Deploiement_Server/deployment-apps/Splunk_Security_Essentials/lookups/mitre_detections.csv

1	Type	Description	TechniqueIdCombined	Technique	Data_Component	Data_Component_Description
2	Detection		T1003.008	/etc/passwd and /etc/shadow	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
3	Detection		T1003.008	/etc/passwd and /etc/shadow	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
4	Detection		T1557.002	ARP Cache Poisoning	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
5	Detection		T1557.002	ARP Cache Poisoning	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
6	Detection		T1558.004	AS-REP Roasting	Active Directory Credential Request	A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
7	Detection		T1548	Abuse Elevation Control Mechanism	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
8	Detection		T1548	Abuse Elevation Control Mechanism	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
9	Detection		T1548	Abuse Elevation Control Mechanism	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
10	Detection		T1548	Abuse Elevation Control Mechanism	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
11	Detection		T1548	Abuse Elevation Control Mechanism	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
12	Detection		T1548	Abuse Elevation Control Mechanism	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
13	Detection		T1548	Abuse Elevation Control Mechanism	OS API Execution	Operating system function/method calls executed by a process
14	Detection		T1134	Access Token Manipulation	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
15	Detection		T1134	Access Token Manipulation	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
16	Detection		T1134	Access Token Manipulation	OS API Execution	Operating system function/method calls executed by a process
17	Detection		T1134	Access Token Manipulation	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
18	Detection		T1134	Access Token Manipulation	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
19	Detection		T1134	Access Token Manipulation	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
20	Detection		T1546.008	Accessibility Features	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
21	Detection		T1546.008	Accessibility Features	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
22	Detection		T1546.008	Accessibility Features	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
23	Detection		T1546.008	Accessibility Features	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
24	Detection		T1546.008	Accessibility Features	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
25	Detection		T1531	Account Access Removal	User Account Deletion	Removal of an account (ex: Windows EID 4726 or /var/log access/authentication logs)
26	Detection		T1531	Account Access Removal	User Account Modification	Changes made to an account, such as permissions and/or membership in specific groups (ex: Windows EID 4738 or /var/log access/authentication logs)
27	Detection		T1531	Account Access Removal	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
28	Detection		T1087	Account Discovery	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
29	Detection		T1087	Account Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
30	Detection		T1087	Account Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
31	Detection		T1087	Account Discovery	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
32	Detection		T1098	Account Manipulation	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
33	Detection		T1098	Account Manipulation	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
34	Detection		T1098	Account Manipulation	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
35	Detection		T1098	Account Manipulation	Group Modification	Changes made to a group, such as membership, name, or permissions (ex: Windows EID 4728 or 4732, AWS IAM UpdateGroup)
36	Detection		T1098	Account Manipulation	User Account Modification	Changes made to an account, such as permissions and/or membership in specific groups (ex: Windows EID 4738 or /var/log access/authentication logs)
37	Detection		T1098	Account Manipulation	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
38	Detection		T1583	Acquire Infrastructure	Response Metadata	Contextual data about an Internet-facing resource gathered from a scan, such as running services or ports
39	Detection		T1583	Acquire Infrastructure	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
40	Detection		T1583	Acquire Infrastructure	Active DNS	Queried domain name system (DNS) registry data highlighting current domain to IP address resolutions (ex: dig/nslookup queries)
41	Detection		T1583	Acquire Infrastructure	Passive DNS	Logged domain name system (DNS) data highlighting timelines of domain to IP address resolutions (ex: passive DNS)
42	Detection		T1583	Acquire Infrastructure	Domain Registration	Information about domain name assignments and other domain metadata (ex: WHOIS)
43	Detection		T1595	Active Scanning	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
44	Detection		T1595	Active Scanning	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
45	Detection		T1547.014	Active Setup	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
46	Detection		T1547.014	Active Setup	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
47	Detection		T1547.014	Active Setup	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
48	Detection		T1547.014	Active Setup	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
49	Detection		T1098.003	Add Office 365 Global Administrator Role	User Account Modification	Changes made to an account, such as permissions and/or membership in specific groups (ex: Windows EID 4738 or /var/log access/authentication logs)
50	Detection		T1137.006	Add-ins	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
51	Detection		T1137.006	Add-ins	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
52	Detection		T1137.006	Add-ins	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
53	Detection		T1137.006	Add-ins	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
54	Detection		T1137.006	Add-ins	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
55	Detection		T1137.006	Add-ins	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
56	Detection		T1098.001	Additional Cloud Credentials	User Account Modification	Changes made to an account, such as permissions and/or membership in specific groups (ex: Windows EID 4738 or /var/log access/authentication logs)
57	Detection		T1098.001	Additional Cloud Credentials	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
58	Detection		T1557	Adversary-in-the-Middle	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
59	Detection		T1557	Adversary-in-the-Middle	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
60	Detection		T1557	Adversary-in-the-Middle	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
61	Detection		T1557	Adversary-in-the-Middle	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
62	Detection		T1546.009	AppCert DLLs	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
63	Detection		T1546.009	AppCert DLLs	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
64	Detection		T1546.009	AppCert DLLs	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
65	Detection		T1546.009	AppCert DLLs	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
66	Detection		T1546.010	AppInit DLLs	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
67	Detection		T1546.010	AppInit DLLs	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
68	Detection		T1546.010	AppInit DLLs	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
69	Detection		T1546.010	AppInit DLLs	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
70	Detection		T1059.002	AppleScript	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
71	Detection		T1059.002	AppleScript	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
72	Detection		T1059.002	AppleScript	OS API Execution	Operating system function/method calls executed by a process
73	Detection		T1550.001	Application Access Token	Web Credential Usage	An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)
74	Detection		T1550.001	Application Access Token	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
75	Detection		T1499.003	Application Exhaustion Flood	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
76	Detection		T1499.003	Application Exhaustion Flood	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
77	Detection		T1499.003	Application Exhaustion Flood	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
78	Detection		T1499.003	Application Exhaustion Flood	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
79	Detection		T1071	Application Layer Protocol	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
80	Detection		T1071	Application Layer Protocol	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
81	Detection		T1546.011	Application Shimming	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
82	Detection		T1546.011	Application Shimming	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
83	Detection		T1546.011	Application Shimming	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
84	Detection		T1546.011	Application Shimming	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
85	Detection		T1546.011	Application Shimming	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
86	Detection		T1010	Application Window Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
87	Detection		T1010	Application Window Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
88	Detection		T1010	Application Window Discovery	OS API Execution	Operating system function/method calls executed by a process
89	Detection		T1499.004	Application or System Exploitation	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
90	Detection		T1499.004	Application or System Exploitation	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
91	Detection		T1499.004	Application or System Exploitation	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
92	Detection		T1499.004	Application or System Exploitation	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
93	Detection		T1560	Archive Collected Data	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
94	Detection		T1560	Archive Collected Data	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
95	Detection		T1560	Archive Collected Data	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
96	Detection		T1560	Archive Collected Data	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
97	Detection		T1560.003	Archive via Custom Method	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
98	Detection		T1560.003	Archive via Custom Method	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
99	Detection		T1560.002	Archive via Library	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
100	Detection		T1560.002	Archive via Library	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
101	Detection		T1560.001	Archive via Utility	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
102	Detection		T1560.001	Archive via Utility	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
103	Detection		T1560.001	Archive via Utility	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
104	Detection		T1573.002	Asymmetric Cryptography	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
105	Detection		T1055.004	Asynchronous Procedure Call	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
106	Detection		T1055.004	Asynchronous Procedure Call	OS API Execution	Operating system function/method calls executed by a process
107	Detection		T1055.004	Asynchronous Procedure Call	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
108	Detection		T1053.001	At (Linux)	Scheduled Job Creation	Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
109	Detection		T1053.001	At (Linux)	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
110	Detection		T1053.001	At (Linux)	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
111	Detection		T1053.002	At (Windows)	Scheduled Job Creation	Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
112	Detection		T1053.002	At (Windows)	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
113	Detection		T1053.002	At (Windows)	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
114	Detection		T1053.002	At (Windows)	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
115	Detection		T1123	Audio Capture	OS API Execution	Operating system function/method calls executed by a process
116	Detection		T1123	Audio Capture	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
117	Detection		T1547.002	Authentication Package	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
118	Detection		T1547.002	Authentication Package	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
119	Detection		T1547.002	Authentication Package	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
120	Detection		T1119	Automated Collection	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
121	Detection		T1119	Automated Collection	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
122	Detection		T1119	Automated Collection	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
123	Detection		T1020	Automated Exfiltration	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
124	Detection		T1020	Automated Exfiltration	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
125	Detection		T1020	Automated Exfiltration	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
126	Detection		T1020	Automated Exfiltration	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
127	Detection		T1020	Automated Exfiltration	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
128	Detection		T1020	Automated Exfiltration	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
129	Detection		T1197	BITS Jobs	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
130	Detection		T1197	BITS Jobs	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
131	Detection		T1197	BITS Jobs	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
132	Detection		T1197	BITS Jobs	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
133	Detection		T1552.003	Bash History	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
134	Detection		T1552.003	Bash History	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
135	Detection		T1102.002	Bidirectional Communication	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
136	Detection		T1102.002	Bidirectional Communication	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
137	Detection		T1102.002	Bidirectional Communication	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
138	Detection		T1027.001	Binary Padding	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
139	Detection		T1547	Boot or Logon Autostart Execution	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
140	Detection		T1547	Boot or Logon Autostart Execution	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
141	Detection		T1547	Boot or Logon Autostart Execution	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
142	Detection		T1547	Boot or Logon Autostart Execution	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
143	Detection		T1547	Boot or Logon Autostart Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
144	Detection		T1547	Boot or Logon Autostart Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
145	Detection		T1547	Boot or Logon Autostart Execution	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
146	Detection		T1547	Boot or Logon Autostart Execution	Kernel Module Load	An object file that contains code to extend the running kernel of an OS, typically used to add support for new hardware (as device drivers) and/or filesystems, or for adding system calls
147	Detection		T1547	Boot or Logon Autostart Execution	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
148	Detection		T1547	Boot or Logon Autostart Execution	OS API Execution	Operating system function/method calls executed by a process
149	Detection		T1037	Boot or Logon Initialization Scripts	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
150	Detection		T1037	Boot or Logon Initialization Scripts	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
151	Detection		T1037	Boot or Logon Initialization Scripts	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
152	Detection		T1037	Boot or Logon Initialization Scripts	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
153	Detection		T1037	Boot or Logon Initialization Scripts	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
154	Detection		T1037	Boot or Logon Initialization Scripts	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
155	Detection		T1542.003	Bootkit	Drive Modification	Changes made to a drive letter or mount point of a data storage device
156	Detection		T1217	Browser Bookmark Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
157	Detection		T1217	Browser Bookmark Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
158	Detection		T1217	Browser Bookmark Discovery	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
159	Detection		T1176	Browser Extensions	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
160	Detection		T1176	Browser Extensions	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
161	Detection		T1176	Browser Extensions	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
162	Detection		T1176	Browser Extensions	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
163	Detection		T1176	Browser Extensions	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
164	Detection		T1185	Browser Session Hijacking	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
165	Detection		T1185	Browser Session Hijacking	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
166	Detection		T1185	Browser Session Hijacking	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
167	Detection		T1110	Brute Force	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
168	Detection		T1110	Brute Force	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
169	Detection		T1110	Brute Force	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
170	Detection		T1612	Build Image on Host	Image Creation	Initial construction of a virtual machine image (ex: Azure Compute Service Images PUT)
171	Detection		T1612	Build Image on Host	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
172	Detection		T1612	Build Image on Host	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
173	Detection		T1612	Build Image on Host	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
174	Detection		T1548.002	Bypass User Account Control	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
175	Detection		T1548.002	Bypass User Account Control	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
176	Detection		T1548.002	Bypass User Account Control	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
177	Detection		T1548.002	Bypass User Account Control	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
178	Detection		T1218.003	CMSTP	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
179	Detection		T1218.003	CMSTP	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
180	Detection		T1218.003	CMSTP	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
181	Detection		T1574.012	COR_PROFILER	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
182	Detection		T1574.012	COR_PROFILER	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
183	Detection		T1574.012	COR_PROFILER	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
184	Detection		T1574.012	COR_PROFILER	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
185	Detection		T1003.005	Cached Domain Credentials	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
186	Detection		T1546.001	Change Default File Association	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
187	Detection		T1546.001	Change Default File Association	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
188	Detection		T1546.001	Change Default File Association	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
189	Detection		T1070.003	Clear Command History	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
190	Detection		T1070.003	Clear Command History	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
191	Detection		T1070.003	Clear Command History	File Deletion	Removal of a file (ex: Sysmon EID 23)
192	Detection		T1070.002	Clear Linux or Mac System Logs	File Deletion	Removal of a file (ex: Sysmon EID 23)
193	Detection		T1070.002	Clear Linux or Mac System Logs	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
194	Detection		T1070.002	Clear Linux or Mac System Logs	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
195	Detection		T1070.001	Clear Windows Event Logs	OS API Execution	Operating system function/method calls executed by a process
196	Detection		T1070.001	Clear Windows Event Logs	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
197	Detection		T1592.004	Client Configurations	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
198	Detection		T1115	Clipboard Data	OS API Execution	Operating system function/method calls executed by a process
199	Detection		T1115	Clipboard Data	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
200	Detection		T1136.003	Cloud Account	User Account Creation	Initial construction of a new account (ex: Windows EID 4720 or /etc/passwd logs)
201	Detection		T1087.004	Cloud Account	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
202	Detection		T1087.004	Cloud Account	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
203	Detection		T1078.004	Cloud Accounts	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
204	Detection		T1078.004	Cloud Accounts	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
205	Detection		T1078.004	Cloud Accounts	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
206	Detection		T1069.003	Cloud Groups	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
207	Detection		T1069.003	Cloud Groups	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
208	Detection		T1069.003	Cloud Groups	Group Enumeration	An extracted list of available groups and/or their associated settings (ex: AWS list-groups)
209	Detection		T1069.003	Cloud Groups	Group Metadata	Contextual data about a group which describes group and activity around it, such as name, permissions, or user accounts within the group
210	Detection		T1069.003	Cloud Groups	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
211	Detection		T1580	Cloud Infrastructure Discovery	Instance Metadata	Contextual data about an instance and activity around it such as name, type, or status
212	Detection		T1580	Cloud Infrastructure Discovery	Instance Enumeration	An extracted list of instances within a cloud environment (ex: instance.list within GCP Audit Logs)
213	Detection		T1580	Cloud Infrastructure Discovery	Snapshot Metadata	Contextual data about a snapshot, which may include information such as ID, type, and status
214	Detection		T1580	Cloud Infrastructure Discovery	Snapshot Enumeration	An extracted list of snapshops within a cloud environment (ex: AWS describe-snapshots)
