Playbook.schema.json

{
   "$defs": {
      "DefendTechnique": {
         "description": "List of Supported D3FEND Techniques.",
         "enum": [
            "D3-AA",
            "D3-ABPI",
            "D3-ACA",
            "D3-ACH",
            "D3-AH",
            "D3-AI",
            "D3-AL",
            "D3-ALLM",
            "D3-AM",
            "D3-AMED",
            "D3-ANAA",
            "D3-ANCI",
            "D3-ANET",
            "D3-APA",
            "D3-APLM",
            "D3-AVE",
            "D3-AZET",
            "D3-BA",
            "D3-BAN",
            "D3-BDI",
            "D3-BSE",
            "D3-CA",
            "D3-CAA",
            "D3-CBAN",
            "D3-CCSA",
            "D3-CE",
            "D3-CERO",
            "D3-CF",
            "D3-CFC",
            "D3-CH",
            "D3-CHN",
            "D3-CI",
            "D3-CIA",
            "D3-CM",
            "D3-CNE",
            "D3-CNR",
            "D3-CNS",
            "D3-CP",
            "D3-CQ",
            "D3-CR",
            "D3-CRO",
            "D3-CS",
            "D3-CSPP",
            "D3-CTS",
            "D3-CV",
            "D3-DA",
            "D3-DAM",
            "D3-DCE",
            "D3-DE",
            "D3-DEM",
            "D3-DENCR",
            "D3-DF",
            "D3-DI",
            "D3-DKE",
            "D3-DKF",
            "D3-DKP",
            "D3-DLIC",
            "D3-DNR",
            "D3-DNRA",
            "D3-DNSAL",
            "D3-DNSCE",
            "D3-DNSDL",
            "D3-DNSTA",
            "D3-DO",
            "D3-DP",
            "D3-DPLM",
            "D3-DPR",
            "D3-DQSA",
            "D3-DRT",
            "D3-DST",
            "D3-DTP",
            "D3-DUC",
            "D3-EAL",
            "D3-EBWSAM",
            "D3-EDL",
            "D3-EF",
            "D3-EFA",
            "D3-EHB",
            "D3-EHPV",
            "D3-EI",
            "D3-ER",
            "D3-ET",
            "D3-FA",
            "D3-FAPA",
            "D3-FBA",
            "D3-FC",
            "D3-FCA",
            "D3-FCDC",
            "D3-FCOA",
            "D3-FCR",
            "D3-FE",
            "D3-FEMC",
            "D3-FEV",
            "D3-FFV",
            "D3-FH",
            "D3-FHRA",
            "D3-FIM",
            "D3-FISV",
            "D3-FMBV",
            "D3-FMCV",
            "D3-FMVV",
            "D3-FRDDL",
            "D3-FRIDL",
            "D3-FV",
            "D3-HBPI",
            "D3-HCI",
            "D3-HD",
            "D3-HDDL",
            "D3-HDL",
            "D3-HR",
            "D3-HS",
            "D3-IAA",
            "D3-IBCA",
            "D3-ID",
            "D3-IDA",
            "D3-IHN",
            "D3-IOPR",
            "D3-IPCTA",
            "D3-IPRA",
            "D3-IRA",
            "D3-IRV",
            "D3-ISVA",
            "D3-ITF",
            "D3-JFAPA",
            "D3-KBPI",
            "D3-LAM",
            "D3-LAMED",
            "D3-LFAM",
            "D3-LFP",
            "D3-LLM",
            "D3-MA",
            "D3-MAN",
            "D3-MBSV",
            "D3-MBT",
            "D3-MENCR",
            "D3-MFA",
            "D3-MH",
            "D3-NAM",
            "D3-NI",
            "D3-NM",
            "D3-NNI",
            "D3-NPC",
            "D3-NRAM",
            "D3-NTA",
            "D3-NTCD",
            "D3-NTF",
            "D3-NTPM",
            "D3-NTSA",
            "D3-NVA",
            "D3-OAM",
            "D3-ODM",
            "D3-OE",
            "D3-OM",
            "D3-ORA",
            "D3-OSM",
            "D3-OTF",
            "D3-OTP",
            "D3-PA",
            "D3-PAM",
            "D3-PAN",
            "D3-PBWSAM",
            "D3-PCA",
            "D3-PCSV",
            "D3-PE",
            "D3-PFV",
            "D3-PH",
            "D3-PHDURA",
            "D3-PLA",
            "D3-PLLM",
            "D3-PLM",
            "D3-PM",
            "D3-PMAD",
            "D3-PR",
            "D3-PS",
            "D3-PSA",
            "D3-PSEP",
            "D3-PSMD",
            "D3-PT",
            "D3-PV",
            "D3-PWA",
            "D3-RA",
            "D3-RAM",
            "D3-RAPA",
            "D3-RC",
            "D3-RD",
            "D3-RDI",
            "D3-RE",
            "D3-RF",
            "D3-RFAM",
            "D3-RFS",
            "D3-RIC",
            "D3-RKD",
            "D3-RN",
            "D3-RNA",
            "D3-RO",
            "D3-RPA",
            "D3-RRID",
            "D3-RS",
            "D3-RTA",
            "D3-RTSD",
            "D3-RUAA",
            "D3-SAOR",
            "D3-SBV",
            "D3-SCA",
            "D3-SCF",
            "D3-SCH",
            "D3-SCP",
            "D3-SDA",
            "D3-SDM",
            "D3-SEA",
            "D3-SFA",
            "D3-SFCV",
            "D3-SFV",
            "D3-SHN",
            "D3-SICA",
            "D3-SJA",
            "D3-SMRA",
            "D3-SPP",
            "D3-SRA",
            "D3-SSC",
            "D3-ST",
            "D3-SU",
            "D3-SVCDM",
            "D3-SWI",
            "D3-SYSDM",
            "D3-SYSM",
            "D3-SYSVA",
            "D3-TAAN",
            "D3-TB",
            "D3-TBA",
            "D3-TBI",
            "D3-TL",
            "D3-UA",
            "D3-UAP",
            "D3-UBA",
            "D3-UDTA",
            "D3-UGLPA",
            "D3-ULA",
            "D3-URA",
            "D3-USICA",
            "D3-VI",
            "D3-VTV",
            "D3-WSAA",
            "D3-WSAM"
         ],
         "title": "DefendTechnique",
         "type": "string"
      },
      "EventBasedDetectionEnum": {
         "description": "Empty Placeholder Enum for baselines.\n\nNOTE: This enum is dynamically populated at runtime by the EventBasedDetection.UpdateDynamicEnum method.",
         "enum": [
            "3CX Supply Chain Attack Network Indicators",
            "7zip CommandLine To SMB Share Path",
            "ASL AWS Concurrent Sessions From Different Ips",
            "ASL AWS Create Access Key",
            "ASL AWS Create Policy Version to allow all resources",
            "ASL AWS Credential Access GetPasswordData",
            "ASL AWS Credential Access RDS Password reset",
            "ASL AWS Defense Evasion Delete CloudWatch Log Group",
            "ASL AWS Defense Evasion Delete Cloudtrail",
            "ASL AWS Defense Evasion Impair Security Services",
            "ASL AWS Defense Evasion PutBucketLifecycle",
            "ASL AWS Defense Evasion Stop Logging Cloudtrail",
            "ASL AWS Defense Evasion Update Cloudtrail",
            "ASL AWS Detect Users creating keys with encrypt policy without MFA",
            "ASL AWS Disable Bucket Versioning",
            "ASL AWS EC2 Snapshot Shared Externally",
            "ASL AWS ECR Container Upload Outside Business Hours",
            "ASL AWS ECR Container Upload Unknown User",
            "ASL AWS IAM AccessDenied Discovery Events",
            "ASL AWS IAM Assume Role Policy Brute Force",
            "ASL AWS IAM Delete Policy",
            "ASL AWS IAM Failure Group Deletion",
            "ASL AWS IAM Successful Group Deletion",
            "ASL AWS Multi-Factor Authentication Disabled",
            "ASL AWS Network Access Control List Created with All Open Ports",
            "ASL AWS Network Access Control List Deleted",
            "ASL AWS New MFA Method Registered For User",
            "ASL AWS SAML Update identity provider",
            "ASL AWS UpdateLoginProfile",
            "AWS AMI Attribute Modification for Exfiltration",
            "AWS Bedrock Claude Cross Region Possible Inference Abuse",
            "AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation",
            "AWS Bedrock Claude Hostile Prompt Sentiment",
            "AWS Bedrock Claude Possible Prompt Injection",
            "AWS Bedrock Claude Sensitive Data in Prompts",
            "AWS Bedrock Claude Unusually Large Prompts",
            "AWS Bedrock Claude excessive use of tokens",
            "AWS Bedrock Delete GuardRails",
            "AWS Bedrock Delete Knowledge Base",
            "AWS Bedrock Delete Model Invocation Logging Configuration",
            "AWS Bedrock High Number List Foundation Model Failures",
            "AWS Bedrock Invoke Model Access Denied",
            "AWS Concurrent Sessions From Different Ips",
            "AWS Console Login Failed During MFA Challenge",
            "AWS Create Policy Version to allow all resources",
            "AWS CreateAccessKey",
            "AWS CreateLoginProfile",
            "AWS Credential Access Failed Login",
            "AWS Credential Access GetPasswordData",
            "AWS Credential Access RDS Password reset",
            "AWS Defense Evasion Delete CloudWatch Log Group",
            "AWS Defense Evasion Delete Cloudtrail",
            "AWS Defense Evasion Impair Security Services",
            "AWS Defense Evasion PutBucketLifecycle",
            "AWS Defense Evasion Stop Logging Cloudtrail",
            "AWS Defense Evasion Update Cloudtrail",
            "AWS Detect Users creating keys with encrypt policy without MFA",
            "AWS Detect Users with KMS keys performing encryption S3",
            "AWS Disable Bucket Versioning",
            "AWS EC2 Snapshot Shared Externally",
            "AWS ECR Container Scanning Findings High",
            "AWS ECR Container Scanning Findings Low Informational Unknown",
            "AWS ECR Container Scanning Findings Medium",
            "AWS ECR Container Upload Outside Business Hours",
            "AWS ECR Container Upload Unknown User",
            "AWS Excessive Security Scanning",
            "AWS Exfiltration via Anomalous GetObject API Activity",
            "AWS Exfiltration via Batch Service",
            "AWS Exfiltration via Bucket Replication",
            "AWS Exfiltration via DataSync Task",
            "AWS Exfiltration via EC2 Snapshot",
            "AWS High Number Of Failed Authentications For User",
            "AWS High Number Of Failed Authentications From Ip",
            "AWS IAM AccessDenied Discovery Events",
            "AWS IAM Assume Role Policy Brute Force",
            "AWS IAM Delete Policy",
            "AWS IAM Failure Group Deletion",
            "AWS IAM Successful Group Deletion",
            "AWS Lambda UpdateFunctionCode",
            "AWS Multi-Factor Authentication Disabled",
            "AWS Multiple Failed MFA Requests For User",
            "AWS Multiple Users Failing To Authenticate From Ip",
            "AWS Network Access Control List Created with All Open Ports",
            "AWS Network Access Control List Deleted",
            "AWS New MFA Method Registered For User",
            "AWS Password Policy Changes",
            "AWS S3 Exfiltration Behavior Identified",
            "AWS SAML Update identity provider",
            "AWS SetDefaultPolicyVersion",
            "AWS Successful Console Authentication From Multiple IPs",
            "AWS Successful Single-Factor Authentication",
            "AWS Unusual Number of Failed Authentications From Ip",
            "AWS UpdateLoginProfile",
            "Access LSASS Memory for Dump Creation",
            "Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint",
            "Active Directory Lateral Movement Identified",
            "Active Directory Privilege Escalation Identified",
            "Active Setup Registry Autostart",
            "Add DefaultUser And Password In Registry",
            "Add or Set Windows Defender Exclusion",
            "Adobe ColdFusion Access Control Bypass",
            "Adobe ColdFusion Unauthenticated Arbitrary File Read",
            "AdsiSearcher Account Discovery",
            "Advanced IP or Port Scanner Execution",
            "Allow File And Printing Sharing In Firewall",
            "Allow Inbound Traffic By Firewall Rule Registry",
            "Allow Inbound Traffic In Firewall Rule",
            "Allow Network Discovery In Firewall",
            "Allow Operation with Consent Admin",
            "Amazon EKS Kubernetes Pod scan detection",
            "Amazon EKS Kubernetes cluster scan detection",
            "Anomalous usage of 7zip",
            "Attacker Tools On Endpoint",
            "Auto Admin Logon Registry Entry",
            "Azure AD Admin Consent Bypassed by Service Principal",
            "Azure AD Application Administrator Role Assigned",
            "Azure AD Authentication Failed During MFA Challenge",
            "Azure AD AzureHound UserAgent Detected",
            "Azure AD Block User Consent For Risky Apps Disabled",
            "Azure AD Concurrent Sessions From Different Ips",
            "Azure AD Device Code Authentication",
            "Azure AD External Guest User Invited",
            "Azure AD FullAccessAsApp Permission Assigned",
            "Azure AD Global Administrator Role Assigned",
            "Azure AD High Number Of Failed Authentications For User",
            "Azure AD High Number Of Failed Authentications From Ip",
            "Azure AD Multi-Factor Authentication Disabled",
            "Azure AD Multi-Source Failed Authentications Spike",
            "Azure AD Multiple AppIDs and UserAgents Authentication Spike",
            "Azure AD Multiple Denied MFA Requests For User",
            "Azure AD Multiple Failed MFA Requests For User",
            "Azure AD Multiple Service Principals Created by SP",
            "Azure AD Multiple Service Principals Created by User",
            "Azure AD Multiple Users Failing To Authenticate From Ip",
            "Azure AD New Custom Domain Added",
            "Azure AD New Federated Domain Added",
            "Azure AD New MFA Method Registered",
            "Azure AD New MFA Method Registered For User",
            "Azure AD OAuth Application Consent Granted By User",
            "Azure AD PIM Role Assigned",
            "Azure AD PIM Role Assignment Activated",
            "Azure AD Privileged Authentication Administrator Role Assigned",
            "Azure AD Privileged Graph API Permission Assigned",
            "Azure AD Privileged Role Assigned",
            "Azure AD Privileged Role Assigned to Service Principal",
            "Azure AD Service Principal Authentication",
            "Azure AD Service Principal Created",
