apt - Linux
  shell-process-spawned-by-java-exe.yml  []  Shell Process Spawned by Java.EXE
  T1083_source-code-enumeration-detection-by-keyword.yml  [T1083]  Source Code Enumeration Detection by Keyword
  T1190_spring-framework-exceptions.yml  [T1190]  Spring Framework Exceptions
  standard-user-in-high-privileged-group.yml  []  Standard User In High Privileged Group
  start-of-nt-virtual-dos-machine.yml  []  Start of NT Virtual DOS Machine
  T1547.001_startup-folder-file-write.yml  [T1547.001]  Startup Folder File Write
  T1484.001_startup-logon-script-added-to-group-policy-object.yml  [T1484.001,T1547]  Startup/Logon Script Added to Group Policy Object
  T1078.004_successful-authentications-from-countries-you-do-not-operate.yml  [T1078.004,T1110]  Successful Authentications From Countries You Do Not Operate Out Of
  T1190_successful-iis-shortname-fuzzing-scan.yml  [T1190]  Successful IIS Shortname Fuzzing Scan
  T1039_suspicious-access-to-sensitive-file-extensions.yml  [T1039]  Suspicious Access to Sensitive File Extensions
  suspicious-access-to-sensitive-file-extensions-zeek.yml  []  Suspicious Access to Sensitive File Extensions - Zeek
  T1486_suspicious-appended-extension.yml  [T1486]  Suspicious Appended Extension
  suspicious-application-installed.yml  []  Suspicious Application Installed
  T1071.001_suspicious-base64-encoded-user-agent.yml  [T1071.001]  Suspicious Base64 Encoded User-Agent
  T1059_suspicious-browser-child-process-macos.yml  [T1059,T1189,T1203]  Suspicious Browser Child Process - MacOS
  suspicious-c2-activities.yml  []  Suspicious C2 Activities
  T1202_suspicious-cabinet-file-execution-via-msdt-exe.yml  [T1202]  Suspicious Cabinet File Execution Via Msdt.EXE
  T1059.003_suspicious-child-process-of-sap-netweaver.yml  [T1059.003,T1190]  Suspicious Child Process of SAP NetWeaver
  T1059.003_suspicious-child-process-of-sap-netweaver-linux.yml  [T1059.003,T1190]  Suspicious Child Process of SAP NetWeaver - Linux
  T1036_suspicious-codepage-switch-via-chcp.yml  [T1036]  Suspicious CodePage Switch Via CHCP
  T1059.004_suspicious-commands-linux.yml  [T1059.004]  Suspicious Commands Linux
  T1078_suspicious-computer-machine-password-by-powershell.yml  [T1078]  Suspicious Computer Machine Password by PowerShell
  T1036.003_suspicious-copy-from-or-to-system-directory.yml  [T1036.003]  Suspicious Copy From or To System Directory
  T1486_suspicious-creation-txt-file-in-user-desktop.yml  [T1486]  Suspicious Creation TXT File in User Desktop
  T1187_suspicious-creation-of-library-ms-file-potential-cve-2025-24.yml  [T1187]  Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit
  T1059.001_suspicious-crushftp-child-process.yml  [T1059.001,T1059.003,T1190]  Suspicious CrushFTP Child Process
  T1072_suspicious-csi-exe-usage.yml  [T1072,T1218]  Suspicious Csi.exe Usage
  T1071.001_suspicious-curl-change-user-agents-linux.yml  [T1071.001]  Suspicious Curl Change User Agents - Linux
  T1105_suspicious-curl-file-upload-linux.yml  [T1105,T1567]  Suspicious Curl File Upload - Linux
  T1590_suspicious-dns-query-for-ip-lookup-service-apis.yml  [T1590]  Suspicious DNS Query for IP Lookup Service APIs
  T1048.003_suspicious-dns-query-with-b64-encoded-string.yml  [T1048.003,T1071.004]  Suspicious DNS Query with B64 Encoded String
  T1095_suspicious-dns-z-flag-bit-set.yml  [T1095,T1571]  Suspicious DNS Z Flag Bit Set
  T1564.004_suspicious-diantz-alternate-data-stream-execution.yml  [T1564.004]  Suspicious Diantz Alternate Data Stream Execution
  T1105_suspicious-diantz-download-and-compress-into-a-cab-file.yml  [T1105]  Suspicious Diantz Download and Compress Into a CAB File
  suspicious-digital-signature-of-appx-package.yml  []  Suspicious Digital Signature Of AppX Package
  T1027_suspicious-download-via-certutil-exe.yml  [T1027,T1105]  Suspicious Download Via Certutil.EXE
  T1547_suspicious-driver-install-by-pnputil-exe.yml  [T1547]  Suspicious Driver Install by pnputil.exe
  suspicious-electron-application-child-processes.yml  []  Suspicious Electron Application Child Processes
  T1566.001_suspicious-email-delivered-in-microsoft-365.yml  [T1566.001,T1566.002]  Suspicious Email Delivered In Microsoft 365
  T1685.005_suspicious-eventlog-clear.yml  [T1685.005]  Suspicious Eventlog Clear
  suspicious-execution-of-installutil-without-log.yml  []  Suspicious Execution of InstallUtil Without Log
  T1059.001_suspicious-execution-of-powershell-with-base64.yml  [T1059.001]  Suspicious Execution of Powershell with Base64
  T1529_suspicious-execution-of-shutdown.yml  [T1529]  Suspicious Execution of Shutdown