215	Detection		T1580	Cloud Infrastructure Discovery	Cloud Storage Metadata	Contextual data about cloud storage infrastructure and activity around it such as name, size, or owner
216	Detection		T1580	Cloud Infrastructure Discovery	Cloud Storage Enumeration	An extracted list of cloud storage infrastructure (ex: AWS S3 ListBuckets or ListObjects)
217	Detection		T1580	Cloud Infrastructure Discovery	Volume Metadata	Contextual data about a cloud volume and activity around it, such as id, type, state, and size
218	Detection		T1580	Cloud Infrastructure Discovery	Volume Enumeration	An extracted list of available volumes within a cloud environment (ex: AWS describe-volumes)
219	Detection		T1552.005	Cloud Instance Metadata API	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
220	Detection		T1538	Cloud Service Dashboard	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
221	Detection		T1538	Cloud Service Dashboard	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
222	Detection		T1526	Cloud Service Discovery	Cloud Service Metadata	Contextual data about a cloud service and activity around it such as name, type, or purpose/function
223	Detection		T1526	Cloud Service Discovery	Cloud Service Enumeration	An extracted list of cloud services (ex: AWS ECS ListServices)
224	Detection		T1619	Cloud Storage Object Discovery	Cloud Storage Enumeration	An extracted list of cloud storage infrastructure (ex: AWS S3 ListBuckets or ListObjects)
225	Detection		T1619	Cloud Storage Object Discovery	Cloud Storage Access	Opening of a cloud storage infrastructure, typically to collect/read its value (ex: AWS S3 GetObject)
226	Detection		T1213.003	Code Repositories	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
227	Detection		T1213.003	Code Repositories	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
228	Detection		T1553.002	Code Signing	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
229	Detection		T1587.002	Code Signing Certificates	Malware Metadata	Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
230	Detection		T1588.003	Code Signing Certificates	Malware Metadata	Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
231	Detection		T1553.006	Code Signing Policy Modification	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
232	Detection		T1553.006	Code Signing Policy Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
233	Detection		T1553.006	Code Signing Policy Modification	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
234	Detection		T1059	Command and Scripting Interpreter	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
235	Detection		T1059	Command and Scripting Interpreter	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
236	Detection		T1059	Command and Scripting Interpreter	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
237	Detection		T1059	Command and Scripting Interpreter	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
238	Detection		T1092	Communication Through Removable Media	Drive Creation	Initial construction of a drive letter or mount point to a data storage device
239	Detection		T1092	Communication Through Removable Media	Drive Access	Opening of a data storage device with an assigned drive letter or mount point
240	Detection		T1027.004	Compile After Delivery	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
241	Detection		T1027.004	Compile After Delivery	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
242	Detection		T1027.004	Compile After Delivery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
243	Detection		T1027.004	Compile After Delivery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
244	Detection		T1218.001	Compiled HTML File	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
245	Detection		T1218.001	Compiled HTML File	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
246	Detection		T1218.001	Compiled HTML File	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
247	Detection		T1542.002	Component Firmware	Driver Metadata	Contextual data about a driver and activity around it such as driver issues reporting or integrity (page hash, code) checking
248	Detection		T1542.002	Component Firmware	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
249	Detection		T1542.002	Component Firmware	OS API Execution	Operating system function/method calls executed by a process
250	Detection		T1559.001	Component Object Model	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
251	Detection		T1559.001	Component Object Model	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
252	Detection		T1559.001	Component Object Model	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
253	Detection		T1546.015	Component Object Model Hijacking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
254	Detection		T1546.015	Component Object Model Hijacking	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
255	Detection		T1546.015	Component Object Model Hijacking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
256	Detection		T1546.015	Component Object Model Hijacking	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
257	Detection		T1586	Compromise Accounts	Social Media	Established, compromised, or otherwise acquired social media personas
258	Detection		T1586	Compromise Accounts	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
259	Detection		T1554	Compromise Client Software Binary	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
260	Detection		T1554	Compromise Client Software Binary	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
261	Detection		T1554	Compromise Client Software Binary	File Deletion	Removal of a file (ex: Sysmon EID 23)
262	Detection		T1554	Compromise Client Software Binary	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
263	Detection		T1584	Compromise Infrastructure	Response Metadata	Contextual data about an Internet-facing resource gathered from a scan, such as running services or ports
264	Detection		T1584	Compromise Infrastructure	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
265	Detection		T1584	Compromise Infrastructure	Active DNS	Queried domain name system (DNS) registry data highlighting current domain to IP address resolutions (ex: dig/nslookup queries)
266	Detection		T1584	Compromise Infrastructure	Passive DNS	Logged domain name system (DNS) data highlighting timelines of domain to IP address resolutions (ex: passive DNS)
267	Detection		T1584	Compromise Infrastructure	Domain Registration	Information about domain name assignments and other domain metadata (ex: WHOIS)
268	Detection		T1213.001	Confluence	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
269	Detection		T1213.001	Confluence	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
270	Detection		T1552.007	Container API	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
271	Detection		T1552.007	Container API	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
272	Detection		T1552.007	Container API	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
273	Detection		T1609	Container Administration Command	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
274	Detection		T1053.007	Container Orchestration Job	Scheduled Job Creation	Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
275	Detection		T1053.007	Container Orchestration Job	Container Creation	Initial construction of a new container (ex: docker create <container_name>)
276	Detection		T1053.007	Container Orchestration Job	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
277	Detection		T1613	Container and Resource Discovery	Cluster Metadata	Contextual data about a cluster and activity around it such as name, namespace, age, or status
278	Detection		T1613	Container and Resource Discovery	Container Enumeration	An extracted list of containers (ex: docker ps)
279	Detection		T1613	Container and Resource Discovery	Container Metadata	Contextual data about a container and activity around it such as name, ID, image, or status
280	Detection		T1613	Container and Resource Discovery	Pod Enumeration	An extracted list of pods within a cluster (ex: kubectl get pods)
281	Detection		T1613	Container and Resource Discovery	Pod Metadata	Contextual data about a pod and activity around it such as name, ID, namespace, or status
282	Detection		T1613	Container and Resource Discovery	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
283	Detection		T1218.002	Control Panel	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
284	Detection		T1218.002	Control Panel	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
285	Detection		T1218.002	Control Panel	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
286	Detection		T1218.002	Control Panel	OS API Execution	Operating system function/method calls executed by a process
287	Detection		T1218.002	Control Panel	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
288	Detection		T1218.002	Control Panel	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
289	Detection		T1136	Create Account	User Account Creation	Initial construction of a new account (ex: Windows EID 4720 or /etc/passwd logs)
290	Detection		T1136	Create Account	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
291	Detection		T1136	Create Account	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
292	Detection		T1578.002	Create Cloud Instance	Instance Creation	Initial construction of a new instance (ex: instance.insert within GCP Audit Logs)
293	Detection		T1134.002	Create Process with Token	OS API Execution	Operating system function/method calls executed by a process
294	Detection		T1134.002	Create Process with Token	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
295	Detection		T1578.001	Create Snapshot	Snapshot Creation	Initial construction of a new snapshot (ex: AWS create-snapshot)
296	Detection		T1543	Create or Modify System Process	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
297	Detection		T1543	Create or Modify System Process	Service Modification	Changes made to a service/daemon, such as changes to name, description, and/or start type (ex: Windows EID 7040 or /var/log daemon logs)
298	Detection		T1543	Create or Modify System Process	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
299	Detection		T1543	Create or Modify System Process	OS API Execution	Operating system function/method calls executed by a process
300	Detection		T1543	Create or Modify System Process	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
301	Detection		T1543	Create or Modify System Process	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
302	Detection		T1543	Create or Modify System Process	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
303	Detection		T1543	Create or Modify System Process	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
304	Detection		T1543	Create or Modify System Process	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
305	Detection		T1056.004	Credential API Hooking	OS API Execution	Operating system function/method calls executed by a process
306	Detection		T1056.004	Credential API Hooking	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
307	Detection		T1110.004	Credential Stuffing	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
308	Detection		T1110.004	Credential Stuffing	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
309	Detection		T1552.001	Credentials In Files	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
310	Detection		T1552.001	Credentials In Files	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
311	Detection		T1555	Credentials from Password Stores	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
312	Detection		T1555	Credentials from Password Stores	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
313	Detection		T1555	Credentials from Password Stores	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
314	Detection		T1555	Credentials from Password Stores	OS API Execution	Operating system function/method calls executed by a process
315	Detection		T1555	Credentials from Password Stores	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
316	Detection		T1555.003	Credentials from Web Browsers	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
317	Detection		T1555.003	Credentials from Web Browsers	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
318	Detection		T1555.003	Credentials from Web Browsers	OS API Execution	Operating system function/method calls executed by a process
319	Detection		T1555.003	Credentials from Web Browsers	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
320	Detection		T1552.002	Credentials in Registry	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
321	Detection		T1552.002	Credentials in Registry	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
322	Detection		T1552.002	Credentials in Registry	Windows Registry Key Access	Opening a Registry Key, typically to read the associated value (ex: Windows EID 4656)
323	Detection		T1053.003	Cron	Scheduled Job Creation	Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
324	Detection		T1053.003	Cron	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
325	Detection		T1053.003	Cron	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
326	Detection		T1053.003	Cron	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
327	Detection		T1003.006	DCSync	Active Directory Object Access	Opening of an active directory object, typically to collect/read its value (ex: Windows EID 4661)
328	Detection		T1003.006	DCSync	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
329	Detection		T1003.006	DCSync	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
330	Detection		T1574.001	DLL Search Order Hijacking	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
331	Detection		T1574.001	DLL Search Order Hijacking	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
332	Detection		T1574.001	DLL Search Order Hijacking	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
333	Detection		T1574.002	DLL Side-Loading	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
334	Detection		T1574.002	DLL Side-Loading	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
335	Detection		T1574.002	DLL Side-Loading	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
336	Detection		T1574.002	DLL Side-Loading	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
337	Detection		T1071.004	DNS	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
338	Detection		T1071.004	DNS	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
339	Detection		T1568.003	DNS Calculation	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
340	Detection		T1584.002	DNS Server	Active DNS	Queried domain name system (DNS) registry data highlighting current domain to IP address resolutions (ex: dig/nslookup queries)
341	Detection		T1584.002	DNS Server	Passive DNS	Logged domain name system (DNS) data highlighting timelines of domain to IP address resolutions (ex: passive DNS)
342	Detection		T1485	Data Destruction	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
343	Detection		T1485	Data Destruction	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
344	Detection		T1485	Data Destruction	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
345	Detection		T1485	Data Destruction	File Deletion	Removal of a file (ex: Sysmon EID 23)
346	Detection		T1485	Data Destruction	Image Deletion	Removal of a virtual machine image (ex: Azure Compute Service Images DELETE)
347	Detection		T1485	Data Destruction	Instance Deletion	Removal of an instance (ex: instance.delete within GCP Audit Logs)
348	Detection		T1485	Data Destruction	Snapshot Deletion	Removal of a snapshot (ex: AWS delete-snapshot)
349	Detection		T1485	Data Destruction	Cloud Storage Deletion	Removal of cloud storage infrastructure (ex: AWS S3 DeleteBucket)
350	Detection		T1485	Data Destruction	Volume Deletion	Removal of a a cloud volume (ex: AWS delete-volume)
351	Detection		T1132	Data Encoding	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
352	Detection		T1486	Data Encrypted for Impact	Cloud Storage Metadata	Contextual data about cloud storage infrastructure and activity around it such as name, size, or owner
353	Detection		T1486	Data Encrypted for Impact	Cloud Storage Modification	Changes made to cloud storage infrastructure, including its settings and/or data (ex: AWS S3 PutObject or PutObjectAcl)
354	Detection		T1486	Data Encrypted for Impact	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
355	Detection		T1486	Data Encrypted for Impact	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
356	Detection		T1486	Data Encrypted for Impact	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
357	Detection		T1486	Data Encrypted for Impact	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
358	Detection		T1565	Data Manipulation	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
359	Detection		T1565	Data Manipulation	OS API Execution	Operating system function/method calls executed by a process
360	Detection		T1565	Data Manipulation	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
361	Detection		T1565	Data Manipulation	File Deletion	Removal of a file (ex: Sysmon EID 23)
362	Detection		T1565	Data Manipulation	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
363	Detection		T1565	Data Manipulation	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
364	Detection		T1565	Data Manipulation	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
365	Detection		T1001	Data Obfuscation	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
366	Detection		T1074	Data Staged	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
367	Detection		T1074	Data Staged	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
368	Detection		T1074	Data Staged	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
369	Detection		T1030	Data Transfer Size Limits	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
370	Detection		T1030	Data Transfer Size Limits	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
371	Detection		T1530	Data from Cloud Storage Object	Cloud Storage Access	Opening of a cloud storage infrastructure, typically to collect/read its value (ex: AWS S3 GetObject)
372	Detection		T1602	Data from Configuration Repository	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
373	Detection		T1602	Data from Configuration Repository	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
374	Detection		T1213	Data from Information Repositories	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
375	Detection		T1213	Data from Information Repositories	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
376	Detection		T1005	Data from Local System	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
377	Detection		T1005	Data from Local System	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
378	Detection		T1005	Data from Local System	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
379	Detection		T1039	Data from Network Shared Drive	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
380	Detection		T1039	Data from Network Shared Drive	Network Share Access	Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)
381	Detection		T1039	Data from Network Shared Drive	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
382	Detection		T1025	Data from Removable Media	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
383	Detection		T1025	Data from Removable Media	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
384	Detection		T1102.001	Dead Drop Resolver	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
385	Detection		T1102.001	Dead Drop Resolver	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
386	Detection		T1491	Defacement	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
387	Detection		T1491	Defacement	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
388	Detection		T1491	Defacement	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
389	Detection		T1491	Defacement	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
390	Detection		T1078.001	Default Accounts	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
391	Detection		T1078.001	Default Accounts	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
392	Detection		T1578.003	Delete Cloud Instance	Instance Deletion	Removal of an instance (ex: instance.delete within GCP Audit Logs)
393	Detection		T1140	Deobfuscate/Decode Files or Information	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
394	Detection		T1140	Deobfuscate/Decode Files or Information	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
395	Detection		T1140	Deobfuscate/Decode Files or Information	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
396	Detection		T1610	Deploy Container	Container Creation	Initial construction of a new container (ex: docker create <container_name>)
397	Detection		T1610	Deploy Container	Container Start	Activation or invocation of a container (ex: docker start or docker restart)
398	Detection		T1610	Deploy Container	Pod Creation	Initial construction of a new pod (ex: kubectl apply|run)
399	Detection		T1610	Deploy Container	Pod Modification	Changes made to a pod, including its settings and/or control data (ex: kubectl set|patch|edit)
400	Detection		T1610	Deploy Container	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
401	Detection		T1587	Develop Capabilities	Malware Metadata	Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
402	Detection		T1587	Develop Capabilities	Malware Content	Code, strings, and other signatures that compromise a malicious payload
403	Detection		T1587	Develop Capabilities	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
404	Detection		T1587.003	Digital Certificates	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
405	Detection		T1588.004	Digital Certificates	Certificate Registration	Queried or logged information highlighting current and expired digital certificates (ex: Certificate transparency)
406	Detection		T1588.004	Digital Certificates	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
407	Detection		T1498.001	Direct Network Flood	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
408	Detection		T1498.001	Direct Network Flood	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
409	Detection		T1006	Direct Volume Access	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
410	Detection		T1006	Direct Volume Access	Drive Access	Opening of a data storage device with an assigned drive letter or mount point
411	Detection		T1562.008	Disable Cloud Logs	Cloud Service Modification	Changes made to a cloud service, including its settings and/or data (ex: AWS CloudTrail DeleteTrail or DeleteConfigRule)
412	Detection		T1562.008	Disable Cloud Logs	Cloud Service Disable	Deactivation or stoppage of a cloud service (ex: AWS Cloudtrail StopLogging)
413	Detection		T1600.002	Disable Crypto Hardware	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
414	Detection		T1562.002	Disable Windows Event Logging	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
415	Detection		T1562.002	Disable Windows Event Logging	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
416	Detection		T1562.002	Disable Windows Event Logging	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