            "Azure AD Service Principal Enumeration",
            "Azure AD Service Principal New Client Credentials",
            "Azure AD Service Principal Owner Added",
            "Azure AD Service Principal Privilege Escalation",
            "Azure AD Successful Authentication From Different Ips",
            "Azure AD Successful PowerShell Authentication",
            "Azure AD Successful Single-Factor Authentication",
            "Azure AD Tenant Wide Admin Consent Granted",
            "Azure AD Unusual Number of Failed Authentications From Ip",
            "Azure AD User Consent Blocked for Risky Application",
            "Azure AD User Consent Denied for OAuth Application",
            "Azure AD User Enabled And Password Reset",
            "Azure AD User ImmutableId Attribute Updated",
            "Azure Active Directory High Risk Sign-in",
            "Azure Automation Account Created",
            "Azure Automation Runbook Created",
            "Azure Runbook Webhook Created",
            "BCDEdit Failure Recovery Modification",
            "BITS Job Persistence",
            "BITSAdmin Download File",
            "Batch File Write to System32",
            "Bcdedit Command Back To Normal Mode Boot",
            "CMD Carry Out String Command Parameter",
            "CMD Echo Pipe - Escalation",
            "CMLUA Or CMSTPLUA UAC Bypass",
            "CSC Net On The Fly Compilation",
            "CertUtil With Decode Argument",
            "Certutil exe certificate extraction",
            "Change To Safe Mode With Network Config",
            "Check Elevated CMD using whoami",
            "Child Processes of Spoolsv exe",
            "Circle CI Disable Security Job",
            "Circle CI Disable Security Step",
            "Cisco AI Defense Security Alerts by Application Name",
            "Cisco ASA - AAA Policy Tampering",
            "Cisco ASA - Core Syslog Message Volume Drop",
            "Cisco ASA - Device File Copy Activity",
            "Cisco ASA - Device File Copy to Remote Location",
            "Cisco ASA - Logging Disabled via CLI",
            "Cisco ASA - Logging Filters Configuration Tampering",
            "Cisco ASA - Logging Message Suppression",
            "Cisco ASA - New Local User Account Created",
            "Cisco ASA - Packet Capture Activity",
            "Cisco ASA - Reconnaissance Command Activity",
            "Cisco ASA - User Account Deleted From Local Database",
            "Cisco ASA - User Account Lockout Threshold Exceeded",
            "Cisco ASA - User Privilege Level Change",
            "Cisco Configuration Archive Logging Analysis",
            "Cisco Duo Admin Login Unusual Browser",
            "Cisco Duo Admin Login Unusual Country",
            "Cisco Duo Admin Login Unusual Os",
            "Cisco Duo Bulk Policy Deletion",
            "Cisco Duo Bypass Code Generation",
            "Cisco Duo Policy Allow Devices Without Screen Lock",
            "Cisco Duo Policy Allow Network Bypass 2FA",
            "Cisco Duo Policy Allow Old Flash",
            "Cisco Duo Policy Allow Old Java",
            "Cisco Duo Policy Allow Tampered Devices",
            "Cisco Duo Policy Bypass 2FA",
            "Cisco Duo Policy Deny Access",
            "Cisco Duo Policy Skip 2FA for Other Countries",
            "Cisco Duo Set User Status to Bypass 2FA",
            "Cisco IOS Suspicious Privileged Account Creation",
            "Cisco IOS XE Guestshell Activation and Destroy",
            "Cisco IOS XE Implant Access",
            "Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal",
            "Cisco IOS XE Reconnaissance Command Activity",
            "Cisco IOS XE Remote Access Probe Burst",
            "Cisco IOS XE Request Platform Package Describe Shell Pattern",
            "Cisco IOS XE Tunnel Interface Configuration",
            "Cisco IOS XE VTY Access Class Tampering",
            "Cisco IOS XE WebUI Login From IOSd Local Port",
            "Cisco IOS XE WebUI Programmatic Configuration",
            "Cisco Isovalent - Access To Cloud Metadata Service",
            "Cisco Isovalent - Cron Job Creation",
            "Cisco Isovalent - Curl Execution With Insecure Flags",
            "Cisco Isovalent - Kprobe Spike",
            "Cisco Isovalent - Late Process Execution",
            "Cisco Isovalent - Non Allowlisted Image Use",
            "Cisco Isovalent - Nsenter Usage in Kubernetes Pod",
            "Cisco Isovalent - Pods Running Offensive Tools",
            "Cisco Isovalent - Potential Escape to Host",
            "Cisco Isovalent - Shell Execution",
            "Cisco NVM - Curl Execution With Insecure Flags",
            "Cisco NVM - Installation of Typosquatted Python Package",
            "Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI",
            "Cisco NVM - Non-Network Binary Making Network Connection",
            "Cisco NVM - Outbound Connection to Suspicious Port",
            "Cisco NVM - Rclone Execution With Network Activity",
            "Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download",
            "Cisco NVM - Susp Script From Archive Triggering Network Activity",
            "Cisco NVM - Suspicious Download From File Sharing Website",
            "Cisco NVM - Suspicious File Download via Headless Browser",
            "Cisco NVM - Suspicious Network Connection From Process With No Args",
            "Cisco NVM - Suspicious Network Connection Initiated via MsXsl",
            "Cisco NVM - Suspicious Network Connection to IP Lookup Service API",
            "Cisco NVM - Webserver Download From File Sharing Website",
            "Cisco Network Interface Modifications",
            "Cisco Privileged Account Creation with HTTP Command Execution",
            "Cisco Privileged Account Creation with Suspicious SSH Activity",
            "Cisco SA - Access to Anonymizer Services",
            "Cisco SA - Automated Web Reconnaissance via HTTP Access Errors",
            "Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity",
            "Cisco SD-WAN - Low Frequency Rogue Peer",
            "Cisco SD-WAN - Peering Activity",
            "Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity",
            "Cisco SD-WAN Multiple SSH key Authentication from Same Source",
            "Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication",
            "Cisco SNMP Community String Configuration Changes",
            "Cisco Secure Firewall - Binary File Type Download",
            "Cisco Secure Firewall - Bits Network Activity",
            "Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint",
            "Cisco Secure Firewall - Blocked Connection",
            "Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt",
            "Cisco Secure Firewall - Communication Over Suspicious Ports",
            "Cisco Secure Firewall - Connection to File Sharing Domain",
            "Cisco Secure Firewall - File Download Over Uncommon Port",
            "Cisco Secure Firewall - High EVE Threat Confidence",
            "Cisco Secure Firewall - High Priority Intrusion Classification",
            "Cisco Secure Firewall - High Volume of Intrusion Events Per Host",
            "Cisco Secure Firewall - Intrusion Events by Threat Activity",
            "Cisco Secure Firewall - Lumma Stealer Activity",
            "Cisco Secure Firewall - Lumma Stealer Download Attempt",
            "Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt",
            "Cisco Secure Firewall - Malware File Downloaded",
            "Cisco Secure Firewall - Oracle E-Business Suite Correlation",
            "Cisco Secure Firewall - Oracle E-Business Suite Exploitation",
            "Cisco Secure Firewall - Possibly Compromised Host",
            "Cisco Secure Firewall - Potential Data Exfiltration",
            "Cisco Secure Firewall - Privileged Command Execution via HTTP",
            "Cisco Secure Firewall - Rare Snort Rule Triggered",
            "Cisco Secure Firewall - React Server Components RCE Attempt",
            "Cisco Secure Firewall - Remote Access Software Usage Traffic",
            "Cisco Secure Firewall - Repeated Blocked Connections",
            "Cisco Secure Firewall - Repeated Malware Downloads",
            "Cisco Secure Firewall - SSH Connection to Non-Standard Port",
            "Cisco Secure Firewall - SSH Connection to sshd_operns",
            "Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts",
            "Cisco Secure Firewall - Static Tundra Smart Install Abuse",
            "Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity",
            "Cisco Secure Firewall - Wget or Curl Download",
            "Cisco Smart Install Oversized Packet Detection",
            "Cisco Smart Install Port Discovery and Status",
            "Cisco TFTP Server Configuration for Data Exfiltration",
            "Citrix ADC Exploitation CVE-2023-3519",
            "Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure",
            "Citrix ADC and Gateway Unauthorized Data Disclosure",
            "Citrix ShareFile Exploitation CVE-2023-24489",
            "Clear Unallocated Sector Using Cipher App",
            "Clop Common Exec Parameter",
            "Clop Ransomware Known Service Name",
            "Cloud API Calls From Previously Unseen User Roles",
            "Cloud Compute Instance Created By Previously Unseen User",
            "Cloud Compute Instance Created In Previously Unused Region",
            "Cloud Compute Instance Created With Previously Unseen Image",
            "Cloud Compute Instance Created With Previously Unseen Instance Type",
            "Cloud Instance Modified By Previously Unseen User",
            "Cloud Provisioning Activity From Previously Unseen City",
            "Cloud Provisioning Activity From Previously Unseen Country",
            "Cloud Provisioning Activity From Previously Unseen IP Address",
            "Cloud Provisioning Activity From Previously Unseen Region",
            "Cloud Security Groups Modifications by User",
            "Common Ransomware Extensions",
            "Common Ransomware Notes",
            "Confluence CVE-2023-22515 Trigger Vulnerability",
            "Confluence Data Center and Server Privilege Escalation",
            "Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527",
            "Confluence Unauthenticated Remote Code Execution CVE-2022-26134",
            "ConnectWise ScreenConnect Authentication Bypass",
            "ConnectWise ScreenConnect Path Traversal",
            "ConnectWise ScreenConnect Path Traversal Windows SACL",
            "Conti Common Exec parameter",
            "Control Loading from World Writable Directory",
            "Create Remote Thread In Shell Application",
            "Create Remote Thread into LSASS",
            "Create or delete windows shares using net exe",
            "Creation of Shadow Copy",
            "Creation of Shadow Copy with wmic and powershell",
            "Creation of lsass Dump with Taskmgr",
            "Credential Dumping via Copy Command from Shadow Copy",
            "Credential Dumping via Symlink to Shadow Copy",
            "CrowdStrike Falcon Stream Alerts",
            "Crowdstrike Admin Weak Password Policy",
            "Crowdstrike Admin With Duplicate Password",
            "Crowdstrike High Identity Risk Severity",
            "Crowdstrike Medium Identity Risk Severity",
            "Crowdstrike Medium Severity Alert",
            "Crowdstrike Multiple LOW Severity Alerts",
            "Crowdstrike Privilege Escalation For Non-Admin User",
            "Crowdstrike User Weak Password Policy",
            "Crowdstrike User with Duplicate Password",
            "CrushFTP Authentication Bypass Exploitation",
            "CrushFTP Max Simultaneous Users From IP",
            "CrushFTP Server Side Template Injection",
            "Curl Execution with Percent Encoded URL",
            "DLLHost with no Command Line Arguments with Network",
            "DNS Exfiltration Using Nslookup App",
            "DNS Kerberos Coercion",
            "DNS Query Length With High Standard Deviation",
            "DSQuery Domain Discovery",
            "Delete ShadowCopy With PowerShell",
            "Deleting Shadow Copies",
            "Detect ARP Poisoning",
            "Detect AWS Console Login by New User",
            "Detect AWS Console Login by User from New City",
            "Detect AWS Console Login by User from New Country",
            "Detect AWS Console Login by User from New Region",
            "Detect AzureHound Command-Line Arguments",
            "Detect AzureHound File Modifications",
            "Detect Baron Samedit CVE-2021-3156",
            "Detect Baron Samedit CVE-2021-3156 Segfault",
            "Detect Baron Samedit CVE-2021-3156 via OSQuery",
            "Detect Certify Command Line Arguments",
            "Detect Certify With PowerShell Script Block Logging",
            "Detect Certipy File Modifications",
            "Detect Computer Changed with Anonymous Account",
            "Detect Copy of ShadowCopy with Script Block Logging",
            "Detect Credential Dumping through LSASS access",
            "Detect DNS Query to Decommissioned S3 Bucket",
            "Detect Distributed Password Spray Attempts",
            "Detect Empire with PowerShell Script Block Logging",
            "Detect Excessive Account Lockouts From Endpoint",
            "Detect Excessive User Account Lockouts",
            "Detect Exchange Web Shell",
            "Detect F5 TMUI RCE CVE-2020-5902",
            "Detect GCP Storage access from a new IP",
            "Detect HTML Help Renamed",
            "Detect HTML Help Spawn Child Process",
            "Detect HTML Help URL in Command Line",
            "Detect HTML Help Using InfoTech Storage Handlers",
            "Detect IPv6 Network Infrastructure Threats",
            "Detect Large ICMP Traffic",
            "Detect MSHTA Url in Command Line",
            "Detect Mimikatz With PowerShell Script Block Logging",
            "Detect New Local Admin account",
            "Detect New Login Attempts to Routers",
            "Detect New Open GCP Storage Buckets",
            "Detect New Open S3 Buckets over AWS CLI",
            "Detect New Open S3 buckets",