  T1529_suspicious-execution-of-shutdown-to-log-out.yml  [T1529]  Suspicious Execution of Shutdown to Log Out
  T1059_suspicious-execution-via-macos-script-editor.yml  [T1059,T1059.002,T1204,T1204.001,T1553,T1566,T1566.002]  Suspicious Execution via macOS Script Editor
  T1564.004_suspicious-extrac32-alternate-data-stream-execution.yml  [T1564.004]  Suspicious Extrac32 Alternate Data Stream Execution
  T1105_suspicious-extrac32-execution.yml  [T1105]  Suspicious Extrac32 Execution
  T1059.006_suspicious-file-characteristics-due-to-missing-fields.yml  [T1059.006]  Suspicious File Characteristics Due to Missing Fields
  T1059_suspicious-file-created-in-perflogs.yml  [T1059]  Suspicious File Created In PerfLogs
  T1190_suspicious-file-drop-by-exchange.yml  [T1190,T1505.003]  Suspicious File Drop by Exchange
  T1190_suspicious-file-write-to-webapps-root-directory.yml  [T1190,T1505.003]  Suspicious File Write to Webapps Root Directory
  T1036.005_suspicious-files-in-default-gpo-folder.yml  [T1036.005]  Suspicious Files in Default GPO Folder
  T1132.001_suspicious-frombase64string-usage-on-gzip-archive-process-cr.yml  [T1132.001]  Suspicious FromBase64String Usage On Gzip Archive - Process Creation
  T1132.001_suspicious-frombase64string-usage-on-gzip-archive-ps-script.yml  [T1132.001]  Suspicious FromBase64String Usage On Gzip Archive - Ps Script
  T1003.006_suspicious-get-adreplaccount.yml  [T1003.006]  Suspicious Get-ADReplAccount
  T1546.015_suspicious-gettypefromclsid-shellexecute.yml  [T1546.015]  Suspicious GetTypeFromCLSID ShellExecute
  T1593.003_suspicious-git-clone.yml  [T1593.003]  Suspicious Git Clone
  T1593.003_suspicious-git-clone-linux.yml  [T1593.003]  Suspicious Git Clone - Linux
  T1087.001_suspicious-group-and-account-reconnaissance-activity-using-n.yml  [T1087.001,T1087.002]  Suspicious Group And Account Reconnaissance Activity Using Net.EXE
  T1552.003_suspicious-history-file-operations.yml  [T1552.003]  Suspicious History File Operations
  T1552.003_suspicious-history-file-operations-linux.yml  [T1552.003]  Suspicious History File Operations - Linux
  T1564.006_suspicious-hyper-v-cmdlets.yml  [T1564.006]  Suspicious Hyper-V Cmdlets
  suspicious-iis-url-globalrules-rewrite-via-appcmd.yml  []  Suspicious IIS URL GlobalRules Rewrite Via AppCmd
  T1070.003_suspicious-io-filestream.yml  [T1070.003]  Suspicious IO.FileStream
  T1059_suspicious-installer-package-child-process.yml  [T1059,T1059.007,T1071,T1071.001]  Suspicious Installer Package Child Process
  T1553.005_suspicious-invoke-item-from-mount-diskimage.yml  [T1553.005]  Suspicious Invoke-Item From Mount-DiskImage
  T1105_suspicious-invoke-webrequest-execution-with-directip.yml  [T1105]  Suspicious Invoke-WebRequest Execution With DirectIP
  T1558.003_suspicious-kerberos-rc4-ticket-encryption.yml  [T1558.003]  Suspicious Kerberos RC4 Ticket Encryption
  T1588.002_suspicious-keyboard-layout-load.yml  [T1588.002]  Suspicious Keyboard Layout Load
  T1036.007_suspicious-lnk-double-extension-file-created.yml  [T1036.007]  Suspicious LNK Double Extension File Created
  suspicious-log-entries.yml  []  Suspicious Log Entries
  T1078.004_suspicious-login-activity-classified-by-google.yml  [T1078.004]  Suspicious Login Activity Classified By Google
  suspicious-macos-firmware-activity.yml  []  Suspicious MacOS Firmware Activity
  suspicious-msbuild-execution-by-uncommon-parent-process.yml  []  Suspicious Msbuild Execution By Uncommon Parent Process
  T1218.007_suspicious-msiexec-embedding-parent.yml  [T1218.007]  Suspicious MsiExec Embedding Parent
  T1218.007_suspicious-msiexec-execute-arbitrary-dll.yml  [T1218.007]  Suspicious Msiexec Execute Arbitrary DLL
  T1218.007_suspicious-msiexec-quiet-install-from-remote-location.yml  [T1218.007]  Suspicious Msiexec Quiet Install From Remote Location
  T1016_suspicious-network-connection-to-ip-lookup-service-apis.yml  [T1016]  Suspicious Network Connection to IP Lookup Service APIs
  suspicious-new-instance-of-an-office-com-object.yml  []  Suspicious New Instance Of An Office COM Object
  T1021.002_suspicious-new-psdrive-to-admin-share.yml  [T1021.002]  Suspicious New-PSDrive to Admin Share
  T1021.003_suspicious-non-powershell-wsman-com-provider.yml  [T1021.003,T1059.001]  Suspicious Non PowerShell WSMAN COM Provider
  T1102_suspicious-non-browser-network-communication-with-google-api.yml  [T1102]  Suspicious Non-Browser Network Communication With Google API