417	Detection		T1562.002	Disable Windows Event Logging	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
418	Detection		T1562.002	Disable Windows Event Logging	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
419	Detection		T1562.002	Disable Windows Event Logging	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
420	Detection		T1562.007	Disable or Modify Cloud Firewall	Firewall Rule Modification	Changes made to a firewall rule, typically to allow/block specific network traffic (ex: Windows EID 4950 or Write/Delete entries within Azure Firewall Rule Collection Activity Logs)
421	Detection		T1562.007	Disable or Modify Cloud Firewall	Firewall Disable	Deactivation or stoppage of a cloud service (ex: Write/Delete entries within Azure Firewall Activity Logs)
422	Detection		T1562.004	Disable or Modify System Firewall	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
423	Detection		T1562.004	Disable or Modify System Firewall	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
424	Detection		T1562.004	Disable or Modify System Firewall	Firewall Disable	Deactivation or stoppage of a cloud service (ex: Write/Delete entries within Azure Firewall Activity Logs)
425	Detection		T1562.004	Disable or Modify System Firewall	Firewall Rule Modification	Changes made to a firewall rule, typically to allow/block specific network traffic (ex: Windows EID 4950 or Write/Delete entries within Azure Firewall Rule Collection Activity Logs)
426	Detection		T1562.001	Disable or Modify Tools	Process Termination	Exit of a running process (ex: Sysmon EID 5 or Windows EID 4689)
427	Detection		T1562.001	Disable or Modify Tools	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
428	Detection		T1562.001	Disable or Modify Tools	Windows Registry Key Deletion	Removal of a Registry Key (ex: Windows EID 4658 or Sysmon EID 12)
429	Detection		T1562.001	Disable or Modify Tools	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
430	Detection		T1562.001	Disable or Modify Tools	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
431	Detection		T1562.001	Disable or Modify Tools	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
432	Detection		T1561.001	Disk Content Wipe	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
433	Detection		T1561.001	Disk Content Wipe	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
434	Detection		T1561.001	Disk Content Wipe	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
435	Detection		T1561.001	Disk Content Wipe	Drive Access	Opening of a data storage device with an assigned drive letter or mount point
436	Detection		T1561.001	Disk Content Wipe	Drive Modification	Changes made to a drive letter or mount point of a data storage device
437	Detection		T1561.002	Disk Structure Wipe	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
438	Detection		T1561.002	Disk Structure Wipe	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
439	Detection		T1561.002	Disk Structure Wipe	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
440	Detection		T1561.002	Disk Structure Wipe	Drive Access	Opening of a data storage device with an assigned drive letter or mount point
441	Detection		T1561.002	Disk Structure Wipe	Drive Modification	Changes made to a drive letter or mount point of a data storage device
442	Detection		T1561	Disk Wipe	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
443	Detection		T1561	Disk Wipe	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
444	Detection		T1561	Disk Wipe	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
445	Detection		T1561	Disk Wipe	Drive Access	Opening of a data storage device with an assigned drive letter or mount point
446	Detection		T1561	Disk Wipe	Drive Modification	Changes made to a drive letter or mount point of a data storage device
447	Detection		T1021.003	Distributed Component Object Model	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
448	Detection		T1021.003	Distributed Component Object Model	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
449	Detection		T1021.003	Distributed Component Object Model	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
450	Detection		T1136.002	Domain Account	User Account Creation	Initial construction of a new account (ex: Windows EID 4720 or /etc/passwd logs)
451	Detection		T1136.002	Domain Account	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
452	Detection		T1136.002	Domain Account	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
453	Detection		T1087.002	Domain Account	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
454	Detection		T1087.002	Domain Account	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
455	Detection		T1078.002	Domain Accounts	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
456	Detection		T1078.002	Domain Accounts	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
457	Detection		T1078.002	Domain Accounts	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
458	Detection		T1556.001	Domain Controller Authentication	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
459	Detection		T1556.001	Domain Controller Authentication	OS API Execution	Operating system function/method calls executed by a process
460	Detection		T1556.001	Domain Controller Authentication	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
461	Detection		T1556.001	Domain Controller Authentication	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
462	Detection		T1090.004	Domain Fronting	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
463	Detection		T1568.002	Domain Generation Algorithms	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
464	Detection		T1568.002	Domain Generation Algorithms	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
465	Detection		T1069.002	Domain Groups	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
466	Detection		T1069.002	Domain Groups	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
467	Detection		T1484	Domain Policy Modification	Active Directory Object Creation	Initial construction of a new active directory object (ex: Windows EID 5137)
468	Detection		T1484	Domain Policy Modification	Active Directory Object Deletion	Removal of an active directory object (ex: Windows EID 5141)
469	Detection		T1484	Domain Policy Modification	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
470	Detection		T1484	Domain Policy Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
471	Detection		T1482	Domain Trust Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
472	Detection		T1482	Domain Trust Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
473	Detection		T1482	Domain Trust Discovery	OS API Execution	Operating system function/method calls executed by a process
474	Detection		T1482	Domain Trust Discovery	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
475	Detection		T1484.002	Domain Trust Modification	Active Directory Object Creation	Initial construction of a new active directory object (ex: Windows EID 5137)
476	Detection		T1484.002	Domain Trust Modification	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
477	Detection		T1484.002	Domain Trust Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
478	Detection		T1583.001	Domains	Active DNS	Queried domain name system (DNS) registry data highlighting current domain to IP address resolutions (ex: dig/nslookup queries)
479	Detection		T1583.001	Domains	Passive DNS	Logged domain name system (DNS) data highlighting timelines of domain to IP address resolutions (ex: passive DNS)
480	Detection		T1583.001	Domains	Domain Registration	Information about domain name assignments and other domain metadata (ex: WHOIS)
481	Detection		T1584.001	Domains	Active DNS	Queried domain name system (DNS) registry data highlighting current domain to IP address resolutions (ex: dig/nslookup queries)
482	Detection		T1584.001	Domains	Passive DNS	Logged domain name system (DNS) data highlighting timelines of domain to IP address resolutions (ex: passive DNS)
483	Detection		T1584.001	Domains	Domain Registration	Information about domain name assignments and other domain metadata (ex: WHOIS)
484	Detection		T1036.007	Double File Extension	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
485	Detection		T1036.007	Double File Extension	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
486	Detection		T1562.010	Downgrade Attack	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
487	Detection		T1562.010	Downgrade Attack	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
488	Detection		T1562.010	Downgrade Attack	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
489	Detection		T1601.002	Downgrade System Image	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
490	Detection		T1189	Drive-by Compromise	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
491	Detection		T1189	Drive-by Compromise	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
492	Detection		T1189	Drive-by Compromise	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
493	Detection		T1189	Drive-by Compromise	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
494	Detection		T1189	Drive-by Compromise	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
495	Detection		T1608.004	Drive-by Target	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
496	Detection		T1574.004	Dylib Hijacking	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
497	Detection		T1574.004	Dylib Hijacking	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
498	Detection		T1574.004	Dylib Hijacking	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
499	Detection		T1559.002	Dynamic Data Exchange	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
500	Detection		T1559.002	Dynamic Data Exchange	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
501	Detection		T1559.002	Dynamic Data Exchange	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
502	Detection		T1574.006	Dynamic Linker Hijacking	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
503	Detection		T1574.006	Dynamic Linker Hijacking	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
504	Detection		T1574.006	Dynamic Linker Hijacking	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
505	Detection		T1574.006	Dynamic Linker Hijacking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
506	Detection		T1574.006	Dynamic Linker Hijacking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
507	Detection		T1568	Dynamic Resolution	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
508	Detection		T1568	Dynamic Resolution	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
509	Detection		T1568	Dynamic Resolution	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
510	Detection		T1055.001	Dynamic-link Library Injection	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
511	Detection		T1055.001	Dynamic-link Library Injection	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
512	Detection		T1055.001	Dynamic-link Library Injection	OS API Execution	Operating system function/method calls executed by a process
513	Detection		T1055.001	Dynamic-link Library Injection	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
514	Detection		T1548.004	Elevated Execution with Prompt	OS API Execution	Operating system function/method calls executed by a process
515	Detection		T1548.004	Elevated Execution with Prompt	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
516	Detection		T1087.003	Email Account	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
517	Detection		T1087.003	Email Account	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
518	Detection		T1114	Email Collection	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
519	Detection		T1114	Email Collection	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
520	Detection		T1114	Email Collection	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
521	Detection		T1114	Email Collection	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
522	Detection		T1114	Email Collection	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
523	Detection		T1114.003	Email Forwarding Rule	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
524	Detection		T1564.008	Email Hiding Rules	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
525	Detection		T1564.008	Email Hiding Rules	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
526	Detection		T1564.008	Email Hiding Rules	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
527	Detection		T1546.014	Emond	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
528	Detection		T1546.014	Emond	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
529	Detection		T1546.014	Emond	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
530	Detection		T1546.014	Emond	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
531	Detection		T1573	Encrypted Channel	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
532	Detection		T1499	Endpoint Denial of Service	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
533	Detection		T1499	Endpoint Denial of Service	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
534	Detection		T1499	Endpoint Denial of Service	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
535	Detection		T1499	Endpoint Denial of Service	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
536	Detection		T1480.001	Environmental Keying	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
537	Detection		T1480.001	Environmental Keying	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
538	Detection		T1611	Escape to Host	Container Creation	Initial construction of a new container (ex: docker create <container_name>)
539	Detection		T1611	Escape to Host	OS API Execution	Operating system function/method calls executed by a process
540	Detection		T1611	Escape to Host	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
541	Detection		T1585	Establish Accounts	Social Media	Established, compromised, or otherwise acquired social media personas
542	Detection		T1585	Establish Accounts	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
543	Detection		T1546	Event Triggered Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
544	Detection		T1546	Event Triggered Execution	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
545	Detection		T1546	Event Triggered Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
546	Detection		T1546	Event Triggered Execution	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
547	Detection		T1546	Event Triggered Execution	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
548	Detection		T1546	Event Triggered Execution	WMI Creation	Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21)
549	Detection		T1546	Event Triggered Execution	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
550	Detection		T1546	Event Triggered Execution	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
551	Detection		T1098.002	Exchange Email Delegate Permissions	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
552	Detection		T1098.002	Exchange Email Delegate Permissions	Group Modification	Changes made to a group, such as membership, name, or permissions (ex: Windows EID 4728 or 4732, AWS IAM UpdateGroup)
553	Detection		T1098.002	Exchange Email Delegate Permissions	User Account Modification	Changes made to an account, such as permissions and/or membership in specific groups (ex: Windows EID 4738 or /var/log access/authentication logs)
554	Detection		T1574.005	Executable Installer File Permissions Weakness	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
555	Detection		T1574.005	Executable Installer File Permissions Weakness	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
556	Detection		T1574.005	Executable Installer File Permissions Weakness	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
557	Detection		T1574.005	Executable Installer File Permissions Weakness	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
558	Detection		T1574.005	Executable Installer File Permissions Weakness	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
559	Detection		T1480	Execution Guardrails	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
560	Detection		T1480	Execution Guardrails	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
561	Detection		T1048	Exfiltration Over Alternative Protocol	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
562	Detection		T1048	Exfiltration Over Alternative Protocol	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
563	Detection		T1048	Exfiltration Over Alternative Protocol	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
564	Detection		T1048	Exfiltration Over Alternative Protocol	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
565	Detection		T1048	Exfiltration Over Alternative Protocol	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
566	Detection		T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
567	Detection		T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
568	Detection		T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
569	Detection		T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
570	Detection		T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
571	Detection		T1011.001	Exfiltration Over Bluetooth	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
572	Detection		T1011.001	Exfiltration Over Bluetooth	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
573	Detection		T1011.001	Exfiltration Over Bluetooth	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
574	Detection		T1011.001	Exfiltration Over Bluetooth	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
575	Detection		T1011.001	Exfiltration Over Bluetooth	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
576	Detection		T1041	Exfiltration Over C2 Channel	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
577	Detection		T1041	Exfiltration Over C2 Channel	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
578	Detection		T1041	Exfiltration Over C2 Channel	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
579	Detection		T1041	Exfiltration Over C2 Channel	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
580	Detection		T1041	Exfiltration Over C2 Channel	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
581	Detection		T1011	Exfiltration Over Other Network Medium	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
582	Detection		T1011	Exfiltration Over Other Network Medium	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
583	Detection		T1011	Exfiltration Over Other Network Medium	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
584	Detection		T1011	Exfiltration Over Other Network Medium	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
585	Detection		T1011	Exfiltration Over Other Network Medium	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
586	Detection		T1052	Exfiltration Over Physical Medium	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
587	Detection		T1052	Exfiltration Over Physical Medium	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
588	Detection		T1052	Exfiltration Over Physical Medium	Drive Creation	Initial construction of a drive letter or mount point to a data storage device
589	Detection		T1052	Exfiltration Over Physical Medium	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
590	Detection		T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
591	Detection		T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
592	Detection		T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
593	Detection		T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
594	Detection		T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
595	Detection		T1048.003	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
596	Detection		T1048.003	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
597	Detection		T1048.003	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
598	Detection		T1048.003	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
599	Detection		T1048.003	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
600	Detection		T1567	Exfiltration Over Web Service	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
601	Detection		T1567	Exfiltration Over Web Service	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
602	Detection		T1567	Exfiltration Over Web Service	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
603	Detection		T1567	Exfiltration Over Web Service	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
604	Detection		T1052.001	Exfiltration over USB	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
605	Detection		T1052.001	Exfiltration over USB	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
606	Detection		T1052.001	Exfiltration over USB	Drive Creation	Initial construction of a drive letter or mount point to a data storage device
607	Detection		T1052.001	Exfiltration over USB	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
608	Detection		T1567.002	Exfiltration to Cloud Storage	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
609	Detection		T1567.002	Exfiltration to Cloud Storage	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
610	Detection		T1567.002	Exfiltration to Cloud Storage	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
611	Detection		T1567.002	Exfiltration to Cloud Storage	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
612	Detection		T1567.001	Exfiltration to Code Repository	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
613	Detection		T1567.001	Exfiltration to Code Repository	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
614	Detection		T1567.001	Exfiltration to Code Repository	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
615	Detection		T1567.001	Exfiltration to Code Repository	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
616	Detection		T1190	Exploit Public-Facing Application	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
617	Detection		T1190	Exploit Public-Facing Application	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
618	Detection		T1068	Exploitation for Privilege Escalation	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
619	Detection		T1210	Exploitation of Remote Services	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
620	Detection		T1210	Exploitation of Remote Services	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
621	Detection		T1491.002	External Defacement	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
622	Detection		T1491.002	External Defacement	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
623	Detection		T1491.002	External Defacement	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
624	Detection		T1491.002	External Defacement	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
625	Detection		T1090.002	External Proxy	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
626	Detection		T1090.002	External Proxy	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
627	Detection		T1090.002	External Proxy	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
628	Detection		T1133	External Remote Services	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
629	Detection		T1133	External Remote Services	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