            "Detect Outbound LDAP Traffic",
            "Detect Outbound SMB Traffic",
            "Detect Outlook exe writing a zip file",
            "Detect Password Spray Attack Behavior From Source",
            "Detect Password Spray Attack Behavior On User",
            "Detect Password Spray Attempts",
            "Detect Path Interception By Creation Of program exe",
            "Detect Port Security Violation",
            "Detect Prohibited Applications Spawning cmd exe",
            "Detect PsExec With accepteula Flag",
            "Detect RClone Command-Line Usage",
            "Detect RTLO In File Name",
            "Detect RTLO In Process",
            "Detect Rare Executables",
            "Detect Regasm Spawning a Process",
            "Detect Regasm with Network Connection",
            "Detect Regasm with no Command Line Arguments",
            "Detect Regsvcs Spawning a Process",
            "Detect Regsvcs with Network Connection",
            "Detect Regsvcs with No Command Line Arguments",
            "Detect Regsvr32 Application Control Bypass",
            "Detect Remote Access Software Usage DNS",
            "Detect Remote Access Software Usage File",
            "Detect Remote Access Software Usage FileInfo",
            "Detect Remote Access Software Usage Process",
            "Detect Remote Access Software Usage Registry",
            "Detect Remote Access Software Usage Traffic",
            "Detect Remote Access Software Usage URL",
            "Detect Renamed 7-Zip",
            "Detect Renamed PSExec",
            "Detect Renamed RClone",
            "Detect Renamed WinRAR",
            "Detect Rogue DHCP Server",
            "Detect Rundll32 Inline HTA Execution",
            "Detect S3 access from a new IP",
            "Detect SNICat SNI Exfiltration",
            "Detect SharpHound Command-Line Arguments",
            "Detect SharpHound File Modifications",
            "Detect SharpHound Usage",
            "Detect Software Download To Network Device",
            "Detect Spike in AWS Security Hub Alerts for EC2 Instance",
            "Detect Spike in AWS Security Hub Alerts for User",
            "Detect Spike in S3 Bucket deletion",
            "Detect Spike in blocked Outbound Traffic from your AWS",
            "Detect Traffic Mirroring",
            "Detect Unauthorized Assets by MAC address",
            "Detect Use of cmd exe to Launch Script Interpreters",
            "Detect WMI Event Subscription Persistence",
            "Detect Web Access to Decommissioned S3 Bucket",
            "Detect Windows DNS SIGRed via Splunk Stream",
            "Detect Windows DNS SIGRed via Zeek",
            "Detect Zerologon via Zeek",
            "Detect attackers scanning for vulnerable JBoss servers",
            "Detect hosts connecting to dynamic domain providers",
            "Detect malicious requests to exploit JBoss servers",
            "Detect mshta inline hta execution",
            "Detect mshta renamed",
            "Detection of tools built by NirSoft",
            "Disable AMSI Through Registry",
            "Disable Defender AntiVirus Registry",
            "Disable Defender BlockAtFirstSeen Feature",
            "Disable Defender Enhanced Notification",
            "Disable Defender MpEngine Registry",
            "Disable Defender Spynet Reporting",
            "Disable Defender Submit Samples Consent Feature",
            "Disable ETW Through Registry",
            "Disable Logs Using WevtUtil",
            "Disable Registry Tool",
            "Disable Schedule Task",
            "Disable Security Logs Using MiniNt Registry",
            "Disable Show Hidden Files",
            "Disable UAC Remote Restriction",
            "Disable Windows App Hotkeys",
            "Disable Windows Behavior Monitoring",
            "Disable Windows SmartScreen Protection",
            "Disabled Kerberos Pre-Authentication Discovery With Get-ADUser",
            "Disabled Kerberos Pre-Authentication Discovery With PowerView",
            "Disabling CMD Application",
            "Disabling ControlPanel",
            "Disabling Defender Services",
            "Disabling Firewall with Netsh",
            "Disabling FolderOptions Windows Feature",
            "Disabling NoRun Windows App",
            "Disabling Remote User Account Control",
            "Disabling SystemRestore In Registry",
            "Disabling Task Manager",
            "Disabling Windows Local Security Authority Defences via Registry",
            "Domain Account Discovery with Dsquery",
            "Domain Account Discovery with Wmic",
            "Domain Controller Discovery with Nltest",
            "Domain Controller Discovery with Wmic",
            "Domain Group Discovery With Dsquery",
            "Domain Group Discovery With Wmic",
            "Domain Group Discovery with Adsisearcher",
            "Download Files Using Telegram",
            "Drop IcedID License dat",
            "Dump LSASS via comsvcs DLL",
            "Dump LSASS via procdump",
            "ESXi Account Modified",
            "ESXi Audit Tampering",
            "ESXi Bulk VM Termination",
            "ESXi Download Errors",
            "ESXi Encryption Settings Modified",
            "ESXi External Root Login Activity",
            "ESXi Firewall Disabled",
            "ESXi Lockdown Mode Disabled",
            "ESXi Loghost Config Tampering",
            "ESXi Malicious VIB Forced Install",
            "ESXi Reverse Shell Patterns",
            "ESXi SSH Brute Force",
            "ESXi SSH Enabled",
            "ESXi Sensitive Files Accessed",
            "ESXi Shared or Stolen Root Account",
            "ESXi Shell Access Enabled",
            "ESXi Syslog Config Change",
            "ESXi System Clock Manipulation",
            "ESXi System Information Discovery",
            "ESXi User Granted Admin Role",
            "ESXi VIB Acceptance Level Tampering",
            "ESXi VM Discovery",
            "ESXi VM Exported via Remote Tool",
            "ETW Registry Disabled",
            "Elevated Group Discovery With Wmic",
            "Elevated Group Discovery with PowerView",
            "Email Attachments With Lots Of Spaces",
            "Email files written outside of the Outlook directory",
            "Email servers sending high volume traffic to hosts",
            "Enable RDP In Other Port Number",
            "Enable WDigest UseLogonCredential Registry",
            "Enumerate Users Local Group Using Telegram",
            "Esentutl SAM Copy",
            "Eventvwr UAC Bypass",
            "Excessive Attempt To Disable Services",
            "Excessive DNS Failures",
            "Excessive File Deletion In WinDefender Folder",
            "Excessive Usage Of Cacls App",
            "Excessive Usage Of SC Service Utility",
            "Excessive Usage Of Taskkill",
            "Excessive Usage of NSLOOKUP App",
            "Excessive distinct processes from Windows Temp",
            "Excessive number of service control start as disabled",
            "Excessive number of taskhost processes",
            "Exchange PowerShell Abuse via SSRF",
            "Exchange PowerShell Module Usage",
            "Executable File Written in Administrative SMB Share",
            "Executables Or Script Creation In Suspicious Path",
            "Executables Or Script Creation In Temp Path",
            "Execute Javascript With Jscript COM CLSID",
            "Execution of File with Multiple Extensions",
            "Exploit Public Facing Application via Apache Commons Text",
            "Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952",
            "F5 BIG-IP iControl REST Vulnerability CVE-2022-1388",
            "F5 TMUI Authentication Bypass",
            "File Download or Read to Pipe Execution",
            "File with Samsam Extension",
            "Firewall Allowed Program Enable",
            "First Time Seen Child Process of Zoom",
            "First Time Seen Running Windows Service",
            "FodHelper UAC Bypass",
            "Fortinet Appliance Auth bypass",
            "Fsutil Zeroing File",
            "GCP Authentication Failed During MFA Challenge",
            "GCP Detect gcploit framework",
            "GCP Kubernetes cluster pod scan detection",
            "GCP Multi-Factor Authentication Disabled",
            "GCP Multiple Failed MFA Requests For User",
            "GCP Multiple Users Failing To Authenticate From Ip",
            "GCP Successful Single-Factor Authentication",
            "GCP Unusual Number of Failed Authentications From Ip",
            "GPUpdate with no Command Line Arguments with Network",
            "GSuite Email Suspicious Attachment",
            "Gdrive suspicious file sharing",
            "Geographic Improbable Location",
            "Get ADDefaultDomainPasswordPolicy with Powershell",
            "Get ADDefaultDomainPasswordPolicy with Powershell Script Block",
            "Get ADUser with PowerShell",
            "Get ADUser with PowerShell Script Block",
            "Get ADUserResultantPasswordPolicy with Powershell",
            "Get ADUserResultantPasswordPolicy with Powershell Script Block",
            "Get DomainPolicy with Powershell",
            "Get DomainPolicy with Powershell Script Block",
            "Get DomainUser with PowerShell",
            "Get DomainUser with PowerShell Script Block",
            "Get WMIObject Group Discovery",
            "Get WMIObject Group Discovery with Script Block Logging",
            "Get-DomainTrust with PowerShell",
            "Get-DomainTrust with PowerShell Script Block",
            "Get-ForestTrust with PowerShell",
            "Get-ForestTrust with PowerShell Script Block",
            "GetAdComputer with PowerShell",
            "GetAdComputer with PowerShell Script Block",
            "GetAdGroup with PowerShell",
            "GetAdGroup with PowerShell Script Block",
            "GetCurrent User with PowerShell",
            "GetCurrent User with PowerShell Script Block",
            "GetDomainComputer with PowerShell",
            "GetDomainComputer with PowerShell Script Block",
            "GetDomainController with PowerShell",
            "GetDomainController with PowerShell Script Block",
            "GetDomainGroup with PowerShell",
            "GetDomainGroup with PowerShell Script Block",
            "GetLocalUser with PowerShell",
            "GetLocalUser with PowerShell Script Block",
            "GetNetTcpconnection with PowerShell",
            "GetNetTcpconnection with PowerShell Script Block",
            "GetWmiObject DS User with PowerShell",
            "GetWmiObject DS User with PowerShell Script Block",
            "GetWmiObject Ds Computer with PowerShell",
            "GetWmiObject Ds Computer with PowerShell Script Block",
            "GetWmiObject Ds Group with PowerShell",
            "GetWmiObject Ds Group with PowerShell Script Block",
            "GetWmiObject User Account with PowerShell",
            "GetWmiObject User Account with PowerShell Script Block",
            "GitHub Enterprise Delete Branch Ruleset",
            "GitHub Enterprise Disable 2FA Requirement",
            "GitHub Enterprise Disable Audit Log Event Stream",
            "GitHub Enterprise Disable Classic Branch Protection Rule",
            "GitHub Enterprise Disable Dependabot",
            "GitHub Enterprise Disable IP Allow List",
            "GitHub Enterprise Modify Audit Log Event Stream",
            "GitHub Enterprise Pause Audit Log Event Stream",
            "GitHub Enterprise Register Self Hosted Runner",
            "GitHub Enterprise Remove Organization",
            "GitHub Enterprise Repository Archived",
            "GitHub Enterprise Repository Deleted",
            "GitHub Organizations Delete Branch Ruleset",
            "GitHub Organizations Disable 2FA Requirement",
            "GitHub Organizations Disable Classic Branch Protection Rule",
            "GitHub Organizations Disable Dependabot",
            "GitHub Organizations Repository Archived",
            "GitHub Organizations Repository Deleted",
            "GitHub Workflow File Creation or Modification",
            "Gsuite Drive Share In External Email",
            "Gsuite Email Suspicious Subject With Attachment",
            "Gsuite Email With Known Abuse Web Service Link",
            "Gsuite Outbound Email With Attachment To External Domain",
            "Gsuite Suspicious Shared File Name",
            "Gsuite suspicious calendar invite",
            "HTTP C2 Framework User Agent",
            "HTTP Duplicated Header",
            "HTTP Malware User Agent",
            "HTTP PUA User Agent",
            "HTTP Possible Request Smuggling",
            "HTTP RMM User Agent",
            "HTTP Rapid POST with Mixed Status Codes",
            "HTTP Request to Reserved Name on IIS Server",
            "HTTP Scripting Tool User Agent",
            "Headless Browser Mockbin or Mocky Request",
            "Headless Browser Usage",
            "Hide User Account From Sign-In Screen",
            "Hiding Files And Directories With Attrib exe",
            "High Frequency Copy Of Files In Network Share",
            "High Number of Login Failures from a single source",
            "High Process Termination Frequency",
            "High Volume of Bytes Out to Url",
            "Hosts receiving high volume of network traffic from email server",
            "Hunting 3CXDesktopApp Software",
            "Hunting for Log4Shell",
            "ICACLS Grant Command",
            "Icacls Deny Command",
            "IcedID Exfiltrated Archived File Creation",
            "Impacket Lateral Movement Commandline Parameters",
            "Impacket Lateral Movement WMIExec Commandline Parameters",
            "Impacket Lateral Movement smbexec CommandLine Parameters",
            "Interactive Session on Remote Endpoint with PowerShell",
            "Internal Horizontal Port Scan",
            "Internal Horizontal Port Scan NMAP Top 20",
            "Internal Vertical Port Scan",
            "Internal Vulnerability Scan",
            "Ivanti Connect Secure Command Injection Attempts",
            "Ivanti Connect Secure SSRF in SAML Component",
            "Ivanti Connect Secure System Information Access via Auth Bypass",