  T1102_suspicious-non-browser-network-communication-with-telegram-a.yml  [T1102,T1105,T1567]  Suspicious Non-Browser Network Communication With Telegram API
  suspicious-oauth-app-file-download-activities.yml  []  Suspicious OAuth App File Download Activities
  T1190_suspicious-openssh-daemon-error.yml  [T1190]  Suspicious OpenSSH Daemon Error
  T1048.003_suspicious-outbound-smtp-connections.yml  [T1048.003]  Suspicious Outbound SMTP Connections
  T1685_suspicious-procexp152-sys-file-created-in-tmp.yml  [T1685]  Suspicious PROCEXP152.sys File Created In TMP
  T1553.004_suspicious-package-installed-linux.yml  [T1553.004]  Suspicious Package Installed - Linux
  T1059.001_suspicious-powershell-download-poshmodule.yml  [T1059.001]  Suspicious PowerShell Download - PoshModule
  T1059.001_suspicious-powershell-download-powershell-script.yml  [T1059.001]  Suspicious PowerShell Download - Powershell Script
  T1547.001_suspicious-powershell-in-registry-run-keys.yml  [T1547.001]  Suspicious PowerShell In Registry Run Keys
  T1059.001_suspicious-powershell-invocation-from-script-engines.yml  [T1059.001]  Suspicious PowerShell Invocation From Script Engines
  suspicious-powershell-invocations-specific-processcreation.yml  []  Suspicious PowerShell Invocations - Specific - ProcessCreation
  T1564.003_suspicious-powershell-windowstyle-option.yml  [T1564.003]  Suspicious PowerShell WindowStyle Option
  suspicious-powercfg-execution-to-change-lock-screen-timeout.yml  []  Suspicious Powercfg Execution To Change Lock Screen Timeout
  T1036_suspicious-process-start-locations.yml  [T1036]  Suspicious Process Start Locations
  T1059_suspicious-rasdial-activity.yml  [T1059]  Suspicious RASdial Activity
  T1087.001_suspicious-reconnaissance-activity-using-get-localgroupmembe.yml  [T1087.001]  Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
  T1222.001_suspicious-recursive-takeown.yml  [T1222.001]  Suspicious Recursive Takeown
  T1110.001_suspicious-rejected-smb-guest-logon-from-ip.yml  [T1110.001]  Suspicious Rejected SMB Guest Logon From IP
  T1078_suspicious-remote-logon-with-explicit-credentials.yml  [T1078]  Suspicious Remote Logon with Explicit Credentials
  suspicious-runas-like-flag-combination.yml  []  Suspicious RunAs-Like Flag Combination
  T1218.011_suspicious-rundll32-setupapi-dll-activity.yml  [T1218.011]  Suspicious Rundll32 Setupapi.dll Activity
  T1059_suspicious-runscripthelper-exe.yml  [T1059,T1202]  Suspicious Runscripthelper.exe
  T1190_suspicious-sql-query.yml  [T1190,T1505.001]  Suspicious SQL Query
  T1552.006_suspicious-sysvol-domain-group-policy-access.yml  [T1552.006]  Suspicious SYSVOL Domain Group Policy Access
  T1018_suspicious-scan-loop-network.yml  [T1018,T1059]  Suspicious Scan Loop Network
  T1036.005_suspicious-scheduled-task-creation-via-masqueraded-xml-file.yml  [T1036.005,T1053.005]  Suspicious Scheduled Task Creation via Masqueraded XML File
  T1053.005_suspicious-scheduled-task-name-as-guid.yml  [T1053.005]  Suspicious Scheduled Task Name As GUID
  T1053.005_suspicious-schtasks-schedule-type-with-high-privileges.yml  [T1053.005]  Suspicious Schtasks Schedule Type With High Privileges
  T1546.002_suspicious-screensave-change-by-reg-exe.yml  [T1546.002]  Suspicious ScreenSave Change by Reg.exe
  T1546.002_suspicious-screensaver-binary-file-creation.yml  [T1546.002]  Suspicious Screensaver Binary File Creation
  T1685_suspicious-service-installed.yml  [T1685]  Suspicious Service Installed
  T1221_suspicious-set-value-of-msdt-in-registry-cve-2022-30190.yml  [T1221]  Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
  T1546.001_suspicious-shell-open-command-registry-modification.yml  [T1546.001,T1548.002]  Suspicious Shell Open Command Registry Modification
  T1036.003_suspicious-start-process-passthru.yml  [T1036.003]  Suspicious Start-Process PassThru
  T1210_suspicious-sysaidserver-child.yml  [T1210]  Suspicious SysAidServer Child
  T1090_suspicious-tcp-tunnel-via-powershell-script.yml  [T1090]  Suspicious TCP Tunnel Via PowerShell Script
  T1553.005_suspicious-unblock-file.yml  [T1553.005]  Suspicious Unblock-File
  T1003.003_suspicious-usage-of-active-directory-diagnostic-tool-ntdsuti.yml  [T1003.003]  Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
  T1027.010_suspicious-usage-of-for-loop-with-recursive-directory-search.yml  [T1027.010,T1059.003]  Suspicious Usage of For Loop with Recursive Directory Search in CMD
  suspicious-use-of-dev-tcp.yml  []  Suspicious Use of /dev/tcp
  T1087_suspicious-use-of-psloglist.yml  [T1087,T1087.001,T1087.002]  Suspicious Use of PsLogList