630	Detection		T1133	External Remote Services	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
631	Detection		T1055.011	Extra Window Memory Injection	OS API Execution	Operating system function/method calls executed by a process
632	Detection		T1008	Fallback Channels	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
633	Detection		T1008	Fallback Channels	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
634	Detection		T1568.001	Fast Flux DNS	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
635	Detection		T1568.001	Fast Flux DNS	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
636	Detection		T1070.004	File Deletion	File Deletion	Removal of a file (ex: Sysmon EID 23)
637	Detection		T1070.004	File Deletion	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
638	Detection		T1071.002	File Transfer Protocols	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
639	Detection		T1071.002	File Transfer Protocols	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
640	Detection		T1083	File and Directory Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
641	Detection		T1083	File and Directory Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
642	Detection		T1083	File and Directory Discovery	OS API Execution	Operating system function/method calls executed by a process
643	Detection		T1222	File and Directory Permissions Modification	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
644	Detection		T1222	File and Directory Permissions Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
645	Detection		T1222	File and Directory Permissions Modification	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
646	Detection		T1222	File and Directory Permissions Modification	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
647	Detection		T1495	Firmware Corruption	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
648	Detection		T1187	Forced Authentication	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
649	Detection		T1187	Forced Authentication	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
650	Detection		T1187	Forced Authentication	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
651	Detection		T1187	Forced Authentication	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
652	Detection		T1187	Forced Authentication	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
653	Detection		T1606	Forge Web Credentials	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
654	Detection		T1606	Forge Web Credentials	Web Credential Creation	Initial construction of new web credential material (ex: Windows EID 1200 or 4769)
655	Detection		T1606	Forge Web Credentials	Web Credential Usage	An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)
656	Detection		T1056.002	GUI Input Capture	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
657	Detection		T1056.002	GUI Input Capture	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
658	Detection		T1056.002	GUI Input Capture	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
659	Detection		T1553.001	Gatekeeper Bypass	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
660	Detection		T1553.001	Gatekeeper Bypass	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
661	Detection		T1553.001	Gatekeeper Bypass	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
662	Detection		T1553.001	Gatekeeper Bypass	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
663	Detection		T1592	Gather Victim Host Information	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
664	Detection		T1558.001	Golden Ticket	Active Directory Credential Request	A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
665	Detection		T1558.001	Golden Ticket	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
666	Detection		T1615	Group Policy Discovery	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
667	Detection		T1615	Group Policy Discovery	Active Directory Object Access	Opening of an active directory object, typically to collect/read its value (ex: Windows EID 4661)
668	Detection		T1615	Group Policy Discovery	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
669	Detection		T1615	Group Policy Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
670	Detection		T1615	Group Policy Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
671	Detection		T1484.001	Group Policy Modification	Active Directory Object Creation	Initial construction of a new active directory object (ex: Windows EID 5137)
672	Detection		T1484.001	Group Policy Modification	Active Directory Object Deletion	Removal of an active directory object (ex: Windows EID 5141)
673	Detection		T1484.001	Group Policy Modification	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
674	Detection		T1484.001	Group Policy Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
675	Detection		T1552.006	Group Policy Preferences	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
676	Detection		T1552.006	Group Policy Preferences	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
677	Detection		T1027.006	HTML Smuggling	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
678	Detection		T1592.001	Hardware	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
679	Detection		T1564.005	Hidden File System	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
680	Detection		T1564.005	Hidden File System	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
681	Detection		T1564.005	Hidden File System	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
682	Detection		T1564.001	Hidden Files and Directories	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
683	Detection		T1564.001	Hidden Files and Directories	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
684	Detection		T1564.001	Hidden Files and Directories	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
685	Detection		T1564.001	Hidden Files and Directories	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
686	Detection		T1564.002	Hidden Users	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
687	Detection		T1564.002	Hidden Users	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
688	Detection		T1564.002	Hidden Users	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
689	Detection		T1564.002	Hidden Users	User Account Creation	Initial construction of a new account (ex: Windows EID 4720 or /etc/passwd logs)
690	Detection		T1564.002	Hidden Users	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
691	Detection		T1564.002	Hidden Users	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
692	Detection		T1564.003	Hidden Window	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
693	Detection		T1564.003	Hidden Window	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
694	Detection		T1564.003	Hidden Window	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
695	Detection		T1564.003	Hidden Window	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
696	Detection		T1564	Hide Artifacts	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
697	Detection		T1564	Hide Artifacts	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
698	Detection		T1564	Hide Artifacts	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
699	Detection		T1564	Hide Artifacts	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
700	Detection		T1564	Hide Artifacts	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
701	Detection		T1564	Hide Artifacts	User Account Creation	Initial construction of a new account (ex: Windows EID 4720 or /etc/passwd logs)
702	Detection		T1564	Hide Artifacts	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
703	Detection		T1564	Hide Artifacts	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
704	Detection		T1564	Hide Artifacts	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
705	Detection		T1564	Hide Artifacts	OS API Execution	Operating system function/method calls executed by a process
706	Detection		T1564	Hide Artifacts	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
707	Detection		T1564	Hide Artifacts	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
708	Detection		T1564	Hide Artifacts	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
709	Detection		T1574	Hijack Execution Flow	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
710	Detection		T1574	Hijack Execution Flow	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
711	Detection		T1574	Hijack Execution Flow	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
712	Detection		T1574	Hijack Execution Flow	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
713	Detection		T1574	Hijack Execution Flow	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
714	Detection		T1574	Hijack Execution Flow	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
715	Detection		T1574	Hijack Execution Flow	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
716	Detection		T1505.004	IIS Components	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
717	Detection		T1505.004	IIS Components	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
718	Detection		T1505.004	IIS Components	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
719	Detection		T1546.012	Image File Execution Options Injection	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
720	Detection		T1546.012	Image File Execution Options Injection	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
721	Detection		T1546.012	Image File Execution Options Injection	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
722	Detection		T1562.003	Impair Command History Logging	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
723	Detection		T1562.003	Impair Command History Logging	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
724	Detection		T1562	Impair Defenses	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
725	Detection		T1562	Impair Defenses	Process Termination	Exit of a running process (ex: Sysmon EID 5 or Windows EID 4689)
726	Detection		T1562	Impair Defenses	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
727	Detection		T1562	Impair Defenses	Windows Registry Key Deletion	Removal of a Registry Key (ex: Windows EID 4658 or Sysmon EID 12)
728	Detection		T1562	Impair Defenses	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
729	Detection		T1562	Impair Defenses	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
730	Detection		T1562	Impair Defenses	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
731	Detection		T1562	Impair Defenses	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
732	Detection		T1562	Impair Defenses	Firewall Disable	Deactivation or stoppage of a cloud service (ex: Write/Delete entries within Azure Firewall Activity Logs)
733	Detection		T1562	Impair Defenses	Firewall Rule Modification	Changes made to a firewall rule, typically to allow/block specific network traffic (ex: Windows EID 4950 or Write/Delete entries within Azure Firewall Rule Collection Activity Logs)
734	Detection		T1562	Impair Defenses	Cloud Service Modification	Changes made to a cloud service, including its settings and/or data (ex: AWS CloudTrail DeleteTrail or DeleteConfigRule)
735	Detection		T1562	Impair Defenses	Cloud Service Disable	Deactivation or stoppage of a cloud service (ex: AWS Cloudtrail StopLogging)
736	Detection		T1525	Implant Internal Image	Image Creation	Initial construction of a virtual machine image (ex: Azure Compute Service Images PUT)
737	Detection		T1525	Implant Internal Image	Image Modification	Changes made to a virtual machine image, including setting and/or control data (ex: Azure Compute Service Images PATCH)
738	Detection		T1562.006	Indicator Blocking	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
739	Detection		T1562.006	Indicator Blocking	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
740	Detection		T1562.006	Indicator Blocking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
741	Detection		T1070	Indicator Removal on Host	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
742	Detection		T1070	Indicator Removal on Host	File Deletion	Removal of a file (ex: Sysmon EID 23)
743	Detection		T1070	Indicator Removal on Host	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
744	Detection		T1070	Indicator Removal on Host	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
745	Detection		T1070	Indicator Removal on Host	Windows Registry Key Deletion	Removal of a Registry Key (ex: Windows EID 4658 or Sysmon EID 12)
746	Detection		T1070	Indicator Removal on Host	OS API Execution	Operating system function/method calls executed by a process
747	Detection		T1070	Indicator Removal on Host	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
748	Detection		T1070	Indicator Removal on Host	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
749	Detection		T1070	Indicator Removal on Host	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
750	Detection		T1070	Indicator Removal on Host	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
751	Detection		T1202	Indirect Command Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
752	Detection		T1202	Indirect Command Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
753	Detection		T1105	Ingress Tool Transfer	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
754	Detection		T1105	Ingress Tool Transfer	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
755	Detection		T1105	Ingress Tool Transfer	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
756	Detection		T1105	Ingress Tool Transfer	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
757	Detection		T1490	Inhibit System Recovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
758	Detection		T1490	Inhibit System Recovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
759	Detection		T1490	Inhibit System Recovery	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
760	Detection		T1490	Inhibit System Recovery	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
761	Detection		T1490	Inhibit System Recovery	File Deletion	Removal of a file (ex: Sysmon EID 23)
762	Detection		T1056	Input Capture	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
763	Detection		T1056	Input Capture	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
764	Detection		T1056	Input Capture	OS API Execution	Operating system function/method calls executed by a process
765	Detection		T1056	Input Capture	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
766	Detection		T1056	Input Capture	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
767	Detection		T1056	Input Capture	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
768	Detection		T1608.003	Install Digital Certificate	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
769	Detection		T1553.004	Install Root Certificate	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
770	Detection		T1553.004	Install Root Certificate	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
771	Detection		T1553.004	Install Root Certificate	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
772	Detection		T1553.004	Install Root Certificate	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
773	Detection		T1218.004	InstallUtil	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
774	Detection		T1218.004	InstallUtil	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
775	Detection		T1559	Inter-Process Communication	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
776	Detection		T1559	Inter-Process Communication	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
777	Detection		T1559	Inter-Process Communication	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
778	Detection		T1491.001	Internal Defacement	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
779	Detection		T1491.001	Internal Defacement	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
780	Detection		T1491.001	Internal Defacement	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
781	Detection		T1491.001	Internal Defacement	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
782	Detection		T1090.001	Internal Proxy	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
783	Detection		T1090.001	Internal Proxy	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
784	Detection		T1090.001	Internal Proxy	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
785	Detection		T1534	Internal Spearphishing	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
786	Detection		T1534	Internal Spearphishing	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
787	Detection		T1534	Internal Spearphishing	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
788	Detection		T1016.001	Internet Connection Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
789	Detection		T1016.001	Internet Connection Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
790	Detection		T1036.001	Invalid Code Signature	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
791	Detection		T1059.007	JavaScript	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
792	Detection		T1059.007	JavaScript	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
793	Detection		T1059.007	JavaScript	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
794	Detection		T1059.007	JavaScript	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
795	Detection		T1001.001	Junk Data	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
796	Detection		T1558.003	Kerberoasting	Active Directory Credential Request	A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
797	Detection		T1547.006	Kernel Modules and Extensions	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
798	Detection		T1547.006	Kernel Modules and Extensions	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
799	Detection		T1547.006	Kernel Modules and Extensions	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
800	Detection		T1547.006	Kernel Modules and Extensions	Kernel Module Load	An object file that contains code to extend the running kernel of an OS, typically used to add support for new hardware (as device drivers) and/or filesystems, or for adding system calls
801	Detection		T1555.001	Keychain	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
802	Detection		T1555.001	Keychain	OS API Execution	Operating system function/method calls executed by a process
803	Detection		T1555.001	Keychain	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
804	Detection		T1056.001	Keylogging	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
805	Detection		T1056.001	Keylogging	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
806	Detection		T1056.001	Keylogging	OS API Execution	Operating system function/method calls executed by a process
807	Detection		T1546.006	LC_LOAD_DYLIB Addition	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
808	Detection		T1546.006	LC_LOAD_DYLIB Addition	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
809	Detection		T1546.006	LC_LOAD_DYLIB Addition	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
810	Detection		T1546.006	LC_LOAD_DYLIB Addition	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
811	Detection		T1546.006	LC_LOAD_DYLIB Addition	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
812	Detection		T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
813	Detection		T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
814	Detection		T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
815	Detection		T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
816	Detection		T1003.004	LSA Secrets	Windows Registry Key Access	Opening a Registry Key, typically to read the associated value (ex: Windows EID 4656)
817	Detection		T1003.004	LSA Secrets	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
818	Detection		T1547.008	LSASS Driver	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
819	Detection		T1547.008	LSASS Driver	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
820	Detection		T1547.008	LSASS Driver	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
821	Detection		T1547.008	LSASS Driver	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
822	Detection		T1003.001	LSASS Memory	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
823	Detection		T1003.001	LSASS Memory	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
824	Detection		T1003.001	LSASS Memory	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
825	Detection		T1003.001	LSASS Memory	OS API Execution	Operating system function/method calls executed by a process
826	Detection		T1570	Lateral Tool Transfer	Network Share Access	Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)
827	Detection		T1570	Lateral Tool Transfer	Named Pipe Metadata	Contextual data about a named pipe on a system, including pipe name and creating process (ex: Sysmon EIDs 17-18)
828	Detection		T1570	Lateral Tool Transfer	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
829	Detection		T1570	Lateral Tool Transfer	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
830	Detection		T1570	Lateral Tool Transfer	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
831	Detection		T1570	Lateral Tool Transfer	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
832	Detection		T1570	Lateral Tool Transfer	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
833	Detection		T1570	Lateral Tool Transfer	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
834	Detection		T1543.001	Launch Agent	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
835	Detection		T1543.001	Launch Agent	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
836	Detection		T1543.001	Launch Agent	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
837	Detection		T1543.001	Launch Agent	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
838	Detection		T1543.001	Launch Agent	Service Modification	Changes made to a service/daemon, such as changes to name, description, and/or start type (ex: Windows EID 7040 or /var/log daemon logs)
839	Detection		T1543.004	Launch Daemon	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
840	Detection		T1543.004	Launch Daemon	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
841	Detection		T1543.004	Launch Daemon	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
842	Detection		T1543.004	Launch Daemon	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
843	Detection		T1543.004	Launch Daemon	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
844	Detection		T1543.004	Launch Daemon	Service Modification	Changes made to a service/daemon, such as changes to name, description, and/or start type (ex: Windows EID 7040 or /var/log daemon logs)
845	Detection		T1569.001	Launchctl	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
846	Detection		T1569.001	Launchctl	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
847	Detection		T1569.001	Launchctl	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
848	Detection		T1569.001	Launchctl	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
849	Detection		T1608.005	Link Target	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
850	Detection		T1222.002	Linux and Mac File and Directory Permissions Modification	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
851	Detection		T1222.002	Linux and Mac File and Directory Permissions Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