            "Ivanti EPM SQL Injection Remote Code Execution",
            "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078",
            "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082",
            "Ivanti VTM New Account Creation",
            "Java Class File download by Java User Agent",
            "Java Writing JSP File",
            "Jenkins Arbitrary File Read CVE-2024-23897",
            "JetBrains TeamCity Authentication Bypass CVE-2024-27198",
            "JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198",
            "JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199",
            "JetBrains TeamCity RCE Attempt",
            "Jscript Execution Using Cscript App",
            "Juniper Networks Remote Code Execution Exploit Detection",
            "Kerberoasting spn request with RC4 encryption",
            "Kerberos Pre-Authentication Flag Disabled in UserAccountControl",
            "Kerberos Pre-Authentication Flag Disabled with PowerShell",
            "Kerberos Service Ticket Request Using RC4 Encryption",
            "Kerberos TGT Request Using RC4 Encryption",
            "Kerberos User Enumeration",
            "Kubernetes AWS detect suspicious kubectl calls",
            "Kubernetes Abuse of Secret by Unusual Location",
            "Kubernetes Abuse of Secret by Unusual User Agent",
            "Kubernetes Abuse of Secret by Unusual User Group",
            "Kubernetes Abuse of Secret by Unusual User Name",
            "Kubernetes Access Scanning",
            "Kubernetes Anomalous Inbound Network Activity from Process",
            "Kubernetes Anomalous Inbound Outbound Network IO",
            "Kubernetes Anomalous Inbound to Outbound Network IO Ratio",
            "Kubernetes Anomalous Outbound Network Activity from Process",
            "Kubernetes Anomalous Traffic on Network Edge",
            "Kubernetes Create or Update Privileged Pod",
            "Kubernetes Cron Job Creation",
            "Kubernetes DaemonSet Deployed",
            "Kubernetes Falco Shell Spawned",
            "Kubernetes Nginx Ingress LFI",
            "Kubernetes Nginx Ingress RFI",
            "Kubernetes Node Port Creation",
            "Kubernetes Pod Created in Default Namespace",
            "Kubernetes Pod With Host Network Attachment",
            "Kubernetes Previously Unseen Container Image Name",
            "Kubernetes Previously Unseen Process",
            "Kubernetes Process Running From New Path",
            "Kubernetes Process with Anomalous Resource Utilisation",
            "Kubernetes Process with Resource Ratio Anomalies",
            "Kubernetes Scanner Image Pulling",
            "Kubernetes Scanning by Unauthenticated IP Address",
            "Kubernetes Shell Running on Worker Node",
            "Kubernetes Shell Running on Worker Node with CPU Activity",
            "Kubernetes Suspicious Image Pulling",
            "Kubernetes Unauthorized Access",
            "Kubernetes newly seen TCP edge",
            "Kubernetes newly seen UDP edge",
            "LLM Model File Creation",
            "LOLBAS With Network Traffic",
            "Large Volume of DNS ANY Queries",
            "Linux APT Privilege Escalation",
            "Linux AWK Privilege Escalation",
            "Linux Account Manipulation Of SSH Config and Keys",
            "Linux Add Files In Known Crontab Directories",
            "Linux Add User Account",
            "Linux Adding Crontab Using List Parameter",
            "Linux At Allow Config File Creation",
            "Linux At Application Execution",
            "Linux Auditd AI CLI Permission Override Activated",
            "Linux Auditd Add User Account",
            "Linux Auditd Add User Account Type",
            "Linux Auditd At Application Execution",
            "Linux Auditd Auditd Daemon Abort",
            "Linux Auditd Auditd Daemon Shutdown",
            "Linux Auditd Auditd Daemon Start",
            "Linux Auditd Auditd Service Stop",
            "Linux Auditd Base64 Decode Files",
            "Linux Auditd Change File Owner To Root",
            "Linux Auditd Clipboard Data Copy",
            "Linux Auditd Copy Fail Privilege Escalation",
            "Linux Auditd Data Destruction Command",
            "Linux Auditd Data Transfer Size Limits Via Split",
            "Linux Auditd Data Transfer Size Limits Via Split Syscall",
            "Linux Auditd Database File And Directory Discovery",
            "Linux Auditd Dd File Overwrite",
            "Linux Auditd Disable Or Modify System Firewall",
            "Linux Auditd Doas Conf File Creation",
            "Linux Auditd Doas Tool Execution",
            "Linux Auditd Edit Cron Table Parameter",
            "Linux Auditd File And Directory Discovery",
            "Linux Auditd File Permission Modification Via Chmod",
            "Linux Auditd File Permissions Modification Via Chattr",
            "Linux Auditd Find Credentials From Password Managers",
            "Linux Auditd Find Credentials From Password Stores",
            "Linux Auditd Find Ssh Private Keys",
            "Linux Auditd Hardware Addition Swapoff",
            "Linux Auditd Hidden Files And Directories Creation",
            "Linux Auditd Insert Kernel Module Using Insmod Utility",
            "Linux Auditd Install Kernel Module Using Modprobe Utility",
            "Linux Auditd Kernel Module Enumeration",
            "Linux Auditd Kernel Module Using Rmmod Utility",
            "Linux Auditd Nopasswd Entry In Sudoers File",
            "Linux Auditd Osquery Service Stop",
            "Linux Auditd Possible Access Or Modification Of Sshd Config File",
            "Linux Auditd Possible Access To Credential Files",
            "Linux Auditd Possible Access To Sudoers File",
            "Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File",
            "Linux Auditd Preload Hijack Library Calls",
            "Linux Auditd Preload Hijack Via Preload File",
            "Linux Auditd Private Keys and Certificate Enumeration",
            "Linux Auditd Service Restarted",
            "Linux Auditd Service Started",
            "Linux Auditd Setuid Using Chmod Utility",
            "Linux Auditd Setuid Using Setcap Utility",
            "Linux Auditd Shred Overwrite Command",
            "Linux Auditd Stop Services",
            "Linux Auditd Sudo Or Su Execution",
            "Linux Auditd Sysmon Service Stop",
            "Linux Auditd System Network Configuration Discovery",
            "Linux Auditd Unix Shell Configuration Modification",
            "Linux Auditd Unload Module Via Modprobe",
            "Linux Auditd Virtual Disk File And Directory Discovery",
            "Linux Auditd Whoami User Discovery",
            "Linux Binary Launched Process with Null Argv",
            "Linux Busybox Privilege Escalation",
            "Linux Change File Owner To Root",
            "Linux Clipboard Data Copy",
            "Linux Common Process For Elevation Control",
            "Linux Composer Privilege Escalation",
            "Linux Cpulimit Privilege Escalation",
            "Linux Csvtool Privilege Escalation",
            "Linux Curl Upload File",
            "Linux DD File Overwrite",
            "Linux Data Destruction Command",
            "Linux Decode Base64 to Shell",
            "Linux Deleting Critical Directory Using RM Command",
            "Linux Deletion Of Cron Jobs",
            "Linux Deletion Of Init Daemon Script",
            "Linux Deletion Of Services",
            "Linux Deletion of SSL Certificate",
            "Linux Dirty Frag Kernel Privilege Escalation",
            "Linux Disable Services",
            "Linux Doas Conf File Creation",
            "Linux Doas Tool Execution",
            "Linux Docker Root Directory Mount",
            "Linux Docker Shell Execution",
            "Linux Edit Cron Table Parameter",
            "Linux Emacs Privilege Escalation",
            "Linux File Created In Kernel Driver Directory",
            "Linux File Creation In Init Boot Directory",
            "Linux File Creation In Profile Directory",
            "Linux Find Privilege Escalation",
            "Linux GDB Privilege Escalation",
            "Linux GNU Awk Privilege Escalation",
            "Linux Gdrive Binary Activity",
            "Linux Gem Privilege Escalation",
            "Linux Hardware Addition SwapOff",
            "Linux High Frequency Of File Deletion In Boot Folder",
            "Linux High Frequency Of File Deletion In Etc Folder",
            "Linux Impair Defenses Process Kill",
            "Linux Indicator Removal Clear Cache",
            "Linux Indicator Removal Service File Deletion",
            "Linux Ingress Tool Transfer Hunting",
            "Linux Ingress Tool Transfer with Curl",
            "Linux Insert Kernel Module Using Insmod Utility",
            "Linux Install Kernel Module Using Modprobe Utility",
            "Linux Iptables Firewall Modification",
            "Linux Kernel Module Enumeration",
            "Linux Kworker Process In Writable Process Path",
            "Linux Magic SysRq Key Abuse",
            "Linux Make Privilege Escalation",
            "Linux Malformed Auth Entry",
            "Linux Medusa Rootkit",
            "Linux MySQL Privilege Escalation",
            "Linux NOPASSWD Entry In Sudoers File",
            "Linux Ngrok Reverse Proxy Usage",
            "Linux Node Privilege Escalation",
            "Linux Obfuscated Files or Information Base64 Decode",
            "Linux Octave Privilege Escalation",
            "Linux OpenVPN Privilege Escalation",
            "Linux PF_ALG Registration Outside of Boot Window",
            "Linux PHP Privilege Escalation",
            "Linux Persistence and Privilege Escalation Risk Behavior",
            "Linux Possible Access Or Modification Of sshd Config File",
            "Linux Possible Access To Credential Files",
            "Linux Possible Access To Sudoers File",
            "Linux Possible Append Command To At Allow Config File",
            "Linux Possible Append Command To Profile Config File",
            "Linux Possible Append Cronjob Entry on Existing Cronjob File",
            "Linux Possible Cronjob Modification With Editor",
            "Linux Possible Ssh Key File Creation",
            "Linux Preload Hijack Library Calls",
            "Linux Proxy Socks Curl",
            "Linux Puppet Privilege Escalation",
            "Linux RPM Privilege Escalation",
            "Linux Ruby Privilege Escalation",
            "Linux SSH Authorized Keys Modification",
            "Linux SSH Remote Services Script Execute",
            "Linux Service File Created In Systemd Directory",
            "Linux Service Restarted",
            "Linux Service Started Or Enabled",
            "Linux Setuid Using Chmod Utility",
            "Linux Setuid Using Setcap Utility",
            "Linux Shred Overwrite Command",
            "Linux Sqlite3 Privilege Escalation",
            "Linux Stdout Redirection To Dev Null File",
            "Linux Stop Services",
            "Linux Sudo OR Su Execution",
            "Linux Sudoers Tmp File Creation",
            "Linux Suspicious Namespace Creation",
            "Linux Suspicious React or Next.js Child Process",
            "Linux System Network Discovery",
            "Linux System Reboot Via System Request Key",
            "Linux Telnet Authentication Bypass",
            "Linux Unix Shell Enable All SysRq Functions",
            "Linux Visudo Utility Execution",
            "Linux c89 Privilege Escalation",
            "Linux c99 Privilege Escalation",
            "Linux pkexec Privilege Escalation",
            "Living Off The Land Detection",
            "Loading Of Dynwrapx Module",
            "Local Account Discovery With Wmic",
            "Local LLM Framework DNS Query",
            "Log4Shell CVE-2021-44228 Exploitation",
            "Log4Shell JNDI Payload Injection Attempt",
            "Log4Shell JNDI Payload Injection with Outbound Connection",
            "Logon Script Event Trigger Execution",
            "M365 Copilot Agentic Jailbreak Attack",
            "M365 Copilot Application Usage Pattern Anomalies",
            "M365 Copilot Failed Authentication Patterns",
            "M365 Copilot Impersonation Jailbreak Attack",
            "M365 Copilot Information Extraction Jailbreak Attack",
            "M365 Copilot Jailbreak Attempts",
            "M365 Copilot Non Compliant Devices Accessing M365 Copilot",
            "M365 Copilot Session Origin Anomalies",
            "MCP Filesystem Server Suspicious Extension Write",
            "MCP Github Suspicious Operation",
            "MCP Postgres Suspicious Query",
            "MCP Prompt Injection",
            "MCP Sensitive System File Search",
            "MOVEit Certificate Store Access Failure",
            "MOVEit Empty Key Fingerprint Authentication Attempt",
            "MS Exchange Mailbox Replication service writing Active Server Pages",
            "MS Scripting Process Loading Ldap Module",
            "MS Scripting Process Loading WMI Module",
            "MSBuild Suspicious Spawned By Script Process",
            "MSI Module Loaded by Non-System Binary",
            "MacOS - Re-opened Applications",
            "MacOS AMOS Stealer - Virtual Machine Check Activity",
            "MacOS Account Created",
            "MacOS Data Chunking",
            "MacOS Gatekeeper Bypass",
            "MacOS Hidden Files and Directories",
            "MacOS Kextload Usage",
            "MacOS Keychains Dumped",
            "MacOS LOLbin",
            "MacOS List Firewall Rules",
            "MacOS Log Removal",
            "MacOS LoginHook Persistence",
            "MacOS Network Share Discovery",
            "MacOS plutil",
            "Mailsniper Invoke functions",
            "Malicious InProcServer32 Modification",
            "Malicious PowerShell Process - Encoded Command",
            "Malicious PowerShell Process - Execution Policy Bypass",
            "Malicious PowerShell Process With Obfuscation Techniques",
            "Malicious Powershell Executed As A Service",
            "Microsoft Defender ATP Alerts",
            "Microsoft Defender Incident Alerts",
            "Microsoft Intune Bulk Wipe",