  T1190_suspicious-user-agents-related-to-recon-tools.yml  [T1190]  Suspicious User-Agents Related To Recon Tools
  T1055_suspicious-userinit-child-process.yml  [T1055]  Suspicious Userinit Child Process
  T1112_suspicious-vboxdrvinst-exe-parameters.yml  [T1112]  Suspicious VBoxDrvInst.exe Parameters
  T1190_suspicious-vsftpd-error-messages.yml  [T1190]  Suspicious VSFTPD Error Messages
  T1218_suspicious-vsls-agent-command-with-agentextensionpath-load.yml  [T1218]  Suspicious Vsls-Agent Command With AgentExtensionPath Load
  T1021.003_suspicious-wsman-provider-image-loads.yml  [T1021.003,T1059.001]  Suspicious WSMAN Provider Image Loads
  T1685_suspicious-windows-defender-folder-exclusion-added-via-reg-e.yml  [T1685]  Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
  suspicious-windowsterminal-child-processes.yml  []  Suspicious WindowsTerminal Child Processes
  suspicious-wordpad-outbound-connections.yml  []  Suspicious Wordpad Outbound Connections
  suspicious-workstation-locking-via-rundll32.yml  []  Suspicious Workstation Locking via Rundll32
  T1553.004_suspicious-x509enrollment-process-creation.yml  [T1553.004]  Suspicious X509Enrollment - Process Creation
  T1553.004_suspicious-x509enrollment-ps-script.yml  [T1553.004]  Suspicious X509Enrollment - Ps Script
  T1027_suspicious-xor-encoded-powershell-command.yml  [T1027,T1059.001,T1140]  Suspicious XOR Encoded PowerShell Command
  T1202_suspicious-zipexec-execution.yml  [T1202,T1218]  Suspicious ZipExec Execution
  T1218_syncappvpublishingserver-bypass-powershell-restriction-ps-mo.yml  [T1218]  SyncAppvPublishingServer Bypass Powershell Restriction - PS Module
  T1218_syncappvpublishingserver-execute-arbitrary-powershell-code.yml  [T1218]  SyncAppvPublishingServer Execute Arbitrary PowerShell Code
  T1218_syncappvpublishingserver-execution-to-bypass-powershell-rest.yml  [T1218]  SyncAppvPublishingServer Execution to Bypass Powershell Restriction
  T1216_syncappvpublishingserver-vbs-execute-arbitrary-powershell-co.yml  [T1216,T1218]  SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
  T1543.003_sysinternals-psservice-execution.yml  [T1543.003]  Sysinternals PsService Execution
  T1543.003_sysinternals-pssuspend-execution.yml  [T1543.003]  Sysinternals PsSuspend Execution
  sysmon-configuration-change.yml  []  Sysmon Configuration Change
  T1685_sysmon-configuration-update.yml  [T1685]  Sysmon Configuration Update
  sysmon-file-executable-creation-detected.yml  []  Sysmon File Executable Creation Detected
  T1059_sysprep-on-appdata-folder.yml  [T1059]  Sysprep on AppData Folder
  T1047_system-disk-and-volume-reconnaissance-via-wmic-exe.yml  [T1047,T1082]  System Disk And Volume Reconnaissance Via Wmic.EXE
  T1082_system-information-discovery-using-ioreg.yml  [T1082]  System Information Discovery Using Ioreg
  T1082_system-information-discovery-using-system-profiler.yml  [T1082,T1497.001]  System Information Discovery Using System_Profiler
  T1082_system-information-discovery-using-sw-vers.yml  [T1082]  System Information Discovery Using sw_vers
  T1082_system-information-discovery-via-sysctl-macos.yml  [T1082,T1497.001]  System Information Discovery Via Sysctl - MacOS
  T1518.001_system-integrity-protection-sip-disabled.yml  [T1518.001]  System Integrity Protection (SIP) Disabled
  T1614.001_system-language-discovery-via-reg-exe.yml  [T1614.001]  System Language Discovery via Reg.Exe
  T1547.001_system-scripts-autorun-keys-modification.yml  [T1547.001]  System Scripts Autorun Keys Modification
  T1543.002_systemd-service-creation.yml  [T1543.002]  Systemd Service Creation
  T1219.002_tacticalrmm-service-installation.yml  [T1219.002]  TacticalRMM Service Installation
  T1048_tap-driver-installation.yml  [T1048]  Tap Driver Installation
  T1048_tap-installer-execution.yml  [T1048]  Tap Installer Execution
  T1219.002_teamviewer-domain-query-by-non-teamviewer-application.yml  [T1219.002]  TeamViewer Domain Query By Non-TeamViewer Application
  T1219.002_teamviewer-remote-session.yml  [T1219.002]  TeamViewer Remote Session
  T1071.001_telegram-api-access.yml  [T1071.001,T1102.002]  Telegram API Access
  T1102.002_telegram-bot-api-request.yml  [T1102.002]  Telegram Bot API Request
  T1685_terminate-linux-process-via-kill.yml  [T1685]  Terminate Linux Process Via Kill
  T1571_testing-usage-of-uncommonly-used-port.yml  [T1571]  Testing Usage of Uncommonly Used Port
  T1574.001_third-party-software-dll-sideloading.yml  [T1574.001]  Third Party Software DLL Sideloading