852	Detection		T1222.002	Linux and Mac File and Directory Permissions Modification	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
853	Detection		T1136.001	Local Account	User Account Creation	Initial construction of a new account (ex: Windows EID 4720 or /etc/passwd logs)
854	Detection		T1136.001	Local Account	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
855	Detection		T1136.001	Local Account	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
856	Detection		T1087.001	Local Account	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
857	Detection		T1087.001	Local Account	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
858	Detection		T1087.001	Local Account	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
859	Detection		T1078.003	Local Accounts	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
860	Detection		T1078.003	Local Accounts	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
861	Detection		T1078.003	Local Accounts	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
862	Detection		T1074.001	Local Data Staging	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
863	Detection		T1074.001	Local Data Staging	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
864	Detection		T1074.001	Local Data Staging	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
865	Detection		T1114.001	Local Email Collection	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
866	Detection		T1114.001	Local Email Collection	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
867	Detection		T1069.001	Local Groups	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
868	Detection		T1069.001	Local Groups	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
869	Detection		T1547.015	Login Items	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
870	Detection		T1547.015	Login Items	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
871	Detection		T1547.015	Login Items	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
872	Detection		T1037.002	Logon Script (Mac)	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
873	Detection		T1037.002	Logon Script (Mac)	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
874	Detection		T1037.002	Logon Script (Mac)	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
875	Detection		T1037.002	Logon Script (Mac)	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
876	Detection		T1037.001	Logon Script (Windows)	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
877	Detection		T1037.001	Logon Script (Windows)	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
878	Detection		T1037.001	Logon Script (Windows)	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
879	Detection		T1218.014	MMC	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
880	Detection		T1218.014	MMC	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
881	Detection		T1218.014	MMC	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
882	Detection		T1127.001	MSBuild	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
883	Detection		T1127.001	MSBuild	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
884	Detection		T1071.003	Mail Protocols	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
885	Detection		T1071.003	Mail Protocols	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
886	Detection		T1134.003	Make and Impersonate Token	OS API Execution	Operating system function/method calls executed by a process
887	Detection		T1134.003	Make and Impersonate Token	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
888	Detection		T1204.002	Malicious File	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
889	Detection		T1204.002	Malicious File	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
890	Detection		T1204.003	Malicious Image	Container Creation	Initial construction of a new container (ex: docker create <container_name>)
891	Detection		T1204.003	Malicious Image	Container Start	Activation or invocation of a container (ex: docker start or docker restart)
892	Detection		T1204.003	Malicious Image	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
893	Detection		T1204.003	Malicious Image	Image Creation	Initial construction of a virtual machine image (ex: Azure Compute Service Images PUT)
894	Detection		T1204.003	Malicious Image	Instance Creation	Initial construction of a new instance (ex: instance.insert within GCP Audit Logs)
895	Detection		T1204.003	Malicious Image	Instance Start	Activation or invocation of an instance (ex: instance.start within GCP Audit Logs)
896	Detection		T1204.003	Malicious Image	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
897	Detection		T1204.001	Malicious Link	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
898	Detection		T1204.001	Malicious Link	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
899	Detection		T1204.001	Malicious Link	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
900	Detection		T1587.001	Malware	Malware Metadata	Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
901	Detection		T1587.001	Malware	Malware Content	Code, strings, and other signatures that compromise a malicious payload
902	Detection		T1588.001	Malware	Malware Metadata	Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
903	Detection		T1588.001	Malware	Malware Content	Code, strings, and other signatures that compromise a malicious payload
904	Detection		T1553.005	Mark-of-the-Web Bypass	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
905	Detection		T1553.005	Mark-of-the-Web Bypass	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
906	Detection		T1036.004	Masquerade Task or Service	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
907	Detection		T1036.004	Masquerade Task or Service	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
908	Detection		T1036.004	Masquerade Task or Service	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
909	Detection		T1036.004	Masquerade Task or Service	Scheduled Job Metadata	Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.
910	Detection		T1036.004	Masquerade Task or Service	Scheduled Job Modification	Changes made to a scheduled job, such as modifications to the execution launch (ex: Windows EID 4702 or /var/log cron logs)
911	Detection		T1036	Masquerading	Image Metadata	Contextual data about a virtual machine image such as name, resource group, state, or type
912	Detection		T1036	Masquerading	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
913	Detection		T1036	Masquerading	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
914	Detection		T1036	Masquerading	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
915	Detection		T1036	Masquerading	Scheduled Job Metadata	Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.
916	Detection		T1036	Masquerading	Scheduled Job Modification	Changes made to a scheduled job, such as modifications to the execution launch (ex: Windows EID 4702 or /var/log cron logs)
917	Detection		T1036	Masquerading	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
918	Detection		T1036	Masquerading	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
919	Detection		T1036	Masquerading	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
920	Detection		T1036.005	Match Legitimate Name or Location	Image Metadata	Contextual data about a virtual machine image such as name, resource group, state, or type
921	Detection		T1036.005	Match Legitimate Name or Location	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
922	Detection		T1036.005	Match Legitimate Name or Location	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
923	Detection		T1218.013	Mavinject	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
924	Detection		T1218.013	Mavinject	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
925	Detection		T1556	Modify Authentication Process	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
926	Detection		T1556	Modify Authentication Process	OS API Execution	Operating system function/method calls executed by a process
927	Detection		T1556	Modify Authentication Process	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
928	Detection		T1556	Modify Authentication Process	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
929	Detection		T1556	Modify Authentication Process	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
930	Detection		T1556	Modify Authentication Process	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
931	Detection		T1556	Modify Authentication Process	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
932	Detection		T1578	Modify Cloud Compute Infrastructure	Instance Stop	Deactivation or stoppage of an instance (ex: instance.stop within GCP Audit Logs)
933	Detection		T1578	Modify Cloud Compute Infrastructure	Instance Start	Activation or invocation of an instance (ex: instance.start within GCP Audit Logs)
934	Detection		T1578	Modify Cloud Compute Infrastructure	Instance Creation	Initial construction of a new instance (ex: instance.insert within GCP Audit Logs)
935	Detection		T1578	Modify Cloud Compute Infrastructure	Instance Modification	Changes made to an instance, including its settings and/or control data (ex: instance.addResourcePolicies or instances.setMetadata within GCP Audit Logs)
936	Detection		T1578	Modify Cloud Compute Infrastructure	Instance Deletion	Removal of an instance (ex: instance.delete within GCP Audit Logs)
937	Detection		T1578	Modify Cloud Compute Infrastructure	Snapshot Creation	Initial construction of a new snapshot (ex: AWS create-snapshot)
938	Detection		T1578	Modify Cloud Compute Infrastructure	Snapshot Modification	Changes made to a snapshop, such as metadata and control data (ex: AWS modify-snapshot-attribute)
939	Detection		T1578	Modify Cloud Compute Infrastructure	Snapshot Deletion	Removal of a snapshot (ex: AWS delete-snapshot)
940	Detection		T1578	Modify Cloud Compute Infrastructure	Volume Creation	Initial construction of a cloud volume (ex: AWS create-volume)
941	Detection		T1578	Modify Cloud Compute Infrastructure	Volume Modification	Changes made to a cloud volume, including its settings and control data (ex: AWS modify-volume)
942	Detection		T1578	Modify Cloud Compute Infrastructure	Volume Deletion	Removal of a a cloud volume (ex: AWS delete-volume)
943	Detection		T1112	Modify Registry	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
944	Detection		T1112	Modify Registry	OS API Execution	Operating system function/method calls executed by a process
945	Detection		T1112	Modify Registry	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
946	Detection		T1112	Modify Registry	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
947	Detection		T1112	Modify Registry	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
948	Detection		T1112	Modify Registry	Windows Registry Key Deletion	Removal of a Registry Key (ex: Windows EID 4658 or Sysmon EID 12)
949	Detection		T1601	Modify System Image	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
950	Detection		T1218.005	Mshta	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
951	Detection		T1218.005	Mshta	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
952	Detection		T1218.005	Mshta	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
953	Detection		T1218.005	Mshta	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
954	Detection		T1218.007	Msiexec	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
955	Detection		T1218.007	Msiexec	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
956	Detection		T1218.007	Msiexec	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
957	Detection		T1218.007	Msiexec	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
958	Detection		T1104	Multi-Stage Channels	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
959	Detection		T1104	Multi-Stage Channels	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
960	Detection		T1090.003	Multi-hop Proxy	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
961	Detection		T1090.003	Multi-hop Proxy	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
962	Detection		T1090.003	Multi-hop Proxy	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
963	Detection		T1003.003	NTDS	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
964	Detection		T1003.003	NTDS	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
965	Detection		T1564.004	NTFS File Attributes	OS API Execution	Operating system function/method calls executed by a process
966	Detection		T1564.004	NTFS File Attributes	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
967	Detection		T1564.004	NTFS File Attributes	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
968	Detection		T1564.004	NTFS File Attributes	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
969	Detection		T1106	Native API	OS API Execution	Operating system function/method calls executed by a process
970	Detection		T1106	Native API	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
971	Detection		T1546.007	Netsh Helper DLL	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
972	Detection		T1546.007	Netsh Helper DLL	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
973	Detection		T1546.007	Netsh Helper DLL	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
974	Detection		T1546.007	Netsh Helper DLL	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
975	Detection		T1599.001	Network Address Translation Traversal	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
976	Detection		T1599.001	Network Address Translation Traversal	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
977	Detection		T1599	Network Boundary Bridging	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
978	Detection		T1599	Network Boundary Bridging	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
979	Detection		T1498	Network Denial of Service	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
980	Detection		T1498	Network Denial of Service	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
981	Detection		T1556.004	Network Device Authentication	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
982	Detection		T1059.008	Network Device CLI	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
983	Detection		T1602.002	Network Device Configuration Dump	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
984	Detection		T1602.002	Network Device Configuration Dump	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
985	Detection		T1037.003	Network Logon Script	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
986	Detection		T1037.003	Network Logon Script	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
987	Detection		T1037.003	Network Logon Script	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
988	Detection		T1037.003	Network Logon Script	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
989	Detection		T1037.003	Network Logon Script	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
990	Detection		T1046	Network Service Scanning	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
991	Detection		T1046	Network Service Scanning	Cloud Service Enumeration	An extracted list of cloud services (ex: AWS ECS ListServices)
992	Detection		T1046	Network Service Scanning	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
993	Detection		T1070.005	Network Share Connection Removal	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
994	Detection		T1070.005	Network Share Connection Removal	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
995	Detection		T1070.005	Network Share Connection Removal	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
996	Detection		T1070.005	Network Share Connection Removal	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
997	Detection		T1135	Network Share Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
998	Detection		T1135	Network Share Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
999	Detection		T1135	Network Share Discovery	OS API Execution	Operating system function/method calls executed by a process
1000	Detection		T1040	Network Sniffing	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1001	Detection		T1040	Network Sniffing	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1002	Detection		T1095	Non-Application Layer Protocol	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1003	Detection		T1095	Non-Application Layer Protocol	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1004	Detection		T1132.002	Non-Standard Encoding	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1005	Detection		T1571	Non-Standard Port	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1006	Detection		T1571	Non-Standard Port	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1007	Detection		T1571	Non-Standard Port	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1008	Detection		T1003	OS Credential Dumping	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1009	Detection		T1003	OS Credential Dumping	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1010	Detection		T1003	OS Credential Dumping	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1011	Detection		T1003	OS Credential Dumping	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1012	Detection		T1003	OS Credential Dumping	Windows Registry Key Access	Opening a Registry Key, typically to read the associated value (ex: Windows EID 4656)
1013	Detection		T1003	OS Credential Dumping	Active Directory Object Access	Opening of an active directory object, typically to collect/read its value (ex: Windows EID 4661)
1014	Detection		T1003	OS Credential Dumping	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1015	Detection		T1003	OS Credential Dumping	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1016	Detection		T1003	OS Credential Dumping	OS API Execution	Operating system function/method calls executed by a process
1017	Detection		T1499.001	OS Exhaustion Flood	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
1018	Detection		T1499.001	OS Exhaustion Flood	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1019	Detection		T1499.001	OS Exhaustion Flood	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1020	Detection		T1027	Obfuscated Files or Information	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1021	Detection		T1027	Obfuscated Files or Information	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1022	Detection		T1027	Obfuscated Files or Information	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1023	Detection		T1027	Obfuscated Files or Information	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1024	Detection		T1588	Obtain Capabilities	Malware Metadata	Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
1025	Detection		T1588	Obtain Capabilities	Malware Content	Code, strings, and other signatures that compromise a malicious payload
1026	Detection		T1588	Obtain Capabilities	Certificate Registration	Queried or logged information highlighting current and expired digital certificates (ex: Certificate transparency)
1027	Detection		T1588	Obtain Capabilities	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1028	Detection		T1218.008	Odbcconf	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1029	Detection		T1218.008	Odbcconf	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1030	Detection		T1218.008	Odbcconf	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1031	Detection		T1137	Office Application Startup	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1032	Detection		T1137	Office Application Startup	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1033	Detection		T1137	Office Application Startup	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
1034	Detection		T1137	Office Application Startup	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1035	Detection		T1137	Office Application Startup	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1036	Detection		T1137	Office Application Startup	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1037	Detection		T1137	Office Application Startup	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1038	Detection		T1137	Office Application Startup	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1039	Detection		T1137.001	Office Template Macros	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1040	Detection		T1137.001	Office Template Macros	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1041	Detection		T1137.001	Office Template Macros	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
1042	Detection		T1137.001	Office Template Macros	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1043	Detection		T1137.001	Office Template Macros	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1044	Detection		T1137.001	Office Template Macros	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1045	Detection		T1137.002	Office Test	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1046	Detection		T1137.002	Office Test	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1047	Detection		T1137.002	Office Test	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
1048	Detection		T1137.002	Office Test	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1049	Detection		T1137.002	Office Test	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1050	Detection		T1137.002	Office Test	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1051	Detection		T1137.002	Office Test	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1052	Detection		T1102.003	One-Way Communication	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1053	Detection		T1102.003	One-Way Communication	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1054	Detection		T1102.003	One-Way Communication	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1055	Detection		T1137.003	Outlook Forms	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1056	Detection		T1137.003	Outlook Forms	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1057	Detection		T1137.003	Outlook Forms	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1058	Detection		T1137.004	Outlook Home Page	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1059	Detection		T1137.004	Outlook Home Page	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1060	Detection		T1137.004	Outlook Home Page	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1061	Detection		T1137.005	Outlook Rules	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1062	Detection		T1137.005	Outlook Rules	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1063	Detection		T1137.005	Outlook Rules	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1064	Detection		T1134.004	Parent PID Spoofing	OS API Execution	Operating system function/method calls executed by a process
1065	Detection		T1134.004	Parent PID Spoofing	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1066	Detection		T1134.004	Parent PID Spoofing	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
1067	Detection		T1550.002	Pass the Hash	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1068	Detection		T1550.002	Pass the Hash	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1069	Detection		T1550.002	Pass the Hash	Active Directory Credential Request	A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