            "Microsoft Intune Device Health Scripts",
            "Microsoft Intune DeviceManagementConfigurationPolicies",
            "Microsoft Intune Manual Device Management",
            "Microsoft Intune Mobile Apps",
            "Microsoft SharePoint Server Elevation of Privilege",
            "Mimikatz PassTheTicket CommandLine Parameters",
            "Mmc LOLBAS Execution Process Spawn",
            "Modification Of Wallpaper",
            "Modify ACL permission To Files Or Folder",
            "Monitor Email For Brand Abuse",
            "Monitor Registry Keys for Print Monitors",
            "Monitor Web Traffic For Brand Abuse",
            "Mshta spawning Rundll32 OR Regsvr32 Process",
            "Msmpeng Application DLL Side Loading",
            "Multiple Archive Files Http Post Traffic",
            "NET Profiler UAC bypass",
            "NLTest Domain Trust Discovery",
            "Network Connection Discovery With Arp",
            "Network Connection Discovery With Netstat",
            "Network Discovery Using Route Windows App",
            "Network Share Discovery Via Dir Command",
            "Network Traffic to Active Directory Web Services Protocol",
            "Nginx ConnectWise ScreenConnect Authentication Bypass",
            "Ngrok Reverse Proxy on Network",
            "Nishang PowershellTCPOneLine",
            "No Windows Updates in a time frame",
            "Non Chrome Process Accessing Chrome Default Dir",
            "Non Firefox Process Access Firefox Profile Dir",
            "Notepad with no Command Line Arguments",
            "Ntdsutil Export NTDS",
            "O365 Add App Role Assignment Grant User",
            "O365 Added Service Principal",
            "O365 Admin Consent Bypassed by Service Principal",
            "O365 Advanced Audit Disabled",
            "O365 Application Available To Other Tenants",
            "O365 Application Registration Owner Added",
            "O365 ApplicationImpersonation Role Assigned",
            "O365 BEC Email Hiding Rule Created",
            "O365 Block User Consent For Risky Apps Disabled",
            "O365 Bypass MFA via Trusted IP",
            "O365 Compliance Content Search Exported",
            "O365 Compliance Content Search Started",
            "O365 Concurrent Sessions From Different Ips",
            "O365 Cross-Tenant Access Change",
            "O365 DLP Rule Triggered",
            "O365 Disable MFA",
            "O365 Elevated Mailbox Permission Assigned",
            "O365 Email Access By Security Administrator",
            "O365 Email Hard Delete Excessive Volume",
            "O365 Email New Inbox Rule Created",
            "O365 Email Password and Payroll Compromise Behavior",
            "O365 Email Receive and Hard Delete Takeover Behavior",
            "O365 Email Reported By Admin Found Malicious",
            "O365 Email Reported By User Found Malicious",
            "O365 Email Security Feature Changed",
            "O365 Email Send Attachments Excessive Volume",
            "O365 Email Send and Hard Delete Exfiltration Behavior",
            "O365 Email Send and Hard Delete Suspicious Behavior",
            "O365 Email Suspicious Behavior Alert",
            "O365 Email Suspicious Search Behavior",
            "O365 Email Transport Rule Changed",
            "O365 Excessive Authentication Failures Alert",
            "O365 Excessive SSO logon errors",
            "O365 Exfiltration via File Access",
            "O365 Exfiltration via File Download",
            "O365 Exfiltration via File Sync Download",
            "O365 External Guest User Invited",
            "O365 External Identity Policy Changed",
            "O365 File Permissioned Application Consent Granted by User",
            "O365 FullAccessAsApp Permission Assigned",
            "O365 High Number Of Failed Authentications for User",
            "O365 High Privilege Role Granted",
            "O365 Mail Permissioned Application Consent Granted by User",
            "O365 Mailbox Email Forwarding Enabled",
            "O365 Mailbox Folder Read Permission Assigned",
            "O365 Mailbox Folder Read Permission Granted",
            "O365 Mailbox Inbox Folder Shared with All Users",
            "O365 Mailbox Read Access Granted to Application",
            "O365 Multi-Source Failed Authentications Spike",
            "O365 Multiple AppIDs and UserAgents Authentication Spike",
            "O365 Multiple Failed MFA Requests For User",
            "O365 Multiple Mailboxes Accessed via API",
            "O365 Multiple OS Vendors Authenticating From User",
            "O365 Multiple Service Principals Created by SP",
            "O365 Multiple Service Principals Created by User",
            "O365 Multiple Users Failing To Authenticate From Ip",
            "O365 New Email Forwarding Rule Created",
            "O365 New Email Forwarding Rule Enabled",
            "O365 New Federated Domain Added",
            "O365 New Forwarding Mailflow Rule Created",
            "O365 New MFA Method Registered",
            "O365 OAuth App Mailbox Access via EWS",
            "O365 OAuth App Mailbox Access via Graph API",
            "O365 PST export alert",
            "O365 Privileged Graph API Permission Assigned",
            "O365 Privileged Role Assigned",
            "O365 Privileged Role Assigned To Service Principal",
            "O365 Safe Links Detection",
            "O365 Security And Compliance Alert Triggered",
            "O365 Service Principal New Client Credentials",
            "O365 Service Principal Privilege Escalation",
            "O365 SharePoint Allowed Domains Policy Changed",
            "O365 SharePoint Malware Detection",
            "O365 SharePoint Suspicious Search Behavior",
            "O365 Tenant Wide Admin Consent Granted",
            "O365 Threat Intelligence Suspicious Email Delivered",
            "O365 Threat Intelligence Suspicious File Detected",
            "O365 User Consent Blocked for Risky Application",
            "O365 User Consent Denied for OAuth Application",
            "O365 ZAP Activity Detection",
            "Okta Authentication Failed During MFA Challenge",
            "Okta IDP Lifecycle Modifications",
            "Okta MFA Exhaustion Hunt",
            "Okta Mismatch Between Source and Response for Verify Push Request",
            "Okta Multi-Factor Authentication Disabled",
            "Okta Multiple Accounts Locked Out",
            "Okta Multiple Failed MFA Requests For User",
            "Okta Multiple Failed Requests to Access Applications",
            "Okta Multiple Users Failing To Authenticate From Ip",
            "Okta New API Token Created",
            "Okta New Device Enrolled on Account",
            "Okta Non-Standard VPN Usage",
            "Okta Phishing Detection with FastPass Origin Check",
            "Okta Risk Threshold Exceeded",
            "Okta Successful Single Factor Authentication",
            "Okta Suspicious Activity Reported",
            "Okta Suspicious Use of a Session Cookie",
            "Okta ThreatInsight Threat Detected",
            "Okta Unauthorized Access to Application",
            "Okta User Logins from Multiple Cities",
            "Ollama Abnormal Network Connectivity",
            "Ollama Abnormal Service Crash Availability Attack",
            "Ollama Excessive API Requests",
            "Ollama Possible API Endpoint Scan Reconnaissance",
            "Ollama Possible Memory Exhaustion Resource Abuse",
            "Ollama Possible Model Exfiltration Data Leakage",
            "Ollama Possible RCE via Model Loading",
            "Ollama Suspicious Prompt Injection Jailbreak",
            "Outbound Network Connection from Java Using Default Ports",
            "Overwriting Accessibility Binaries",
            "PTC Windchill GW READY OK Probe",
            "PTC Windchill Gateway Command Execution",
            "PaperCut NG Remote Web Access Attempt",
            "PaperCut NG Suspicious Behavior Debug Log",
            "Permission Modification using Takeown App",
            "PetitPotam Network Share Access Request",
            "PetitPotam Suspicious Kerberos TGT Request",
            "Ping Sleep Batch Command",
            "PingID Mismatch Auth Source and Verification Response",
            "PingID Multiple Failed MFA Requests For User",
            "PingID New MFA Method After Credential Reset",
            "PingID New MFA Method Registered For User",
            "Plain HTTP POST Exfiltrated Data",
            "Possible Browser Pass View Parameter",
            "Possible Lateral Movement PowerShell Spawn",
            "Potential System Network Configuration Discovery Activity",
            "Potential Telegram API Request Via CommandLine",
            "Potential password in username",
            "PowerShell - Connect To Internet With Hidden Window",
            "PowerShell 4104 Hunting",
            "PowerShell Domain Enumeration",
            "PowerShell Enable PowerShell Remoting",
            "PowerShell Environment Variable Execution",
            "PowerShell Get LocalGroup Discovery",
            "PowerShell Invoke CIMMethod CIMSession",
            "PowerShell Invoke WmiExec Usage",
            "PowerShell Loading DotNET into Memory via Reflection",
            "PowerShell PInvoke Process Injection API Chain",
            "PowerShell Script Block With URL Chain",
            "PowerShell Start or Stop Service",
            "PowerShell Start-BitsTransfer",
            "PowerShell WebRequest Using Memory Stream",
            "Powershell COM Hijacking InprocServer32 Modification",
            "Powershell Creating Thread Mutex",
            "Powershell Defender Threat Actions Set to Allow",
            "Powershell Disable Security Monitoring",
            "Powershell Enable SMB1Protocol Feature",
            "Powershell Execute COM Object",
            "Powershell Fileless Process Injection via GetProcAddress",
            "Powershell Fileless Script Contains Base64 Encoded Content",
            "Powershell Get LocalGroup Discovery with Script Block Logging",
            "Powershell Load Module in Meterpreter",
            "Powershell Processing Stream Of Data",
            "Powershell Remote Services Add TrustedHost",
            "Powershell Remote Thread To Known Windows Process",
            "Powershell Remove Windows Defender Directory",
            "Powershell Using memory As Backing Store",
            "Powershell Windows Defender Exclusion Commands",
            "Prevent Automatic Repair Mode using Bcdedit",
            "Print Processor Registry Autostart",
            "Print Spooler Adding A Printer Driver",
            "Print Spooler Failed to Load a Plug-in",
            "Process Creating LNK file in Suspicious Location",
            "Process Deleting Its Process File Path",
            "Process Execution via WMI",
            "Process Kill Base On File Path",
            "Process Writing DynamicWrapperX",
            "Processes Tapping Keyboard Events",
            "Prohibited Network Traffic Allowed",
            "Protocol or Port Mismatch",
            "Protocols passing authentication in cleartext",
            "ProxyShell ProxyNotShell Behavior Detected",
            "Randomly Generated Scheduled Task Name",
            "Randomly Generated Windows Service Name",
            "Ransomware Notes bulk creation",
            "Recon AVProduct Through Pwh or WMI",
            "Recon Using WMI Class",
            "Recursive Delete of Directory In Batch CMD",
            "Reg exe Manipulating Windows Services Registry Keys",
            "Registry Keys Used For Persistence",
            "Registry Keys Used For Privilege Escalation",
            "Registry Keys for Creating SHIM Databases",
            "Regsvr32 Silent and Install Param Dll Loading",
            "Regsvr32 with Known Silent Switch Cmdline",
            "Remcos RAT File Creation in Remcos Folder",
            "Remcos client registry install entry",
            "Remote Desktop Network Traffic",
            "Remote Desktop Process Running On System",
            "Remote Process Instantiation via DCOM and PowerShell",
            "Remote Process Instantiation via DCOM and PowerShell Script Block",
            "Remote Process Instantiation via WMI",
            "Remote Process Instantiation via WMI and PowerShell",
            "Remote Process Instantiation via WMI and PowerShell Script Block",
            "Remote Process Instantiation via WinRM and PowerShell",
            "Remote Process Instantiation via WinRM and PowerShell Script Block",
            "Remote Process Instantiation via WinRM and Winrs",
            "Remote System Discovery with Adsisearcher",
            "Remote System Discovery with Dsquery",
            "Remote System Discovery with Wmic",
            "Remote WMI Command Attempt",
            "Resize ShadowStorage volume",
            "Revil Common Exec Parameter",
            "Revil Registry Entry",
            "Risk Rule for Dev Sec Ops by Repository",
            "Rubeus Command Line Parameters",
            "Rubeus Kerberos Ticket Exports Through Winlogon Access",
            "RunDLL Loading DLL By Ordinal",
            "Runas Execution in CommandLine",
            "Rundll32 Control RunDLL Hunt",
            "Rundll32 Control RunDLL World Writable Directory",
            "Rundll32 Create Remote Thread To A Process",
            "Rundll32 CreateRemoteThread In Browser",
            "Rundll32 DNSQuery",
            "Rundll32 LockWorkStation",
            "Rundll32 Process Creating Exe Dll Files",
            "Rundll32 Shimcache Flush",
            "Rundll32 with no Command Line Arguments with Network",
            "Ryuk Test Files Detected",
            "Ryuk Wake on LAN Command",
            "SAM Database File Access Attempt",
            "SAP NetWeaver Visual Composer Exploitation Attempt",
            "SLUI RunAs Elevated",
            "SLUI Spawning a Process",
            "SMB Traffic Spike",
            "SQL Injection with Long URLs",
            "SSL Certificates with Punycode",
            "Samsam Test File Write",
            "SchCache Change By App Connect And Create ADSI Object",
            "Schedule Task with HTTP Command Arguments",
            "Schedule Task with Rundll32 Command Trigger",