  T1490_time-machine-backup-deletion-attempt-via-tmutil-macos.yml  [T1490]  Time Machine Backup Deletion Attempt Via Tmutil - MacOS
  T1490_time-machine-backup-disabled-via-tmutil-macos.yml  [T1490]  Time Machine Backup Disabled Via Tmutil - MacOS
  T1070_tomcat-webserver-logs-deleted.yml  [T1070]  Tomcat WebServer Logs Deleted
  T1070.006_touch-suspicious-service-file.yml  [T1070.006]  Touch Suspicious Service File
  T1003.001_transferring-files-with-credential-data-via-network-shares.yml  [T1003.001,T1003.002,T1003.003]  Transferring Files with Credential Data via Network Shares
  T1003.001_transferring-files-with-credential-data-via-network-shares-z.yml  [T1003.001,T1003.002,T1003.003]  Transferring Files with Credential Data via Network Shares - Zeek
  T1202_troubleshooting-pack-cmdlet-execution.yml  [T1202]  Troubleshooting Pack Cmdlet Execution
  T1041_tunneling-tool-execution.yml  [T1041,T1071.001,T1572]  Tunneling Tool Execution
  T1548_uac-bypass-via-windows-firewall-snap-in-hijack.yml  [T1548]  UAC Bypass via Windows Firewall Snap-In Hijack
  T1548.002_uac-disabled.yml  [T1548.002]  UAC Disabled
  T1548.002_uac-notification-disabled.yml  [T1548.002]  UAC Notification Disabled
  T1548.002_uac-secure-desktop-prompt-disabled.yml  [T1548.002]  UAC Secure Desktop Prompt Disabled
  T1686_ufw-disable-attempt.yml  [T1686]  UFW Disable Attempt
  T1218_uncommon-assistive-technology-applications-execution-via-atb.yml  [T1218]  Uncommon  Assistive Technology Applications Execution Via AtBroker.EXE
  T1218_uncommon-addinutil-exe-commandline-execution.yml  [T1218]  Uncommon AddinUtil.EXE CommandLine Execution
  T1218_uncommon-child-process-of-addinutil-exe.yml  [T1218]  Uncommon Child Process Of AddinUtil.EXE
  T1218_uncommon-child-process-of-appvlp-exe.yml  [T1218]  Uncommon Child Process Of Appvlp.EXE
  T1059.005_uncommon-child-process-of-bginfo-exe.yml  [T1059.005,T1202,T1218]  Uncommon Child Process Of BgInfo.EXE
  T1202_uncommon-child-process-of-conhost-exe.yml  [T1202]  Uncommon Child Process Of Conhost.EXE
  T1218_uncommon-child-process-of-defaultpack-exe.yml  [T1218]  Uncommon Child Process Of Defaultpack.EXE
  T1218.008_uncommon-child-process-spawned-by-odbcconf-exe.yml  [T1218.008]  Uncommon Child Process Spawned By Odbcconf.EXE
  uncommon-child-processes-of-sndvol-exe.yml  []  Uncommon Child Processes Of SndVol.exe
  T1087_uncommon-connection-to-active-directory-web-services.yml  [T1087]  Uncommon Connection to Active Directory Web Services
  T1546.011_uncommon-extension-shim-database-installation-via-sdbinst-ex.yml  [T1546.011]  Uncommon Extension Shim Database Installation Via Sdbinst.EXE
  T1003.001_uncommon-grantedaccess-flags-on-lsass.yml  [T1003.001]  Uncommon GrantedAccess Flags On LSASS
  T1218_uncommon-link-exe-parent-process.yml  [T1218]  Uncommon Link.EXE Parent Process
  T1686.003_uncommon-new-firewall-rule-added-in-windows-firewall-excepti.yml  [T1686.003]  Uncommon New Firewall Rule Added In Windows Firewall Exception List
  T1550.003_uncommon-outbound-kerberos-connection.yml  [T1550.003,T1558]  Uncommon Outbound Kerberos Connection
  T1558.003_uncommon-outbound-kerberos-connection-security.yml  [T1558.003]  Uncommon Outbound Kerberos Connection - Security
  T1059.001_uncommon-powershell-hosts.yml  [T1059.001]  Uncommon PowerShell Hosts
  T1543.003_uncommon-service-installation-image-path.yml  [T1543.003]  Uncommon Service Installation Image Path
  T1216_uncommon-sigverif-exe-child-process.yml  [T1216]  Uncommon Sigverif.EXE Child Process
  T1036.005_uncommon-svchost-parent-process.yml  [T1036.005]  Uncommon Svchost Parent Process
  T1082_uncommon-system-information-discovery-via-wmic-exe.yml  [T1082]  Uncommon System Information Discovery Via Wmic.EXE
  T1546.004_unix-shell-configuration-modification.yml  [T1546.004]  Unix Shell Configuration Modification
  T1036.005_unsigned-node-file-loaded.yml  [T1036.005,T1129,T1574.001]  Unsigned .node File Loaded
  unsigned-appx-installation-attempt-using-add-appxpackage.yml  []  Unsigned AppX Installation Attempt Using Add-AppxPackage
  unsigned-appx-installation-attempt-using-add-appxpackage-pss.yml  []  Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript
  T1218.010_unsigned-dll-loaded-by-windows-utility.yml  [T1218.010,T1218.011]  Unsigned DLL Loaded by Windows Utility
  T1003.001_unsigned-image-loaded-into-lsass-process.yml  [T1003.001]  Unsigned Image Loaded Into LSASS Process
  T1574.001_unsigned-module-loaded-by-clickonce-application.yml  [T1574.001]  Unsigned Module Loaded by ClickOnce Application