1070	Detection		T1550.003	Pass the Ticket	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1071	Detection		T1550.003	Pass the Ticket	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1072	Detection		T1550.003	Pass the Ticket	Active Directory Credential Request	A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
1073	Detection		T1110.002	Password Cracking	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1074	Detection		T1110.002	Password Cracking	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1075	Detection		T1556.002	Password Filter DLL	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1076	Detection		T1556.002	Password Filter DLL	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1077	Detection		T1556.002	Password Filter DLL	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1078	Detection		T1110.001	Password Guessing	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1079	Detection		T1110.001	Password Guessing	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1080	Detection		T1555.005	Password Managers	OS API Execution	Operating system function/method calls executed by a process
1081	Detection		T1555.005	Password Managers	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1082	Detection		T1555.005	Password Managers	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1083	Detection		T1555.005	Password Managers	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1084	Detection		T1201	Password Policy Discovery	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
1085	Detection		T1201	Password Policy Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1086	Detection		T1201	Password Policy Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1087	Detection		T1110.003	Password Spraying	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1088	Detection		T1110.003	Password Spraying	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1089	Detection		T1601.001	Patch System Image	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1090	Detection		T1574.007	Path Interception by PATH Environment Variable	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1091	Detection		T1574.007	Path Interception by PATH Environment Variable	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1092	Detection		T1574.007	Path Interception by PATH Environment Variable	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1093	Detection		T1574.008	Path Interception by Search Order Hijacking	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1094	Detection		T1574.008	Path Interception by Search Order Hijacking	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1095	Detection		T1574.008	Path Interception by Search Order Hijacking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1096	Detection		T1574.009	Path Interception by Unquoted Path	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1097	Detection		T1574.009	Path Interception by Unquoted Path	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1098	Detection		T1574.009	Path Interception by Unquoted Path	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1099	Detection		T1120	Peripheral Device Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1100	Detection		T1120	Peripheral Device Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1101	Detection		T1120	Peripheral Device Discovery	OS API Execution	Operating system function/method calls executed by a process
1102	Detection		T1069	Permission Groups Discovery	Pod Metadata	Contextual data about a pod and activity around it such as name, ID, namespace, or status
1103	Detection		T1069	Permission Groups Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1104	Detection		T1069	Permission Groups Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1105	Detection		T1069	Permission Groups Discovery	Group Enumeration	An extracted list of available groups and/or their associated settings (ex: AWS list-groups)
1106	Detection		T1069	Permission Groups Discovery	Group Metadata	Contextual data about a group which describes group and activity around it, such as name, permissions, or user accounts within the group
1107	Detection		T1069	Permission Groups Discovery	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1108	Detection		T1566	Phishing	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1109	Detection		T1566	Phishing	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1110	Detection		T1566	Phishing	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1111	Detection		T1566	Phishing	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1112	Detection		T1598	Phishing for Information	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1113	Detection		T1598	Phishing for Information	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1114	Detection		T1598	Phishing for Information	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1115	Detection		T1547.011	Plist Modification	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
1116	Detection		T1547.011	Plist Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1117	Detection		T1547.011	Plist Modification	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1118	Detection		T1547.011	Plist Modification	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1119	Detection		T1556.003	Pluggable Authentication Modules	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1120	Detection		T1556.003	Pluggable Authentication Modules	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1121	Detection		T1205.001	Port Knocking	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1122	Detection		T1205.001	Port Knocking	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1123	Detection		T1547.010	Port Monitors	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1124	Detection		T1547.010	Port Monitors	OS API Execution	Operating system function/method calls executed by a process
1125	Detection		T1547.010	Port Monitors	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1126	Detection		T1547.010	Port Monitors	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1127	Detection		T1055.002	Portable Executable Injection	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
1128	Detection		T1055.002	Portable Executable Injection	OS API Execution	Operating system function/method calls executed by a process
1129	Detection		T1055.002	Portable Executable Injection	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1130	Detection		T1059.001	PowerShell	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1131	Detection		T1059.001	PowerShell	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1132	Detection		T1059.001	PowerShell	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1133	Detection		T1059.001	PowerShell	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
1134	Detection		T1546.013	PowerShell Profile	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1135	Detection		T1546.013	PowerShell Profile	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1136	Detection		T1546.013	PowerShell Profile	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1137	Detection		T1546.013	PowerShell Profile	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1138	Detection		T1542	Pre-OS Boot	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1139	Detection		T1542	Pre-OS Boot	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1140	Detection		T1542	Pre-OS Boot	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
1141	Detection		T1542	Pre-OS Boot	Driver Metadata	Contextual data about a driver and activity around it such as driver issues reporting or integrity (page hash, code) checking
1142	Detection		T1542	Pre-OS Boot	OS API Execution	Operating system function/method calls executed by a process
1143	Detection		T1542	Pre-OS Boot	Drive Modification	Changes made to a drive letter or mount point of a data storage device
1144	Detection		T1547.012	Print Processors	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1145	Detection		T1547.012	Print Processors	OS API Execution	Operating system function/method calls executed by a process
1146	Detection		T1547.012	Print Processors	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1147	Detection		T1547.012	Print Processors	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1148	Detection		T1547.012	Print Processors	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
1149	Detection		T1552.004	Private Keys	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1150	Detection		T1552.004	Private Keys	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1151	Detection		T1003.007	Proc Filesystem	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1152	Detection		T1003.007	Proc Filesystem	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1153	Detection		T1055.009	Proc Memory	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1154	Detection		T1057	Process Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1155	Detection		T1057	Process Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1156	Detection		T1057	Process Discovery	OS API Execution	Operating system function/method calls executed by a process
1157	Detection		T1055.013	Process Doppelgänging	OS API Execution	Operating system function/method calls executed by a process
1158	Detection		T1055.013	Process Doppelgänging	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1159	Detection		T1055.012	Process Hollowing	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
1160	Detection		T1055.012	Process Hollowing	OS API Execution	Operating system function/method calls executed by a process
1161	Detection		T1055.012	Process Hollowing	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1162	Detection		T1055	Process Injection	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
1163	Detection		T1055	Process Injection	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1164	Detection		T1055	Process Injection	OS API Execution	Operating system function/method calls executed by a process
1165	Detection		T1055	Process Injection	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1166	Detection		T1055	Process Injection	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1167	Detection		T1055	Process Injection	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1168	Detection		T1001.003	Protocol Impersonation	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1169	Detection		T1572	Protocol Tunneling	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1170	Detection		T1572	Protocol Tunneling	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1171	Detection		T1572	Protocol Tunneling	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1172	Detection		T1090	Proxy	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1173	Detection		T1090	Proxy	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1174	Detection		T1090	Proxy	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1175	Detection		T1055.008	Ptrace System Calls	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
1176	Detection		T1055.008	Ptrace System Calls	OS API Execution	Operating system function/method calls executed by a process
1177	Detection		T1055.008	Ptrace System Calls	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1178	Detection		T1216.001	PubPrn	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1179	Detection		T1216.001	PubPrn	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1180	Detection		T1216.001	PubPrn	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
1181	Detection		T1059.006	Python	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1182	Detection		T1059.006	Python	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1183	Detection		T1012	Query Registry	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1184	Detection		T1012	Query Registry	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1185	Detection		T1012	Query Registry	Windows Registry Key Access	Opening a Registry Key, typically to read the associated value (ex: Windows EID 4656)
1186	Detection		T1012	Query Registry	OS API Execution	Operating system function/method calls executed by a process
1187	Detection		T1037.004	RC Scripts	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1188	Detection		T1037.004	RC Scripts	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1189	Detection		T1037.004	RC Scripts	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1190	Detection		T1037.004	RC Scripts	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1191	Detection		T1563.002	RDP Hijacking	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1192	Detection		T1563.002	RDP Hijacking	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1193	Detection		T1563.002	RDP Hijacking	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1194	Detection		T1563.002	RDP Hijacking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1195	Detection		T1563.002	RDP Hijacking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1196	Detection		T1542.004	ROMMONkit	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
1197	Detection		T1547.007	Re-opened Applications	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1198	Detection		T1547.007	Re-opened Applications	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1199	Detection		T1600.001	Reduce Key Space	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1200	Detection		T1498.002	Reflection Amplification	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
1201	Detection		T1498.002	Reflection Amplification	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1202	Detection		T1620	Reflective Code Loading	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
1203	Detection		T1620	Reflective Code Loading	OS API Execution	Operating system function/method calls executed by a process
1204	Detection		T1620	Reflective Code Loading	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1205	Detection		T1547.001	Registry Run Keys / Startup Folder	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
1206	Detection		T1547.001	Registry Run Keys / Startup Folder	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1207	Detection		T1547.001	Registry Run Keys / Startup Folder	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1208	Detection		T1547.001	Registry Run Keys / Startup Folder	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1209	Detection		T1547.001	Registry Run Keys / Startup Folder	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1210	Detection		T1218.009	Regsvcs/Regasm	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1211	Detection		T1218.009	Regsvcs/Regasm	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1212	Detection		T1218.010	Regsvr32	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1213	Detection		T1218.010	Regsvr32	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1214	Detection		T1218.010	Regsvr32	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1215	Detection		T1218.010	Regsvr32	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1216	Detection		T1219	Remote Access Software	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1217	Detection		T1219	Remote Access Software	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1218	Detection		T1219	Remote Access Software	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1219	Detection		T1219	Remote Access Software	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1220	Detection		T1074.002	Remote Data Staging	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1221	Detection		T1074.002	Remote Data Staging	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1222	Detection		T1074.002	Remote Data Staging	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1223	Detection		T1021.001	Remote Desktop Protocol	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1224	Detection		T1021.001	Remote Desktop Protocol	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1225	Detection		T1021.001	Remote Desktop Protocol	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1226	Detection		T1021.001	Remote Desktop Protocol	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1227	Detection		T1114.002	Remote Email Collection	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1228	Detection		T1114.002	Remote Email Collection	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1229	Detection		T1114.002	Remote Email Collection	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1230	Detection		T1563	Remote Service Session Hijacking	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1231	Detection		T1563	Remote Service Session Hijacking	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1232	Detection		T1563	Remote Service Session Hijacking	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1233	Detection		T1563	Remote Service Session Hijacking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1234	Detection		T1563	Remote Service Session Hijacking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1235	Detection		T1021	Remote Services	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1236	Detection		T1021	Remote Services	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1237	Detection		T1021	Remote Services	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1238	Detection		T1021	Remote Services	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1239	Detection		T1021	Remote Services	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1240	Detection		T1021	Remote Services	Network Share Access	Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)
1241	Detection		T1021	Remote Services	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1242	Detection		T1018	Remote System Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1243	Detection		T1018	Remote System Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1244	Detection		T1018	Remote System Discovery	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1245	Detection		T1018	Remote System Discovery	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1246	Detection		T1036.003	Rename System Utilities	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1247	Detection		T1036.003	Rename System Utilities	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
1248	Detection		T1036.003	Rename System Utilities	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1249	Detection		T1036.003	Rename System Utilities	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1250	Detection		T1091	Replication Through Removable Media	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1251	Detection		T1091	Replication Through Removable Media	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1252	Detection		T1091	Replication Through Removable Media	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1253	Detection		T1091	Replication Through Removable Media	Drive Creation	Initial construction of a drive letter or mount point to a data storage device
1254	Detection		T1564.009	Resource Forking	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1255	Detection		T1564.009	Resource Forking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1256	Detection		T1564.009	Resource Forking	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1257	Detection		T1564.009	Resource Forking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1258	Detection		T1496	Resource Hijacking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1259	Detection		T1496	Resource Hijacking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1260	Detection		T1496	Resource Hijacking	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1261	Detection		T1496	Resource Hijacking	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1262	Detection		T1496	Resource Hijacking	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1263	Detection		T1496	Resource Hijacking	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
1264	Detection		T1578.004	Revert Cloud Instance	Instance Modification	Changes made to an instance, including its settings and/or control data (ex: instance.addResourcePolicies or instances.setMetadata within GCP Audit Logs)
1265	Detection		T1578.004	Revert Cloud Instance	Instance Start	Activation or invocation of an instance (ex: instance.start within GCP Audit Logs)
1266	Detection		T1578.004	Revert Cloud Instance	Instance Stop	Deactivation or stoppage of an instance (ex: instance.stop within GCP Audit Logs)
1267	Detection		T1036.002	Right-to-Left Override	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1268	Detection		T1207	Rogue Domain Controller	Active Directory Object Creation	Initial construction of a new active directory object (ex: Windows EID 5137)
1269	Detection		T1207	Rogue Domain Controller	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
1270	Detection		T1207	Rogue Domain Controller	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1271	Detection		T1207	Rogue Domain Controller	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1272	Detection		T1014	Rootkit	Drive Modification	Changes made to a drive letter or mount point of a data storage device
1273	Detection		T1014	Rootkit	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
1274	Detection		T1564.006	Run Virtual Instance	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1275	Detection		T1564.006	Run Virtual Instance	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1276	Detection		T1564.006	Run Virtual Instance	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1277	Detection		T1564.006	Run Virtual Instance	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
1278	Detection		T1564.006	Run Virtual Instance	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1279	Detection		T1218.011	Rundll32	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1280	Detection		T1218.011	Rundll32	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1281	Detection		T1218.011	Rundll32	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1282	Detection		T1218.011	Rundll32	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1283	Detection		T1565.003	Runtime Data Manipulation	OS API Execution	Operating system function/method calls executed by a process
1284	Detection		T1565.003	Runtime Data Manipulation	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1285	Detection		T1565.003	Runtime Data Manipulation	File Deletion	Removal of a file (ex: Sysmon EID 23)
1286	Detection		T1565.003	Runtime Data Manipulation	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1287	Detection		T1565.003	Runtime Data Manipulation	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1288	Detection		T1606.002	SAML Tokens	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1289	Detection		T1606.002	SAML Tokens	Web Credential Creation	Initial construction of new web credential material (ex: Windows EID 1200 or 4769)
1290	Detection		T1606.002	SAML Tokens	Web Credential Usage	An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)
1291	Detection		T1134.005	SID-History Injection	OS API Execution	Operating system function/method calls executed by a process
1292	Detection		T1134.005	SID-History Injection	User Account Metadata	Contextual data about an account, which may include a username, user ID, environmental data, etc.