            "Scheduled Task Creation on Remote Endpoint using At",
            "Scheduled Task Deleted Or Created via CMD",
            "Scheduled Task Initiation on Remote Endpoint",
            "Schtasks Run Task On Demand",
            "Schtasks scheduling job on remote system",
            "Schtasks used for forcing a reboot",
            "Screensaver Event Trigger Execution",
            "Script Execution via WMI",
            "Sdclt UAC Bypass",
            "Sdelete Application Execution",
            "SearchProtocolHost with no Command Line with Network",
            "SecretDumps Offline NTDS Dumping Tool",
            "ServicePrincipalNames Discovery with PowerShell",
            "ServicePrincipalNames Discovery with SetSPN",
            "Services Escalate Exe",
            "Services LOLBAS Execution Process Spawn",
            "Set Default PowerShell Execution Policy To Unrestricted or Bypass",
            "Shai-Hulud 2 Exfiltration Artifact Files",
            "Shai-Hulud Workflow File Creation or Modification",
            "Shim Database File Creation",
            "Shim Database Installation With Suspicious Parameters",
            "Short Lived Scheduled Task",
            "Short Lived Windows Accounts",
            "SilentCleanup UAC Bypass",
            "Single Letter Process On Endpoint",
            "Spike in File Writes",
            "Splunk App for Lookup File Editing RCE via User XSLT",
            "Splunk AppDynamics Secure Application Alerts",
            "Splunk Authentication Token Exposure in Debug Log",
            "Splunk Code Injection via custom dashboard leading to RCE",
            "Splunk Enterprise KV Store Incorrect Authorization",
            "Splunk Information Disclosure on Account Login",
            "Splunk Path Traversal In Splunk App For Lookup File Edit",
            "Splunk RCE PDFgen Render",
            "Splunk RCE Through Arbitrary File Write to Windows System Root",
            "Splunk RCE via User XSLT",
            "Splunk Secure Application Alerts for Runtime Security",
            "Splunk Sensitive Information Disclosure in DEBUG Logging Channels",
            "Splunk User Enumeration Attempt",
            "Splunk XSS Privilege Escalation via Custom Urls in Dashboard",
            "Spoolsv Spawning Rundll32",
            "Spoolsv Suspicious Loaded Modules",
            "Spoolsv Suspicious Process Access",
            "Spoolsv Writing a DLL",
            "Spoolsv Writing a DLL - Sysmon",
            "Spring4Shell Payload URL Request",
            "Sqlite Module In Temp Folder",
            "Steal or Forge Authentication Certificates Behavior Identified",
            "Sunburst Correlation DLL and Network Event",
            "Supernova Webshell",
            "Suspicious Computer Account Name Change",
            "Suspicious Copy on System32",
            "Suspicious Curl Network Connection",
            "Suspicious DLLHost no Command Line Arguments",
            "Suspicious Email Attachment Extensions",
            "Suspicious GPUpdate no Command Line Arguments",
            "Suspicious IcedID Rundll32 Cmdline",
            "Suspicious Image Creation In Appdata Folder",
            "Suspicious Java Classes",
            "Suspicious Kerberos Service Ticket Request",
            "Suspicious Linux Discovery Commands",
            "Suspicious MSBuild Rename",
            "Suspicious MSBuild Spawn",
            "Suspicious PlistBuddy Usage",
            "Suspicious PlistBuddy Usage via OSquery",
            "Suspicious Process DNS Query Known Abuse Web Services",
            "Suspicious Process Executed From Container File",
            "Suspicious Process With Discord DNS Query",
            "Suspicious Reg exe Process",
            "Suspicious Regsvr32 Register Suspicious Path",
            "Suspicious Rundll32 PluginInit",
            "Suspicious Rundll32 StartW",
            "Suspicious Rundll32 dllregisterserver",
            "Suspicious Rundll32 no Command Line Arguments",
            "Suspicious SQLite3 LSQuarantine Behavior",
            "Suspicious Scheduled Task from Public Directory",
            "Suspicious SearchProtocolHost no Command Line Arguments",
            "Suspicious Ticket Granting Ticket Request",
            "Suspicious WAV file in Appdata Folder",
            "Suspicious microsoft workflow compiler rename",
            "Suspicious microsoft workflow compiler usage",
            "Suspicious msbuild path",
            "Suspicious mshta child process",
            "Suspicious mshta spawn",
            "Suspicious wevtutil Usage",
            "Suspicious writes to windows Recycle Bin",
            "Svchost LOLBAS Execution Process Spawn",
            "System Info Gathering Using Dxdiag Application",
            "System Information Discovery Detection",
            "System Processes Run From Unexpected Locations",
            "System User Discovery With Query",
            "System User Discovery With Whoami",
            "TOR Traffic",
            "Time Provider Persistence Registry",
            "Tomcat Session Deserialization Attempt",
            "Tomcat Session File Upload Attempt",
            "Trickbot Named Pipe",
            "UAC Bypass MMC Load Unsigned Dll",
            "UAC Bypass With Colorui COM Object",
            "USN Journal Deletion",
            "Uninstall App Using MsiExec",
            "Unknown Process Using The Kerberos Protocol",
            "Unload Sysmon Filter Driver",
            "Unloading AMSI via Reflection",
            "Unusual Number of Computer Service Tickets Requested",
            "Unusual Number of Kerberos Service Tickets Requested",
            "Unusual Number of Remote Endpoint Authentication Events",
            "Unusually Long Command Line",
            "Unusually Long Content-Type Length",
            "User Discovery With Env Vars PowerShell",
            "User Discovery With Env Vars PowerShell Script Block",
            "VMWare Aria Operations Exploit Attempt",
            "VMware Server Side Template Injection Hunt",
            "VMware Workspace ONE Freemarker Server-side Template Injection",
            "Vbscript Execution Using Wscript App",
            "Verclsid CLSID Execution",
            "WBAdmin Delete System Backups",
            "WMI Permanent Event Subscription",
            "WMI Permanent Event Subscription - Sysmon",
            "WMI Recon Running Process Or Services",
            "WMI Temporary Event Subscription",
            "WMIC XSL Execution via URL",
            "WS FTP Remote Code Execution",
            "WSReset UAC Bypass",
            "Wbemprox COM Object Execution",
            "Web JSP Request via URL",
            "Web Remote ShellServlet Access",
            "Web Servers Executing Suspicious Processes",
            "Web Spring Cloud Function FunctionRouter",
            "Web Spring4Shell HTTP Request Class Module",
            "Web or Application Server Spawning a Shell",
            "Wermgr Process Connecting To IP Check Web Services",
            "Wermgr Process Create Executable File",
            "Wermgr Process Spawned CMD Or Powershell Process",
            "WinEvent Scheduled Task Created Within Public Path",
            "WinEvent Scheduled Task Created to Spawn Shell",
            "WinEvent Windows Task Scheduler Event Action Started",
            "WinRAR Spawning Shell Application",
            "WinRM Spawning a Process",
            "Windows .Key File Creation in Root Directory",
            "Windows AD Abnormal Object Access Activity",
            "Windows AD AdminSDHolder ACL Modified",
            "Windows AD Cross Domain SID History Addition",
            "Windows AD DCShadow Privileges ACL Addition",
            "Windows AD DSRM Account Changes",
            "Windows AD DSRM Password Reset",
            "Windows AD Dangerous Deny ACL Modification",
            "Windows AD Dangerous Group ACL Modification",
            "Windows AD Dangerous User ACL Modification",
            "Windows AD Domain Controller Audit Policy Disabled",
            "Windows AD Domain Controller Promotion",
            "Windows AD Domain Replication ACL Addition",
            "Windows AD Domain Root ACL Deletion",
            "Windows AD Domain Root ACL Modification",
            "Windows AD GPO Deleted",
            "Windows AD GPO Disabled",
            "Windows AD GPO New CSE Addition",
            "Windows AD Hidden OU Creation",
            "Windows AD Object Owner Updated",
            "Windows AD Privileged Account SID History Addition",
            "Windows AD Privileged Group Modification",
            "Windows AD Privileged Object Access Activity",
            "Windows AD Replication Request Initiated by User Account",
            "Windows AD Replication Request Initiated from Unsanctioned Location",
            "Windows AD Replication Service Traffic",
            "Windows AD Rogue Domain Controller Network Activity",
            "Windows AD SID History Attribute Modified",
            "Windows AD Same Domain SID History Addition",
            "Windows AD Self DACL Assignment",
            "Windows AD ServicePrincipalName Added To Domain Account",
            "Windows AD Short Lived Domain Account ServicePrincipalName",
            "Windows AD Short Lived Domain Controller SPN Attribute",
            "Windows AD Short Lived Server Object",
            "Windows AD Suspicious Attribute Modification",
            "Windows AD add Self to Group",
            "Windows AI Platform DNS Query",
            "Windows Abused Web Services",
            "Windows Access Token Manipulation SeDebugPrivilege",
            "Windows Access Token Manipulation Winlogon Duplicate Token Handle",
            "Windows Access Token Winlogon Duplicate Handle In Uncommon Path",
            "Windows Account Access Removal via Logoff Exec",
            "Windows Account Discovery With NetUser PreauthNotRequire",
            "Windows Account Discovery for None Disable User Account",
            "Windows Account Discovery for Sam Account Name",
            "Windows AdFind Exe",
            "Windows Admin Password Changed by Non-Admin",
            "Windows Admin Permission Discovery",
            "Windows Administrative Shares Accessed On Multiple Hosts",
            "Windows Admon Default Group Policy Object Modified",
            "Windows Admon Group Policy Object Created",
            "Windows Advanced Installer MSIX with AI_STUBS Execution",
            "Windows Alternate DataStream - Base64 Content",
            "Windows Alternate DataStream - Executable Content",
            "Windows Alternate DataStream - Process Execution",
            "Windows Anomalous Registry Value Length in Environment Key",
            "Windows Anonymous Pipe Activity",
            "Windows Apache Benchmark Binary",
            "Windows App Layer Protocol Qakbot NamedPipe",
            "Windows App Layer Protocol Wermgr Connect To NamedPipe",
            "Windows AppCertDLL Modification Via Command Line",
            "Windows AppLocker Block Events",
            "Windows AppLocker Execution from Uncommon Locations",
            "Windows AppLocker Privilege Escalation via Unauthorized Bypass",
            "Windows AppLocker Rare Application Launch Detection",
            "Windows AppX Deployment Full Trust Package Installation",
            "Windows AppX Deployment Package Installation Success",
            "Windows AppX Deployment Unsigned Package Installation",
            "Windows Application Layer Protocol RMS Radmin Tool Namedpipe",
            "Windows Application Whitelisting Bypass Attempt via Rundll32",
            "Windows Archive Collected Data via Powershell",
            "Windows Archive Collected Data via Rar",
            "Windows Archived Collected Data In TEMP Folder",
            "Windows Attempt To Stop Security Service",
            "Windows Audit Policy Auditing Option Disabled via Auditpol",
            "Windows Audit Policy Auditing Option Modified - Registry",
            "Windows Audit Policy Cleared via Auditpol",
            "Windows Audit Policy Disabled via Auditpol",
            "Windows Audit Policy Disabled via Legacy Auditpol",
            "Windows Audit Policy Excluded Category via Auditpol",
            "Windows Audit Policy Restored via Auditpol",
            "Windows Audit Policy Security Descriptor Tampering via Auditpol",
            "Windows AutoIt3 Execution",
            "Windows Autostart Execution LSASS Driver Registry Modification",
            "Windows Azure PowerShell Module Installation Via PowerShell Script",
            "Windows Azure Storage Utility Execution Via CLI",
            "Windows Binary Execution from an Archive",
            "Windows Binary Proxy Execution Mavinject DLL Injection",
            "Windows BitDefender Submission Wizard DLL Sideloading",
            "Windows BitLocker Suspicious Command Usage",
            "Windows BitLockerToGo Process Execution",
            "Windows BitLockerToGo with Network Activity",
            "Windows Bluetooth Service Installed From Uncommon Location",
            "Windows Boot or Logon Autostart Execution In Startup Folder",
            "Windows BootLoader Inventory",
            "Windows Browser Process Launched with Unusual Flags",
            "Windows Bypass UAC via Pkgmgr Tool",
            "Windows CAB File on Disk",
            "Windows COM Hijacking InprocServer32 Modification",
            "Windows Cabinet File Extraction Via Expand",
            "Windows Cached Domain Credentials Reg Query",
            "Windows Certutil Root Certificate Addition",
            "Windows Change File Association Command To Notepad",
            "Windows Chrome Auto-Update Disabled via Registry",
            "Windows Chrome Enable Extension Loading via Command-Line",
            "Windows Chrome Extension Allowed Registry Modification",
            "Windows Chromium Browser Launched with Small Window Size",
            "Windows Chromium Browser No Security Sandbox Process",
            "Windows Chromium Browser with Custom User Data Directory",
            "Windows Chromium Process Launched with Logging Disabled",
            "Windows Chromium Process Loaded Extension via Command-Line",
            "Windows Chromium Process with Disabled Extensions",