  T1021.002_unsigned-or-unencrypted-smb-connection-to-share-established.yml  [T1021.002]  Unsigned or Unencrypted SMB Connection to Share Established
  T1564.004_unusual-file-download-from-file-sharing-websites-file-stream.yml  [T1564.004]  Unusual File Download From File Sharing Websites - File Stream
  T1059_unusual-parent-process-for-cmd-exe.yml  [T1059]  Unusual Parent Process For Cmd.EXE
  T1059.001_usage-of-web-request-commands-and-cmdlets.yml  [T1059.001]  Usage Of Web Request Commands And Cmdlets
  T1059.001_usage-of-web-request-commands-and-cmdlets-scriptblock.yml  [T1059.001]  Usage Of Web Request Commands And Cmdlets - ScriptBlock
  T1564.001_use-icacls-to-hide-file-to-everyone.yml  [T1564.001]  Use Icacls to Hide File to Everyone
  T1564.004_use-ntfs-short-name-in-command-line.yml  [T1564.004]  Use NTFS Short Name in Command Line
  T1564.004_use-ntfs-short-name-in-image.yml  [T1564.004]  Use NTFS Short Name in Image
  T1218_use-of-the-sftp-exe-binary-as-a-lolbin.yml  [T1218]  Use Of The SFTP.EXE Binary As A LOLBIN
  T1564.004_use-short-name-path-in-command-line.yml  [T1564.004]  Use Short Name Path in Command Line
  T1564.004_use-short-name-path-in-image.yml  [T1564.004]  Use Short Name Path in Image
  T1059_use-of-fsharp-interpreters.yml  [T1059]  Use of FSharp Interpreters
  T1059_use-of-openconsole.yml  [T1059]  Use of OpenConsole
  T1059_use-of-pcalua-for-execution.yml  [T1059]  Use of Pcalua For Execution
  T1127_use-of-remote-exe.yml  [T1127]  Use of Remote.exe
  T1218_use-of-scriptrunner-exe.yml  [T1218]  Use of Scriptrunner.exe
  T1127_use-of-ttdinject-exe.yml  [T1127]  Use of TTDInject.exe
  T1219.002_use-of-ultravnc-remote-access-software.yml  [T1219.002]  Use of UltraVNC Remote Access Software
  T1127_use-of-vsiisexelauncher-exe.yml  [T1127]  Use of VSIISExeLauncher.exe
  T1218_use-of-visualuiaverifynative-exe.yml  [T1218]  Use of VisualUiaVerifyNative.exe
  T1127_use-of-wfc-exe.yml  [T1127]  Use of Wfc.exe
  T1078.004_user-access-blocked-by-azure-conditional-access.yml  [T1078.004,T1110]  User Access Blocked by Azure Conditional Access
  T1078.003_user-added-to-admin-group-via-dscl.yml  [T1078.003]  User Added To Admin Group Via Dscl
  T1078.003_user-added-to-admin-group-via-dseditgroup.yml  [T1078.003]  User Added To Admin Group Via DseditGroup
  T1078.003_user-added-to-admin-group-via-sysadminctl.yml  [T1078.003]  User Added To Admin Group Via Sysadminctl
  T1548_user-added-to-group-with-ca-policy-modification-access.yml  [T1548,T1556]  User Added To Group With CA Policy Modification Access
  user-added-to-root-sudoers-group-using-usermod.yml  []  User Added To Root/Sudoers Group Using Usermod
  T1078_user-added-to-local-administrator-group.yml  [T1078,T1098]  User Added to Local Administrator Group
  T1098_user-added-to-local-administrators-group.yml  [T1098]  User Added to Local Administrators Group
  T1078_user-added-to-an-administrator-s-azure-ad-role.yml  [T1078,T1098.003]  User Added to an Administrator's Azure AD Role
  T1033_user-discovery-and-export-via-get-aduser-cmdlet.yml  [T1033]  User Discovery And Export Via Get-ADUser Cmdlet
  T1033_user-discovery-and-export-via-get-aduser-cmdlet-powershell.yml  [T1033]  User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
  T1531_user-has-been-deleted-via-userdel.yml  [T1531]  User Has Been Deleted Via Userdel
  T1548_user-removed-from-group-with-ca-policy-modification-access.yml  [T1548,T1556]  User Removed From Group With CA Policy Modification Access
  T1078.004_user-state-changed-from-guest-to-member.yml  [T1078.004]  User State Changed From Guest To Member
  T1078.004_users-authenticating-to-other-azure-ad-tenants.yml  [T1078.004]  Users Authenticating To Other Azure AD Tenants
  T1216_utilityfunctions-ps1-proxy-dll.yml  [T1216]  UtilityFunctions.ps1 Proxy Dll
  T1587.001_vhd-image-download-via-browser.yml  [T1587.001]  VHD Image Download Via Browser
  T1574.001_vmguestlib-dll-sideload.yml  [T1574.001]  VMGuestLib DLL Sideload
  T1574.001_vmmap-signed-dbghelp-dll-potential-sideloading.yml  [T1574.001]  VMMap Signed Dbghelp.DLL Potential Sideloading
  T1005_veeam-backup-database-suspicious-query.yml  [T1005]  Veeam Backup Database Suspicious Query
  T1218_verclsid-exe-runs-com-object.yml  [T1218]  Verclsid.exe Runs COM Object
  T1071.001_visual-studio-code-tunnel-execution.yml  [T1071.001,T1219]  Visual Studio Code Tunnel Execution
  visual-studio-code-tunnel-remote-file-creation.yml  []  Visual Studio Code Tunnel Remote File Creation