1293	Detection		T1134.005	SID-History Injection	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
1294	Detection		T1553.003	SIP and Trust Provider Hijacking	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1295	Detection		T1553.003	SIP and Trust Provider Hijacking	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1296	Detection		T1553.003	SIP and Trust Provider Hijacking	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1297	Detection		T1021.002	SMB/Windows Admin Shares	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1298	Detection		T1021.002	SMB/Windows Admin Shares	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1299	Detection		T1021.002	SMB/Windows Admin Shares	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1300	Detection		T1021.002	SMB/Windows Admin Shares	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1301	Detection		T1021.002	SMB/Windows Admin Shares	Network Share Access	Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)
1302	Detection		T1602.001	SNMP (MIB Dump)	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1303	Detection		T1602.001	SNMP (MIB Dump)	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1304	Detection		T1505.001	SQL Stored Procedures	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1305	Detection		T1021.004	SSH	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1306	Detection		T1021.004	SSH	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1307	Detection		T1021.004	SSH	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1308	Detection		T1098.004	SSH Authorized Keys	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1309	Detection		T1098.004	SSH Authorized Keys	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1310	Detection		T1098.004	SSH Authorized Keys	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1311	Detection		T1563.001	SSH Hijacking	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1312	Detection		T1563.001	SSH Hijacking	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1313	Detection		T1563.001	SSH Hijacking	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1314	Detection		T1563.001	SSH Hijacking	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1315	Detection		T1563.001	SSH Hijacking	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1316	Detection		T1562.009	Safe Mode Boot	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1317	Detection		T1562.009	Safe Mode Boot	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1318	Detection		T1562.009	Safe Mode Boot	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
1319	Detection		T1562.009	Safe Mode Boot	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1320	Detection		T1595.001	Scanning IP Blocks	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1321	Detection		T1053.005	Scheduled Task	Scheduled Job Creation	Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
1322	Detection		T1053.005	Scheduled Task	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1323	Detection		T1053.005	Scheduled Task	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1324	Detection		T1053.005	Scheduled Task	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1325	Detection		T1053	Scheduled Task/Job	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1326	Detection		T1053	Scheduled Task/Job	Container Creation	Initial construction of a new container (ex: docker create <container_name>)
1327	Detection		T1053	Scheduled Task/Job	Scheduled Job Creation	Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
1328	Detection		T1053	Scheduled Task/Job	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1329	Detection		T1053	Scheduled Task/Job	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1330	Detection		T1053	Scheduled Task/Job	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1331	Detection		T1029	Scheduled Transfer	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1332	Detection		T1029	Scheduled Transfer	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1333	Detection		T1113	Screen Capture	OS API Execution	Operating system function/method calls executed by a process
1334	Detection		T1113	Screen Capture	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1335	Detection		T1546.002	Screensaver	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1336	Detection		T1546.002	Screensaver	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1337	Detection		T1546.002	Screensaver	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1338	Detection		T1546.002	Screensaver	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1339	Detection		T1546.002	Screensaver	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1340	Detection		T1594	Search Victim-Owned Websites	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1341	Detection		T1003.002	Security Account Manager	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1342	Detection		T1003.002	Security Account Manager	Windows Registry Key Access	Opening a Registry Key, typically to read the associated value (ex: Windows EID 4656)
1343	Detection		T1003.002	Security Account Manager	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1344	Detection		T1518.001	Security Software Discovery	Firewall Metadata	Contextual data about a firewall and activity around it such as name, policy, or status
1345	Detection		T1518.001	Security Software Discovery	Firewall Enumeration	An extracted list of available firewalls and/or their associated settings/rules (ex: Azure Network Firewall CLI Show commands)
1346	Detection		T1518.001	Security Software Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1347	Detection		T1518.001	Security Software Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1348	Detection		T1518.001	Security Software Discovery	OS API Execution	Operating system function/method calls executed by a process
1349	Detection		T1547.005	Security Support Provider	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1350	Detection		T1547.005	Security Support Provider	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1351	Detection		T1547.005	Security Support Provider	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1352	Detection		T1555.002	Securityd Memory	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1353	Detection		T1555.002	Securityd Memory	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1354	Detection		T1583.004	Server	Response Metadata	Contextual data about an Internet-facing resource gathered from a scan, such as running services or ports
1355	Detection		T1583.004	Server	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1356	Detection		T1584.004	Server	Response Metadata	Contextual data about an Internet-facing resource gathered from a scan, such as running services or ports
1357	Detection		T1584.004	Server	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1358	Detection		T1505	Server Software Component	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1359	Detection		T1505	Server Software Component	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1360	Detection		T1505	Server Software Component	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1361	Detection		T1505	Server Software Component	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1362	Detection		T1505	Server Software Component	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1363	Detection		T1505	Server Software Component	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1364	Detection		T1569.002	Service Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1365	Detection		T1569.002	Service Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1366	Detection		T1569.002	Service Execution	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
1367	Detection		T1569.002	Service Execution	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1368	Detection		T1499.002	Service Exhaustion Flood	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
1369	Detection		T1499.002	Service Exhaustion Flood	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1370	Detection		T1499.002	Service Exhaustion Flood	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1371	Detection		T1499.002	Service Exhaustion Flood	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1372	Detection		T1489	Service Stop	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1373	Detection		T1489	Service Stop	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1374	Detection		T1489	Service Stop	OS API Execution	Operating system function/method calls executed by a process
1375	Detection		T1489	Service Stop	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
1376	Detection		T1489	Service Stop	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1377	Detection		T1489	Service Stop	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1378	Detection		T1489	Service Stop	Process Termination	Exit of a running process (ex: Sysmon EID 5 or Windows EID 4689)
1379	Detection		T1574.010	Services File Permissions Weakness	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1380	Detection		T1574.010	Services File Permissions Weakness	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1381	Detection		T1574.010	Services File Permissions Weakness	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1382	Detection		T1574.010	Services File Permissions Weakness	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
1383	Detection		T1574.011	Services Registry Permissions Weakness	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1384	Detection		T1574.011	Services Registry Permissions Weakness	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1385	Detection		T1574.011	Services Registry Permissions Weakness	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
1386	Detection		T1574.011	Services Registry Permissions Weakness	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1387	Detection		T1548.001	Setuid and Setgid	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1388	Detection		T1548.001	Setuid and Setgid	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1389	Detection		T1548.001	Setuid and Setgid	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1390	Detection		T1129	Shared Modules	OS API Execution	Operating system function/method calls executed by a process
1391	Detection		T1129	Shared Modules	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1392	Detection		T1213.002	Sharepoint	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1393	Detection		T1213.002	Sharepoint	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1394	Detection		T1547.009	Shortcut Modification	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1395	Detection		T1547.009	Shortcut Modification	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1396	Detection		T1547.009	Shortcut Modification	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1397	Detection		T1218	Signed Binary Proxy Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1398	Detection		T1218	Signed Binary Proxy Execution	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1399	Detection		T1218	Signed Binary Proxy Execution	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1400	Detection		T1218	Signed Binary Proxy Execution	OS API Execution	Operating system function/method calls executed by a process
1401	Detection		T1218	Signed Binary Proxy Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1402	Detection		T1218	Signed Binary Proxy Execution	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1403	Detection		T1218	Signed Binary Proxy Execution	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1404	Detection		T1216	Signed Script Proxy Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1405	Detection		T1216	Signed Script Proxy Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1406	Detection		T1216	Signed Script Proxy Execution	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
1407	Detection		T1558.002	Silver Ticket	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
1408	Detection		T1585.001	Social Media Accounts	Social Media	Established, compromised, or otherwise acquired social media personas
1409	Detection		T1585.001	Social Media Accounts	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1410	Detection		T1586.001	Social Media Accounts	Social Media	Established, compromised, or otherwise acquired social media personas
1411	Detection		T1586.001	Social Media Accounts	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1412	Detection		T1592.002	Software	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1413	Detection		T1072	Software Deployment Tools	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1414	Detection		T1072	Software Deployment Tools	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1415	Detection		T1518	Software Discovery	Firewall Metadata	Contextual data about a firewall and activity around it such as name, policy, or status
1416	Detection		T1518	Software Discovery	Firewall Enumeration	An extracted list of available firewalls and/or their associated settings/rules (ex: Azure Network Firewall CLI Show commands)
1417	Detection		T1518	Software Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1418	Detection		T1518	Software Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1419	Detection		T1518	Software Discovery	OS API Execution	Operating system function/method calls executed by a process
1420	Detection		T1027.002	Software Packing	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1421	Detection		T1036.006	Space after Filename	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1422	Detection		T1566.001	Spearphishing Attachment	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1423	Detection		T1566.001	Spearphishing Attachment	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1424	Detection		T1566.001	Spearphishing Attachment	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1425	Detection		T1566.001	Spearphishing Attachment	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1426	Detection		T1598.002	Spearphishing Attachment	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1427	Detection		T1598.002	Spearphishing Attachment	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1428	Detection		T1598.002	Spearphishing Attachment	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1429	Detection		T1566.002	Spearphishing Link	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1430	Detection		T1566.002	Spearphishing Link	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1431	Detection		T1566.002	Spearphishing Link	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1432	Detection		T1598.003	Spearphishing Link	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1433	Detection		T1598.003	Spearphishing Link	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1434	Detection		T1598.003	Spearphishing Link	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1435	Detection		T1598.001	Spearphishing Service	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1436	Detection		T1598.001	Spearphishing Service	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1437	Detection		T1598.001	Spearphishing Service	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1438	Detection		T1566.003	Spearphishing via Service	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1439	Detection		T1566.003	Spearphishing via Service	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1440	Detection		T1566.003	Spearphishing via Service	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1441	Detection		T1608	Stage Capabilities	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1442	Detection		T1132.001	Standard Encoding	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1443	Detection		T1037.005	Startup Items	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1444	Detection		T1037.005	Startup Items	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1445	Detection		T1037.005	Startup Items	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1446	Detection		T1037.005	Startup Items	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1447	Detection		T1528	Steal Application Access Token	User Account Modification	Changes made to an account, such as permissions and/or membership in specific groups (ex: Windows EID 4738 or /var/log access/authentication logs)
1448	Detection		T1539	Steal Web Session Cookie	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1449	Detection		T1539	Steal Web Session Cookie	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1450	Detection		T1558	Steal or Forge Kerberos Tickets	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1451	Detection		T1558	Steal or Forge Kerberos Tickets	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1452	Detection		T1558	Steal or Forge Kerberos Tickets	Active Directory Credential Request	A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
1453	Detection		T1558	Steal or Forge Kerberos Tickets	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
1454	Detection		T1027.003	Steganography	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1455	Detection		T1001.002	Steganography	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1456	Detection		T1565.001	Stored Data Manipulation	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1457	Detection		T1565.001	Stored Data Manipulation	File Deletion	Removal of a file (ex: Sysmon EID 23)
1458	Detection		T1565.001	Stored Data Manipulation	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1459	Detection		T1553	Subvert Trust Controls	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
1460	Detection		T1553	Subvert Trust Controls	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1461	Detection		T1553	Subvert Trust Controls	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1462	Detection		T1553	Subvert Trust Controls	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1463	Detection		T1553	Subvert Trust Controls	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1464	Detection		T1553	Subvert Trust Controls	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1465	Detection		T1553	Subvert Trust Controls	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1466	Detection		T1548.003	Sudo and Sudo Caching	Process Metadata	Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
1467	Detection		T1548.003	Sudo and Sudo Caching	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1468	Detection		T1548.003	Sudo and Sudo Caching	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1469	Detection		T1548.003	Sudo and Sudo Caching	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1470	Detection		T1573.001	Symmetric Cryptography	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1471	Detection		T1497.001	System Checks	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1472	Detection		T1497.001	System Checks	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1473	Detection		T1497.001	System Checks	OS API Execution	Operating system function/method calls executed by a process
1474	Detection		T1542.001	System Firmware	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
1475	Detection		T1082	System Information Discovery	Instance Metadata	Contextual data about an instance and activity around it such as name, type, or status
1476	Detection		T1082	System Information Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1477	Detection		T1082	System Information Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1478	Detection		T1082	System Information Discovery	OS API Execution	Operating system function/method calls executed by a process
1479	Detection		T1614.001	System Language Discovery	Windows Registry Key Access	Opening a Registry Key, typically to read the associated value (ex: Windows EID 4656)
1480	Detection		T1614.001	System Language Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1481	Detection		T1614.001	System Language Discovery	OS API Execution	Operating system function/method calls executed by a process
1482	Detection		T1614.001	System Language Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1483	Detection		T1614	System Location Discovery	Instance Metadata	Contextual data about an instance and activity around it such as name, type, or status
1484	Detection		T1614	System Location Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1485	Detection		T1614	System Location Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1486	Detection		T1614	System Location Discovery	OS API Execution	Operating system function/method calls executed by a process
1487	Detection		T1016	System Network Configuration Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1488	Detection		T1016	System Network Configuration Discovery	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
1489	Detection		T1016	System Network Configuration Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1490	Detection		T1016	System Network Configuration Discovery	OS API Execution	Operating system function/method calls executed by a process
1491	Detection		T1049	System Network Connections Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1492	Detection		T1049	System Network Connections Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1493	Detection		T1049	System Network Connections Discovery	OS API Execution	Operating system function/method calls executed by a process