            "Windows Chromium process Launched with Disable Popup Blocking",
            "Windows Cisco Secure Endpoint Related Service Stopped",
            "Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc",
            "Windows Cisco Secure Endpoint Unblock File Via Sfc",
            "Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc",
            "Windows ClipBoard Data via Get-ClipBoard",
            "Windows Cloud Files Filter Loaded by Uncommon Process",
            "Windows Cloud Files Filter Log Created by Non-System Process",
            "Windows Cmdline Tool Execution From Non-Shell Process",
            "Windows Cobalt Strike PowerShell Loader",
            "Windows Command Obfuscation with Environment Variable Substrings",
            "Windows Command Shell DCRat ForkBomb Payload",
            "Windows Command and Scripting Interpreter Hunting Path Traversal",
            "Windows Command and Scripting Interpreter Path Traversal Exec",
            "Windows Common Abused Cmd Shell Risk Behavior",
            "Windows Compatibility Telemetry Suspicious Child Process",
            "Windows Compatibility Telemetry Tampering Through Registry",
            "Windows Computer Account Changed to Domain Controller",
            "Windows Computer Account Created by Computer Account",
            "Windows Computer Account Requesting Kerberos Ticket",
            "Windows Computer Account With SPN",
            "Windows ComputerDefaults Spawning a Process",
            "Windows ConHost with Headless Argument",
            "Windows ConsoleHost History File Deletion",
            "Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script",
            "Windows Create Local Account",
            "Windows Create Local Administrator Account Via Net",
            "Windows Credential Access From Browser Password Store",
            "Windows Credential Dumping LSASS Memory Createdump",
            "Windows Credential Target Information Structure in Commandline",
            "Windows Credentials Access via VaultCli Module",
            "Windows Credentials from Password Stores Chrome Copied in TEMP Dir",
            "Windows Credentials from Password Stores Chrome Extension Access",
            "Windows Credentials from Password Stores Chrome LocalState Access",
            "Windows Credentials from Password Stores Chrome Login Data Access",
            "Windows Credentials from Password Stores Creation",
            "Windows Credentials from Password Stores Deletion",
            "Windows Credentials from Password Stores Query",
            "Windows Credentials from Web Browsers Saved in TEMP Folder",
            "Windows Credentials in Registry Reg Query",
            "Windows CrowdStrike Agent Registry Key Removal",
            "Windows Crowdstrike RTR Script Execution",
            "Windows Curl Download to Suspicious Path",
            "Windows Curl Upload to Remote Destination",
            "Windows DISM Install PowerShell Web Access",
            "Windows DISM Remove Defender",
            "Windows DLL Module Loaded in Temp Dir",
            "Windows DLL Search Order Hijacking Hunt with Sysmon",
            "Windows DLL Search Order Hijacking with iscsicpl",
            "Windows DLL Side-Loading In Calc",
            "Windows DLL Side-Loading Process Child Of Calc",
            "Windows DNS Gather Network Info",
            "Windows DNS Query Request To TinyUrl",
            "Windows DNS Query Request by Telegram Bot API",
            "Windows Data Destruction Recursive Exec Files Deletion",
            "Windows Debugger Tool Execution",
            "Windows Defacement Modify Transcodedwallpaper File",
            "Windows Default Cobalt Strike PowerShell Beacon",
            "Windows Default Group Policy Object Modified",
            "Windows Default Group Policy Object Modified with GPME",
            "Windows Default RDP File Creation By Non MSTSC Process",
            "Windows Default Rdp File Deletion",
            "Windows Default Rdp File Unhidden",
            "Windows Defender ASR Audit Events",
            "Windows Defender ASR Block Events",
            "Windows Defender ASR Registry Modification",
            "Windows Defender ASR Rule Disabled",
            "Windows Defender ASR Rules Stacking",
            "Windows Defender ASR or Threat Configuration Tamper",
            "Windows Defender Exclusion Registry Entry",
            "Windows Delete or Modify System Firewall",
            "Windows Deleted Registry By A Non Critical Process File Path",
            "Windows Detect Network Scanner Behavior",
            "Windows Developer-Signed MSIX Package Installation",
            "Windows Devtunnels Execution",
            "Windows Devtunnels Image Loaded",
            "Windows Disable Change Password Through Registry",
            "Windows Disable Internet Explorer Addons",
            "Windows Disable Lock Workstation Feature Through Registry",
            "Windows Disable LogOff Button Through Registry",
            "Windows Disable Memory Crash Dump",
            "Windows Disable Notification Center",
            "Windows Disable Shutdown Button Through Registry",
            "Windows Disable Windows Event Logging Disable HTTP Logging",
            "Windows Disable Windows Group Policy Features Through Registry",
            "Windows Disable or Modify Tools Via Taskkill",
            "Windows Disable or Stop Browser Process",
            "Windows DisableAntiSpyware Registry",
            "Windows DiskCryptor Usage",
            "Windows Diskshadow Proxy Execution",
            "Windows DnsAdmins New Member Added",
            "Windows Domain Account Discovery Via Get-NetComputer",
            "Windows Domain Admin Impersonation Indicator",
            "Windows DotNet Binary in Non Standard Path",
            "Windows Downdate Registry Activity",
            "Windows Driver Inventory",
            "Windows Driver Load Non-Standard Path",
            "Windows Drivers Loaded by Signature",
            "Windows EDRSilencer Execution",
            "Windows EFI Bootloader File Modification",
            "Windows EFI Volume Mount Attempt Via Mountvol",
            "Windows ESX Admins Group Creation Security Event",
            "Windows ESX Admins Group Creation via Net",
            "Windows ESX Admins Group Creation via PowerShell",
            "Windows Enable PowerShell Web Access",
            "Windows Enable Win32 ScheduledJob via Registry",
            "Windows Entra User Management Via Azure CLI",
            "Windows Event For Service Disabled",
            "Windows Event Log Cleared",
            "Windows Event Logging Service Has Shutdown",
            "Windows Event Triggered Image File Execution Options Injection",
            "Windows EventLog Recon Activity Using Log Query Utilities",
            "Windows Eventlog Cleared Via Wevtutil",
            "Windows Excel Spawning Microsoft Project Application",
            "Windows Excessive Disabled Services Event",
            "Windows Excessive Service Stop Attempt",
            "Windows Excessive Usage Of Net App",
            "Windows Exchange Autodiscover SSRF Abuse",
            "Windows Executable Masquerading as Benign File Types",
            "Windows Executable in Loaded Modules",
            "Windows Execute Arbitrary Commands with MSDT",
            "Windows Execution of Microsoft MSC File In Suspicious Path",
            "Windows Exfiltration Over C2 Via Invoke RestMethod",
            "Windows Exfiltration Over C2 Via Powershell UploadString",
            "Windows Explorer LNK Exploit Process Launch With Padding",
            "Windows Explorer.exe Spawning PowerShell or Cmd",
            "Windows Export Certificate",
            "Windows FFmpeg Audio and Video Device Discovery",
            "Windows FFmpeg DirectShow Video Capture",
            "Windows File Association Modification via Ftype",
            "Windows File Collection Via Copy Utilities",
            "Windows File Download Via CertUtil",
            "Windows File Download Via PowerShell",
            "Windows File Share Discovery With Powerview",
            "Windows File Transfer Protocol In Non-Common Process Path",
            "Windows File Without Extension In Critical Folder",
            "Windows File and Directory Enable ReadOnly Permissions",
            "Windows File and Directory Permissions Enable Inheritance",
            "Windows File and Directory Permissions Remove Inheritance",
            "Windows Files and Dirs Access Rights Modification Via Icacls",
            "Windows Filtering Platform Policy Added to Block EDR Process",
            "Windows Find Domain Organizational Units with GetDomainOU",
            "Windows Find Interesting ACL with FindInterestingDomainAcl",
            "Windows Findstr GPP Discovery",
            "Windows Firewall Rule Added",
            "Windows Firewall Rule Deletion",
            "Windows Firewall Rule Modification",
            "Windows Forest Discovery with GetForestDomain",
            "Windows Gather Victim Host Information Camera",
            "Windows Gather Victim Identity SAM Info",
            "Windows Gather Victim Network Info Through Ip Check Web Services",
            "Windows Gdrive Binary Activity",
            "Windows Get Local Admin with FindLocalAdminAccess",
            "Windows Get-AdComputer Unconstrained Delegation Discovery",
            "Windows Get-Variable.EXE Execution from WindowsApps Folder",
            "Windows Global Object Access Audit List Cleared Via Auditpol",
            "Windows GrimResource - MMC Process Accessing APDS DLL",
            "Windows Group Discovery Via Net",
            "Windows Group Policy Object Created",
            "Windows Guest Account Enabled Via Net.EXE",
            "Windows HTTP Network Communication From MSIExec",
            "Windows Handle Duplication in Known UAC-Bypass Binaries",
            "Windows Hidden Schedule Task Settings",
            "Windows Hide Notification Features Through Registry",
            "Windows High File Deletion Frequency",
            "Windows Hijack Execution Flow Version Dll Side Load",
            "Windows Hosts File Access",
            "Windows Hunting System Account Targeting Lsass",
            "Windows IIS Components Add New Module",
            "Windows IIS Components Get-WebGlobalModule Module Query",
            "Windows IIS Components Module Failed to Load",
            "Windows IIS Components New Module Added",
            "Windows IIS Server PSWA Console Access",
            "Windows IOBit Unlocker Extension DLL Registration via Regsvr32",
            "Windows ISO LNK File Creation",
            "Windows Identify PowerShell Web Access IIS Pool",
            "Windows Identify Protocol Handlers",
            "Windows Impair Defense Add Xml Applocker Rules",
            "Windows Impair Defense Change Win Defender Health Check Intervals",
            "Windows Impair Defense Change Win Defender Quick Scan Interval",
            "Windows Impair Defense Change Win Defender Throttle Rate",
            "Windows Impair Defense Change Win Defender Tracing Level",
            "Windows Impair Defense Configure App Install Control",
            "Windows Impair Defense Define Win Defender Threat Action",
            "Windows Impair Defense Delete Win Defender Context Menu",
            "Windows Impair Defense Delete Win Defender Profile Registry",
            "Windows Impair Defense Deny Security Software With Applocker",
            "Windows Impair Defense Disable Controlled Folder Access",
            "Windows Impair Defense Disable Defender Firewall And Network",
            "Windows Impair Defense Disable Defender Protocol Recognition",
            "Windows Impair Defense Disable PUA Protection",
            "Windows Impair Defense Disable Realtime Signature Delivery",
            "Windows Impair Defense Disable Web Evaluation",
            "Windows Impair Defense Disable Win Defender App Guard",
            "Windows Impair Defense Disable Win Defender Compute File Hashes",
            "Windows Impair Defense Disable Win Defender Gen reports",
            "Windows Impair Defense Disable Win Defender Network Protection",
            "Windows Impair Defense Disable Win Defender Report Infection",
            "Windows Impair Defense Disable Win Defender Scan On Update",
            "Windows Impair Defense Disable Win Defender Signature Retirement",
            "Windows Impair Defense Overide Win Defender Phishing Filter",
            "Windows Impair Defense Override SmartScreen Prompt",
            "Windows Impair Defense Set Win Defender Smart Screen Level To Warn",
            "Windows Impair Defenses Disable AV AutoStart via Registry",
            "Windows Impair Defenses Disable Auto Logger Session",
            "Windows Impair Defenses Disable HVCI",
            "Windows Impair Defenses Disable Win Defender Auto Logging",
            "Windows Important Audit Policy Disabled",
            "Windows InProcServer32 New Outlook Form",
            "Windows Increase in Group or Object Modification Activity",
            "Windows Increase in User Modification Activity",
            "Windows Indicator Removal Via Rmdir",
            "Windows Indirect Command Execution Via Series Of Forfiles",
            "Windows Indirect Command Execution Via forfiles",
            "Windows Indirect Command Execution Via pcalua",
            "Windows Information Discovery Fsutil",
            "Windows Ingress Tool Transfer Using Explorer",
            "Windows Input Capture Using Credential UI Dll",
            "Windows InstallUtil Credential Theft",
            "Windows InstallUtil Remote Network Connection",
            "Windows InstallUtil URL in Command Line",
            "Windows InstallUtil Uninstall Option",
            "Windows InstallUtil in Non Standard Path",
            "Windows Kerberos Coercion via DNS",
            "Windows Kerberos Local Successful Logon",
            "Windows Known Abused DLL Created",
            "Windows Known Abused DLL Loaded Suspiciously",
            "Windows Known GraphicalProton Loaded Modules",
            "Windows KrbRelayUp Service Creation",
            "Windows LAPS Password Gathering Via PowerShell Script",
            "Windows LOLBAS Executed As Renamed File",