  T1071.001_visual-studio-code-tunnel-service-installation.yml  [T1071.001]  Visual Studio Code Tunnel Service Installation
  T1071.001_visual-studio-code-tunnel-shell-execution.yml  [T1071.001]  Visual Studio Code Tunnel Shell Execution
  T1218_visual-studio-nodejstools-pressanykey-arbitrary-binary-execu.yml  [T1218]  Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
  T1218_visual-studio-nodejstools-pressanykey-renamed-execution.yml  [T1218]  Visual Studio NodejsTools PressAnyKey Renamed Execution
  vscode-code-tunnel-execution-file-indicator.yml  []  VsCode Code Tunnel Execution File Indicator
  T1546.013_vscode-powershell-profile-modification.yml  [T1546.013]  VsCode Powershell Profile Modification
  T1685_wdac-policy-file-creation-in-codeintegrity-folder.yml  [T1685]  WDAC Policy File Creation In CodeIntegrity Folder
  T1569.002_wfp-filter-added-via-registry.yml  [T1569.002,T1685]  WFP Filter Added via Registry
  T1546.003_wmi-activescripteventconsumers-activity-via-scrcons-exe-dll.yml  [T1546.003]  WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
  T1047_wmi-event-consumer-created-named-pipe.yml  [T1047]  WMI Event Consumer Created Named Pipe
  T1546.003_wmi-event-subscription.yml  [T1546.003]  WMI Event Subscription
  T1546.003_wmi-persistence.yml  [T1546.003]  WMI Persistence
  T1546.003_wmi-persistence-script-event-consumer.yml  [T1546.003]  WMI Persistence - Script Event Consumer
  T1546.003_wmi-persistence-security.yml  [T1546.003]  WMI Persistence - Security
  T1220_wmic-loading-scripting-libraries.yml  [T1220]  WMIC Loading Scripting Libraries
  T1047_wmic-remote-command-execution.yml  [T1047]  WMIC Remote Command Execution
  T1047_wmic-unquoted-services-path-lookup-powershell.yml  [T1047]  WMIC Unquoted Services Path Lookup - PowerShell
  T1059.005_wsf-jse-js-vba-vbe-file-execution-via-cscript-wscript.yml  [T1059.005,T1059.007]  WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
  T1202_wsl-child-process-anomaly.yml  [T1202,T1218]  WSL Child Process Anomaly
  weak-or-abused-passwords-in-cli.yml  []  Weak or Abused Passwords In CLI
  T1566_webdav-temporary-local-file-creation.yml  [T1566,T1584]  WebDAV Temporary Local File Creation
  T1048.003_webdav-client-execution-via-rundll32-exe.yml  [T1048.003]  WebDav Client Execution Via Rundll32.EXE
  T1685_werfaultsecure-loading-dbgcore-or-dbghelp-edr-freeze.yml  [T1685]  WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze
  T1105_wget-creating-files-in-tmp-directory.yml  [T1105]  Wget Creating Files in Tmp Directory
  T1033_whoami-exe-execution-anomaly.yml  [T1033]  Whoami.EXE Execution Anomaly
  T1033_whoami-exe-execution-with-output-option.yml  [T1033]  Whoami.EXE Execution With Output Option
  T1059.001_winapi-function-calls-via-powershell-scripts.yml  [T1059.001,T1106]  WinAPI Function Calls Via PowerShell Scripts
  T1059.001_winapi-library-calls-via-powershell-scripts.yml  [T1059.001,T1106]  WinAPI Library Calls Via PowerShell Scripts
  T1560.001_winrar-execution-in-non-standard-folder.yml  [T1560.001]  WinRAR Execution in Non-Standard Folder
  T1547.001_winsock2-autorun-keys-modification.yml  [T1547.001]  WinSock2 Autorun Keys Modification
  winsxs-executable-file-creation-by-non-system-process.yml  []  WinSxS Executable File Creation By Non-System Process
  T1021.002_windows-admin-share-mount-via-net-exe.yml  [T1021.002]  Windows Admin Share Mount Via Net.EXE
  T1204.002_windows-appx-deployment-full-trust-package-installation.yml  [T1204.002,T1553.005]  Windows AppX Deployment Full Trust Package Installation
  T1204.002_windows-appx-deployment-unsigned-package-installation.yml  [T1204.002,T1553.005]  Windows AppX Deployment Unsigned Package Installation
  T1490_windows-backup-deleted-via-wbadmin-exe.yml  [T1490]  Windows Backup Deleted Via Wbadmin.EXE
  T1202_windows-binary-executed-from-wsl.yml  [T1202]  Windows Binary Executed From WSL
  T1555.004_windows-credential-manager-access-via-vaultcmd.yml  [T1555.004]  Windows Credential Manager Access via VaultCmd
  T1484.001_windows-default-domain-gpo-modification.yml  [T1484.001]  Windows Default Domain GPO Modification
  T1484.001_windows-default-domain-gpo-modification-via-gpme.yml  [T1484.001]  Windows Default Domain GPO Modification via GPME
  T1685_windows-defender-exclusion-list-modified.yml  [T1685]  Windows Defender Exclusion List Modified
  T1685_windows-defender-exclusion-registry-key-write-access-request.yml  [T1685]  Windows Defender Exclusion Registry Key - Write Access Requested
  T1685_windows-defender-exclusions-added.yml  [T1685]  Windows Defender Exclusions Added