1494	Detection		T1033	System Owner/User Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1495	Detection		T1033	System Owner/User Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1496	Detection		T1007	System Service Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1497	Detection		T1007	System Service Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1498	Detection		T1569	System Services	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1499	Detection		T1569	System Services	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1500	Detection		T1569	System Services	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
1501	Detection		T1569	System Services	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1502	Detection		T1569	System Services	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1503	Detection		T1529	System Shutdown/Reboot	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1504	Detection		T1529	System Shutdown/Reboot	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1505	Detection		T1529	System Shutdown/Reboot	Host Status	Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)
1506	Detection		T1124	System Time Discovery	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1507	Detection		T1124	System Time Discovery	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1508	Detection		T1124	System Time Discovery	OS API Execution	Operating system function/method calls executed by a process
1509	Detection		T1543.002	Systemd Service	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1510	Detection		T1543.002	Systemd Service	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1511	Detection		T1543.002	Systemd Service	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1512	Detection		T1543.002	Systemd Service	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1513	Detection		T1543.002	Systemd Service	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
1514	Detection		T1543.002	Systemd Service	Service Modification	Changes made to a service/daemon, such as changes to name, description, and/or start type (ex: Windows EID 7040 or /var/log daemon logs)
1515	Detection		T1053.006	Systemd Timers	Scheduled Job Creation	Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
1516	Detection		T1053.006	Systemd Timers	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1517	Detection		T1053.006	Systemd Timers	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1518	Detection		T1053.006	Systemd Timers	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1519	Detection		T1542.005	TFTP Boot	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1520	Detection		T1542.005	TFTP Boot	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1521	Detection		T1542.005	TFTP Boot	Firmware Modification	Changes made to firmware, including its settings and/or data, such as MBR (Master Boot Record) and VBR (Volume Boot Record)
1522	Detection		T1080	Taint Shared Content	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1523	Detection		T1080	Taint Shared Content	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1524	Detection		T1080	Taint Shared Content	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1525	Detection		T1080	Taint Shared Content	Network Share Access	Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)
1526	Detection		T1221	Template Injection	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1527	Detection		T1221	Template Injection	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1528	Detection		T1221	Template Injection	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1529	Detection		T1055.003	Thread Execution Hijacking	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
1530	Detection		T1055.003	Thread Execution Hijacking	OS API Execution	Operating system function/method calls executed by a process
1531	Detection		T1055.003	Thread Execution Hijacking	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1532	Detection		T1055.005	Thread Local Storage	Process Modification	Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
1533	Detection		T1055.005	Thread Local Storage	OS API Execution	Operating system function/method calls executed by a process
1534	Detection		T1055.005	Thread Local Storage	Process Access	Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
1535	Detection		T1497.003	Time Based Evasion	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1536	Detection		T1497.003	Time Based Evasion	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1537	Detection		T1497.003	Time Based Evasion	OS API Execution	Operating system function/method calls executed by a process
1538	Detection		T1547.003	Time Providers	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1539	Detection		T1547.003	Time Providers	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1540	Detection		T1547.003	Time Providers	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1541	Detection		T1547.003	Time Providers	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1542	Detection		T1070.006	Timestomp	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1543	Detection		T1070.006	Timestomp	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1544	Detection		T1134.001	Token Impersonation/Theft	OS API Execution	Operating system function/method calls executed by a process
1545	Detection		T1134.001	Token Impersonation/Theft	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1546	Detection		T1588.002	Tool	Malware Metadata	Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
1547	Detection		T1020.001	Traffic Duplication	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1548	Detection		T1020.001	Traffic Duplication	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1549	Detection		T1205	Traffic Signaling	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1550	Detection		T1205	Traffic Signaling	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1551	Detection		T1205	Traffic Signaling	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1552	Detection		T1537	Transfer Data to Cloud Account	Snapshot Creation	Initial construction of a new snapshot (ex: AWS create-snapshot)
1553	Detection		T1537	Transfer Data to Cloud Account	Snapshot Modification	Changes made to a snapshop, such as metadata and control data (ex: AWS modify-snapshot-attribute)
1554	Detection		T1537	Transfer Data to Cloud Account	Cloud Storage Modification	Changes made to cloud storage infrastructure, including its settings and/or data (ex: AWS S3 PutObject or PutObjectAcl)
1555	Detection		T1537	Transfer Data to Cloud Account	Cloud Storage Creation	Initial construction of new cloud storage infrastructure (ex: AWS S3 CreateBucket)
1556	Detection		T1565.002	Transmitted Data Manipulation	OS API Execution	Operating system function/method calls executed by a process
1557	Detection		T1565.002	Transmitted Data Manipulation	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1558	Detection		T1565.002	Transmitted Data Manipulation	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1559	Detection		T1505.002	Transport Agent	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1560	Detection		T1505.002	Transport Agent	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1561	Detection		T1546.005	Trap	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1562	Detection		T1546.005	Trap	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1563	Detection		T1546.005	Trap	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1564	Detection		T1546.005	Trap	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1565	Detection		T1127	Trusted Developer Utilities Proxy Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1566	Detection		T1127	Trusted Developer Utilities Proxy Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1567	Detection		T1199	Trusted Relationship	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1568	Detection		T1199	Trusted Relationship	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
1569	Detection		T1199	Trusted Relationship	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1570	Detection		T1111	Two-Factor Authentication Interception	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1571	Detection		T1111	Two-Factor Authentication Interception	Driver Load	Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)
1572	Detection		T1111	Two-Factor Authentication Interception	OS API Execution	Operating system function/method calls executed by a process
1573	Detection		T1059.004	Unix Shell	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1574	Detection		T1059.004	Unix Shell	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1575	Detection		T1546.004	Unix Shell Configuration Modification	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1576	Detection		T1546.004	Unix Shell Configuration Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1577	Detection		T1546.004	Unix Shell Configuration Modification	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1578	Detection		T1546.004	Unix Shell Configuration Modification	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1579	Detection		T1552	Unsecured Credentials	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1580	Detection		T1552	Unsecured Credentials	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1581	Detection		T1552	Unsecured Credentials	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1582	Detection		T1552	Unsecured Credentials	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1583	Detection		T1552	Unsecured Credentials	Windows Registry Key Access	Opening a Registry Key, typically to read the associated value (ex: Windows EID 4656)
1584	Detection		T1535	Unused/Unsupported Cloud Regions	Instance Creation	Initial construction of a new instance (ex: instance.insert within GCP Audit Logs)
1585	Detection		T1608.001	Upload Malware	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1586	Detection		T1608.002	Upload Tool	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1587	Detection		T1550	Use Alternate Authentication Material	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1588	Detection		T1550	Use Alternate Authentication Material	Web Credential Usage	An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)
1589	Detection		T1550	Use Alternate Authentication Material	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1590	Detection		T1550	Use Alternate Authentication Material	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1591	Detection		T1550	Use Alternate Authentication Material	Active Directory Credential Request	A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
1592	Detection		T1497.002	User Activity Based Checks	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1593	Detection		T1497.002	User Activity Based Checks	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1594	Detection		T1497.002	User Activity Based Checks	OS API Execution	Operating system function/method calls executed by a process
1595	Detection		T1204	User Execution	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1596	Detection		T1204	User Execution	Instance Start	Activation or invocation of an instance (ex: instance.start within GCP Audit Logs)
1597	Detection		T1204	User Execution	Instance Creation	Initial construction of a new instance (ex: instance.insert within GCP Audit Logs)
1598	Detection		T1204	User Execution	Image Creation	Initial construction of a virtual machine image (ex: Azure Compute Service Images PUT)
1599	Detection		T1204	User Execution	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1600	Detection		T1204	User Execution	Container Start	Activation or invocation of a container (ex: docker start or docker restart)
1601	Detection		T1204	User Execution	Container Creation	Initial construction of a new container (ex: docker create <container_name>)
1602	Detection		T1204	User Execution	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1603	Detection		T1204	User Execution	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1604	Detection		T1204	User Execution	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1605	Detection		T1204	User Execution	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1606	Detection		T1564.007	VBA Stomping	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
1607	Detection		T1564.007	VBA Stomping	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1608	Detection		T1055.014	VDSO Hijacking	OS API Execution	Operating system function/method calls executed by a process
1609	Detection		T1055.014	VDSO Hijacking	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1610	Detection		T1021.005	VNC	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1611	Detection		T1021.005	VNC	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1612	Detection		T1021.005	VNC	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1613	Detection		T1078	Valid Accounts	Logon Session Metadata	Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
1614	Detection		T1078	Valid Accounts	User Account Authentication	An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log)
1615	Detection		T1078	Valid Accounts	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1616	Detection		T1218.012	Verclsid	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1617	Detection		T1218.012	Verclsid	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1618	Detection		T1125	Video Capture	OS API Execution	Operating system function/method calls executed by a process
1619	Detection		T1125	Video Capture	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1620	Detection		T1583.003	Virtual Private Server	Response Metadata	Contextual data about an Internet-facing resource gathered from a scan, such as running services or ports
1621	Detection		T1583.003	Virtual Private Server	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1622	Detection		T1584.003	Virtual Private Server	Response Metadata	Contextual data about an Internet-facing resource gathered from a scan, such as running services or ports
1623	Detection		T1584.003	Virtual Private Server	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1624	Detection		T1497	Virtualization/Sandbox Evasion	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1625	Detection		T1497	Virtualization/Sandbox Evasion	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1626	Detection		T1497	Virtualization/Sandbox Evasion	OS API Execution	Operating system function/method calls executed by a process
1627	Detection		T1059.005	Visual Basic	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1628	Detection		T1059.005	Visual Basic	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1629	Detection		T1059.005	Visual Basic	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1630	Detection		T1059.005	Visual Basic	Script Execution	Launching a list of commands through a script file (ex: Windows EID 4104)
1631	Detection		T1595.002	Vulnerability Scanning	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1632	Detection		T1595.002	Vulnerability Scanning	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1633	Detection		T1600	Weaken Encryption	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1634	Detection		T1606.001	Web Cookies	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1635	Detection		T1606.001	Web Cookies	Web Credential Creation	Initial construction of new web credential material (ex: Windows EID 1200 or 4769)
1636	Detection		T1606.001	Web Cookies	Web Credential Usage	An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)
1637	Detection		T1056.003	Web Portal Capture	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1638	Detection		T1071.001	Web Protocols	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1639	Detection		T1071.001	Web Protocols	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1640	Detection		T1102	Web Service	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1641	Detection		T1102	Web Service	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1642	Detection		T1102	Web Service	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1643	Detection		T1583.006	Web Services	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1644	Detection		T1584.006	Web Services	Response Content	Logged network traffic in response to a scan showing both protocol header and body values
1645	Detection		T1550.004	Web Session Cookie	Web Credential Usage	An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)
1646	Detection		T1550.004	Web Session Cookie	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1647	Detection		T1505.003	Web Shell	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1648	Detection		T1505.003	Web Shell	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1649	Detection		T1505.003	Web Shell	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1650	Detection		T1505.003	Web Shell	Network Traffic Content	Logged network traffic data showing both protocol header and body values (ex: PCAP)
1651	Detection		T1505.003	Web Shell	Network Traffic Flow	Summarized network packet data, with metrics, such as protocol headers and volume (ex: Netflow or Zeek http.log)
1652	Detection		T1505.003	Web Shell	Application Log Content	Logging, messaging, and other artifacts provided by third-party services (ex: metrics, errors, and/or alerts from mail/web applications)
1653	Detection		T1059.003	Windows Command Shell	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1654	Detection		T1059.003	Windows Command Shell	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1655	Detection		T1555.004	Windows Credential Manager	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1656	Detection		T1555.004	Windows Credential Manager	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1657	Detection		T1555.004	Windows Credential Manager	OS API Execution	Operating system function/method calls executed by a process
1658	Detection		T1555.004	Windows Credential Manager	File Access	Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)
1659	Detection		T1222.001	Windows File and Directory Permissions Modification	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1660	Detection		T1222.001	Windows File and Directory Permissions Modification	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1661	Detection		T1222.001	Windows File and Directory Permissions Modification	Active Directory Object Modification	Changes made to an active directory object (ex: Windows EID 5163 or 5136)
1662	Detection		T1222.001	Windows File and Directory Permissions Modification	File Metadata	Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc.
1663	Detection		T1047	Windows Management Instrumentation	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1664	Detection		T1047	Windows Management Instrumentation	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1665	Detection		T1047	Windows Management Instrumentation	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1666	Detection		T1546.003	Windows Management Instrumentation Event Subscription	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1667	Detection		T1546.003	Windows Management Instrumentation Event Subscription	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1668	Detection		T1546.003	Windows Management Instrumentation Event Subscription	WMI Creation	Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21)
1669	Detection		T1021.006	Windows Remote Management	Service Metadata	Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
1670	Detection		T1021.006	Windows Remote Management	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1671	Detection		T1021.006	Windows Remote Management	Network Connection Creation	Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log)
1672	Detection		T1021.006	Windows Remote Management	Logon Session Creation	Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp)
1673	Detection		T1021.006	Windows Remote Management	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1674	Detection		T1543.003	Windows Service	Service Creation	Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)
1675	Detection		T1543.003	Windows Service	Service Modification	Changes made to a service/daemon, such as changes to name, description, and/or start type (ex: Windows EID 7040 or /var/log daemon logs)
1676	Detection		T1543.003	Windows Service	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1677	Detection		T1543.003	Windows Service	OS API Execution	Operating system function/method calls executed by a process
1678	Detection		T1543.003	Windows Service	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1679	Detection		T1543.003	Windows Service	Windows Registry Key Creation	Initial construction of a new Registry Key (ex: Windows EID 4656 or Sysmon EID 12)
1680	Detection		T1543.003	Windows Service	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1681	Detection		T1547.004	Winlogon Helper DLL	Windows Registry Key Modification	Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)
1682	Detection		T1547.004	Winlogon Helper DLL	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)
1683	Detection		T1547.004	Winlogon Helper DLL	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1684	Detection		T1547.013	XDG Autostart Entries	File Creation	Initial construction of a new file (ex: Sysmon EID 11)
1685	Detection		T1547.013	XDG Autostart Entries	File Modification	Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)
1686	Detection		T1547.013	XDG Autostart Entries	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1687	Detection		T1547.013	XDG Autostart Entries	Command Execution	Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history)
1688	Detection		T1220	XSL Script Processing	Process Creation	Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
1689	Detection		T1220	XSL Script Processing	Module Load	Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)