  T1059_windows-defender-exclusions-added-powershell.yml  [T1059,T1685]  Windows Defender Exclusions Added - PowerShell
  T1685_windows-defender-exclusions-added-registry.yml  [T1685]  Windows Defender Exclusions Added - Registry
  T1685_windows-defender-real-time-protection-failure-restart.yml  [T1685]  Windows Defender Real-Time Protection Failure/Restart
  T1685_windows-defender-threat-detection-service-disabled.yml  [T1685]  Windows Defender Threat Detection Service Disabled
  T1685_windows-firewall-disabled-via-powershell.yml  [T1685]  Windows Firewall Disabled via PowerShell
  T1686.003_windows-firewall-profile-disabled.yml  [T1686.003]  Windows Firewall Profile Disabled
  T1047_windows-hotfix-updates-reconnaissance-via-wmic-exe.yml  [T1047]  Windows Hotfix Updates Reconnaissance Via Wmic.EXE
  windows-kernel-debugger-execution.yml  []  Windows Kernel Debugger Execution
  T1070.008_windows-mail-app-mailbox-access-via-powershell-script.yml  [T1070.008]  Windows Mail App Mailbox Access Via PowerShell Script
  T1547.009_windows-network-access-suspicious-desktop-ini-action.yml  [T1547.009]  Windows Network Access Suspicious desktop.ini Action
  T1040_windows-pcap-drivers.yml  [T1040]  Windows Pcap Drivers
  T1071.001_windows-powershell-user-agent.yml  [T1071.001]  Windows PowerShell User Agent
  T1113_windows-recall-feature-enabled-disableaidataanalysis-value-d.yml  [T1113]  Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
  T1113_windows-recall-feature-enabled-registry.yml  [T1113]  Windows Recall Feature Enabled - Registry
  T1113_windows-recall-feature-enabled-via-reg-exe.yml  [T1113]  Windows Recall Feature Enabled Via Reg.EXE
  T1490_windows-recovery-environment-disabled-via-reagentc.yml  [T1490]  Windows Recovery Environment Disabled Via Reagentc
  T1566.001_windows-registry-trust-record-modification.yml  [T1566.001]  Windows Registry Trust Record Modification
  T1113_windows-screen-capture-with-copyfromscreen.yml  [T1113]  Windows Screen Capture with CopyFromScreen
  T1547.015_windows-terminal-profile-settings-modification-by-uncommon-p.yml  [T1547.015]  Windows Terminal Profile Settings Modification By Uncommon Process
  T1112_winlogon-allowmultipletssessions-enable.yml  [T1112]  Winlogon AllowMultipleTSSessions Enable
  T1547.004_winlogon-helper-dll.yml  [T1547.004]  Winlogon Helper DLL
  T1560.001_winrar-compressing-dump-files.yml  [T1560.001]  Winrar Compressing Dump Files
  T1048_winscp-execution-from-non-standard-folder.yml  [T1048]  Winscp Execution From Non Standard Folder
  T1218_wlrmdr-exe-uncommon-argument-or-child-process.yml  [T1218]  Wlrmdr.EXE Uncommon Argument Or Child Process
  T1047_wmiprvse-spawned-a-process.yml  [T1047]  WmiPrvSE Spawned A Process
  T1547.001_wow6432node-classes-autorun-keys-modification.yml  [T1547.001]  Wow6432Node Classes Autorun Keys Modification
  T1547.001_wow6432node-currentversion-autorun-keys-modification.yml  [T1547.001]  Wow6432Node CurrentVersion Autorun Keys Modification
  T1547.001_wow6432node-windows-nt-currentversion-autorun-keys-modificat.yml  [T1547.001]  Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
  T1685_write-protect-for-storage-disabled.yml  [T1685]  Write Protect For Storage Disabled
  T1546.002_writing-local-admin-share.yml  [T1546.002]  Writing Local Admin Share
  T1059_writing-of-malicious-files-to-the-fonts-folder.yml  [T1059,T1211]  Writing Of Malicious Files To The Fonts Folder
  T1059_wscript-shell-run-in-commandline.yml  [T1059]  Wscript Shell Run In CommandLine
  T1218_xbap-execution-from-uncommon-locations-via-presentationhost.yml  [T1218]  XBAP Execution From Uncommon Locations Via PresentationHost.EXE
  T1047_xsl-script-execution-via-wmic-exe.yml  [T1047,T1059.005,T1059.007,T1220]  XSL Script Execution Via WMIC.EXE
  T1190_zimbra-collaboration-suite-email-server-unauthenticated-rce.yml  [T1190]  Zimbra Collaboration Suite Email Server Unauthenticated RCE
  T1074.001_zip-a-folder-with-powershell-for-staging-in-temp-powershell.yml  [T1074.001]  Zip A Folder With PowerShell For Staging In Temp  - PowerShell Module
  T1074.001_zip-a-folder-with-powershell-for-staging-in-temp-powershell_2.yml  [T1074.001]  Zip A Folder With PowerShell For Staging In Temp - PowerShell
  T1074.001_zip-a-folder-with-powershell-for-staging-in-temp-powershell_3.yml  [T1074.001]  Zip A Folder With PowerShell For Staging In Temp - PowerShell Script
  T1078.002_msds-managedaccountprecededbylink-attribute-modified.yml  [T1078.002,T1098]  msDS-ManagedAccountPrecededByLink Attribute Modified