            "Windows LOLBAS Executed Outside Expected Path",
            "Windows LSA Secrets NoLMhash Registry",
            "Windows Large Number of Computer Service Tickets Requested",
            "Windows Ldifde Directory Object Behavior",
            "Windows Level RMM PowerShell Script Installer",
            "Windows Level RMM Watchdog Task Created",
            "Windows Linked Policies In ADSI Discovery",
            "Windows List ENV Variables Via SET Command From Uncommon Parent",
            "Windows Local Administrator Credential Stuffing",
            "Windows Local LLM Framework Execution",
            "Windows MMC Loaded Script Engine DLL",
            "Windows MOF Event Triggered Execution via WMI",
            "Windows MOVEit Transfer Writing ASPX",
            "Windows MSC EvilTwin Directory Path Manipulation",
            "Windows MSExchange Management Mailbox Cmdlet Usage",
            "Windows MSHTA Writing to World Writable Path",
            "Windows MSI Rollback Script Deleted By Non-Msiexec Process",
            "Windows MSIExec DLLRegisterServer",
            "Windows MSIExec Remote Download",
            "Windows MSIExec Spawn Discovery Command",
            "Windows MSIExec Spawn WinDBG",
            "Windows MSIExec Unregister DLLRegisterServer",
            "Windows MSIX Package Interaction",
            "Windows MSTSC RDP Commandline",
            "Windows Mail Protocol In Non-Common Process Path",
            "Windows Mark Of The Web Bypass",
            "Windows Masquerading Explorer As Child Process",
            "Windows Masquerading Msdtc Process",
            "Windows Metasploit Confluence Plugin Execution",
            "Windows Mimikatz Binary Execution",
            "Windows Mimikatz Crypto Export File Extensions",
            "Windows Mock Trusted Directory MSC File Creation",
            "Windows Modify Registry AuthenticationLevelOverride",
            "Windows Modify Registry Auto Minor Updates",
            "Windows Modify Registry Auto Update Notif",
            "Windows Modify Registry Configure BitLocker",
            "Windows Modify Registry Default Icon Setting",
            "Windows Modify Registry Delete Firewall Rules",
            "Windows Modify Registry DisAllow Windows App",
            "Windows Modify Registry Disable RDP",
            "Windows Modify Registry Disable Restricted Admin",
            "Windows Modify Registry Disable Toast Notifications",
            "Windows Modify Registry Disable Win Defender Raw Write Notif",
            "Windows Modify Registry Disable WinDefender Notifications",
            "Windows Modify Registry Disable Windows Security Center Notif",
            "Windows Modify Registry DisableRemoteDesktopAntiAlias",
            "Windows Modify Registry DisableSecuritySettings",
            "Windows Modify Registry Disabling WER Settings",
            "Windows Modify Registry Do Not Connect To Win Update",
            "Windows Modify Registry DontShowUI",
            "Windows Modify Registry EnableLinkedConnections",
            "Windows Modify Registry LongPathsEnabled",
            "Windows Modify Registry MaxConnectionPerServer",
            "Windows Modify Registry No Auto Reboot With Logon User",
            "Windows Modify Registry No Auto Update",
            "Windows Modify Registry NoChangingWallPaper",
            "Windows Modify Registry ProxyEnable",
            "Windows Modify Registry ProxyServer",
            "Windows Modify Registry Qakbot Binary Data Registry",
            "Windows Modify Registry Regedit Silent Reg Import",
            "Windows Modify Registry Risk Behavior",
            "Windows Modify Registry Suppress Win Defender Notif",
            "Windows Modify Registry Tamper Protection",
            "Windows Modify Registry USeWuServer",
            "Windows Modify Registry UpdateServiceUrlAlternate",
            "Windows Modify Registry Utilize ProgIDs",
            "Windows Modify Registry ValleyRAT C2 Config",
            "Windows Modify Registry ValleyRat PWN Reg Entry",
            "Windows Modify Registry With MD5 Reg Key Name",
            "Windows Modify Registry WuServer",
            "Windows Modify Registry on Smart Card Group Policy",
            "Windows Modify Registry to Add or Modify Firewall Rule",
            "Windows Modify Registry wuStatusServer",
            "Windows Modify Show Compress Color And Info Tip Registry",
            "Windows Modify System Firewall with Notable Process Path",
            "Windows MpCmdRun RemoveDefinitions Execution",
            "Windows MsMpEng Writing to System32",
            "Windows Mshta Execution In Registry",
            "Windows MsiExec HideWindow Rundll32 Execution",
            "Windows Multi hop Proxy TOR Website Query",
            "Windows Multiple Account Passwords Changed",
            "Windows Multiple Accounts Deleted",
            "Windows Multiple Accounts Disabled",
            "Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos",
            "Windows Multiple Invalid Users Fail To Authenticate Using Kerberos",
            "Windows Multiple Invalid Users Failed To Authenticate Using NTLM",
            "Windows Multiple NTLM Null Domain Authentications",
            "Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials",
            "Windows Multiple Users Failed To Authenticate From Host Using NTLM",
            "Windows Multiple Users Failed To Authenticate From Process",
            "Windows Multiple Users Failed To Authenticate Using Kerberos",
            "Windows Multiple Users Remotely Failed To Authenticate From Host",
            "Windows Mustang Panda USB Tool Execution",
            "Windows Net System Service Discovery",
            "Windows NetSupport RMM DLL Loaded By Uncommon Process",
            "Windows Netspy Network Scanner Execution",
            "Windows Network Connection Discovery Via Net",
            "Windows Network Connection From Program In Suspect Location",
            "Windows Network Share Interaction Via Net",
            "Windows New Custom Security Descriptor Set On EventLog Channel",
            "Windows New Default File Association Value Set",
            "Windows New Deny Permission Set On Service SD Via Sc.EXE",
            "Windows New EventLog ChannelAccess Registry Value Set",
            "Windows New InProcServer32 Added",
            "Windows New Service Security Descriptor Set Via Sc.EXE",
            "Windows Ngrok Reverse Proxy Usage",
            "Windows NirSoft AdvancedRun",
            "Windows NirSoft Tool Bundle File Created",
            "Windows NirSoft Utilities",
            "Windows Njrat Fileless Storage via Registry",
            "Windows Non Discord App Access Discord LevelDB",
            "Windows Non-System Account Targeting Lsass",
            "Windows Non-System Process Querying Definition Update",
            "Windows NorthStar C2 Agent Execution",
            "Windows Obfuscated Files or Information via RAR SFX",
            "Windows Odbcconf Hunting",
            "Windows Odbcconf Load DLL",
            "Windows Odbcconf Load Response File",
            "Windows Office Product Dropped Cab or Inf File",
            "Windows Office Product Dropped Uncommon File",
            "Windows Office Product Loaded MSHTML Module",
            "Windows Office Product Loading Taskschd DLL",
            "Windows Office Product Loading VBE7 DLL",
            "Windows Office Product Spawned Child Process For Download",
            "Windows Office Product Spawned Control",
            "Windows Office Product Spawned MSDT",
            "Windows Office Product Spawned Rundll32 With No DLL",
            "Windows Office Product Spawned Uncommon Process",
            "Windows OneDrive Share Mounted via Net",
            "Windows Outlook Dialogs Disabled from Unusual Process",
            "Windows Outlook LoadMacroProviderOnBoot Persistence",
            "Windows Outlook Macro Created by Suspicious Process",
            "Windows Outlook Macro Security Modified",
            "Windows Outlook WebView Registry Modification",
            "Windows PUA Named Pipe",
            "Windows PaperCut NG Spawn Shell",
            "Windows Parent PID Spoofing with Explorer",
            "Windows Password Managers Discovery",
            "Windows Password Policy Discovery with Net",
            "Windows Phishing Outlook Drop Dll In FORM Dir",
            "Windows Phishing PDF File Executes URL Link",
            "Windows Phishing Recent ISO Exec Registry",
            "Windows Possible Credential Dumping",
            "Windows Post Exploitation Risk Behavior",
            "Windows Potato Privilege Escalation Tool Execution",
            "Windows Potential AppDomainManager Hijack Artifacts Creation",
            "Windows Potential Cloudflared Network Connection",
            "Windows Potential Cloudflared Tunnel Execution",
            "Windows Potential Web Shell Creation For VMware Workspace ONE",
            "Windows PowGoop Beacon Decoding",
            "Windows PowerShell Add Module to Global Assembly Cache",
            "Windows PowerShell Disable HTTP Logging",
            "Windows PowerShell Export Certificate",
            "Windows PowerShell Export PfxCertificate",
            "Windows PowerShell FakeCAPTCHA Clipboard Execution",
            "Windows PowerShell Get CIMInstance Remote Computer",
            "Windows PowerShell IIS Components WebGlobalModule Usage",
            "Windows PowerShell Invoke-RestMethod IP Information Collection",
            "Windows PowerShell Invoke-Sqlcmd Execution",
            "Windows PowerShell MSIX Package Installation",
            "Windows PowerShell Module File Created",
            "Windows PowerShell Process Implementing Manual Base64 Decoder",
            "Windows PowerShell Process With Malicious String",
            "Windows PowerShell ScheduleTask",
            "Windows PowerShell Script Block With Malicious String",
            "Windows PowerShell Script From WindowsApps Directory",
            "Windows PowerShell Script TabExpansion Direct Call",
            "Windows PowerShell WMI Win32 ScheduledJob",
            "Windows PowerSploit GPP Discovery",
            "Windows PowerView AD Access Control List Enumeration",
            "Windows PowerView Constrained Delegation Discovery",
            "Windows PowerView Kerberos Service Ticket Request",
            "Windows PowerView SPN Discovery",
            "Windows PowerView Unconstrained Delegation Discovery",
            "Windows Powershell Cryptography Namespace",
            "Windows Powershell History File Deletion",
            "Windows Powershell Import Applocker Policy",
            "Windows Powershell Logoff User via Quser",
            "Windows Powershell RemoteSigned File",
            "Windows Private Keys Discovery",
            "Windows Privilege Escalation Attempt Via MSI Rollback",
            "Windows Privilege Escalation Suspicious Process Elevation",
            "Windows Privilege Escalation System Process Without System Parent",
            "Windows Privilege Escalation User Process Spawn System Process",
            "Windows Privileged Group Modification",
            "Windows Process Accessing Windows Recall Directory",
            "Windows Process Commandline Discovery",
            "Windows Process Executed From Removable Media",
            "Windows Process Execution From ProgramData",
            "Windows Process Execution From RDP Share",
            "Windows Process Execution in Temp Dir",
            "Windows Process Injection In Non-Service SearchIndexer",
            "Windows Process Injection Of Wermgr to Known Browser",
            "Windows Process Injection Remote Thread",
            "Windows Process Injection Wermgr Child Process",
            "Windows Process Injection With Public Source Path",
            "Windows Process Injection into Commonly Abused Processes",
            "Windows Process Injection into Notepad",
            "Windows Process With NamedPipe CommandLine",
            "Windows Process With NetExec Command Line Parameters",
            "Windows Process Writing File to World Writable Path",
            "Windows Processes Killed By Industroyer2 Malware",
            "Windows Product Key Registry Query",
            "Windows Protocol Tunneling with Plink",
            "Windows Proxy Execution of .NET Utilities via Scripts",
            "Windows Proxy Via Netsh",
            "Windows Proxy Via Registry",
            "Windows PsTools Recon Usage",
            "Windows PuTTY Suite Utility Execution",
            "Windows Query Registry Browser List Application",
            "Windows Query Registry UnInstall Program List",
            "Windows RDP Bitmap Cache File Creation",
            "Windows RDP Cache File Deletion",
            "Windows RDP Client Launched with Admin Session",
            "Windows RDP Connection Successful",
            "Windows RDP File Execution",
            "Windows RDP Login Session Was Established",
            "Windows RDP Server Registry Deletion",
            "Windows RDP Server Registry Entry Created",
            "Windows RDPClient Connection Sequence Events",
            "Windows RMM Named Pipe",
            "Windows RMM Tool Execution",
            "Windows Raccine Scheduled Task Deletion",
            "Windows Rapid Authentication On Multiple Hosts",
            "Windows Rasautou DLL Execution",
            "Windows Raw Access To Disk Volume Partition",
            "Windows Raw Access To Master Boot Record Drive",
            "Windows Rdp AutomaticDestinations Deletion",
            "Windows Registry BootExecute Modification",
            "Windows Registry Certificate Added",
            "Windows Registry Delete Task SD",
            "Windows Registry Dotnet ETW Disabled Via ENV Variable",
            "Windows Registry Entries Exported Via Reg",
            "Windows Registry Entries Restored Via Reg",
            "Windows Registry Modification for Safe Mode Persistence",
            "Windows Registry Payload Injection",
            "Windows Registry SIP Provider Modification",
            "Windows Regsvr32 Renamed Binary",
            "Windows Remote Access Software BRC4 Loaded Dll",
            "Windows Remote Access Software RMS Registry",
            "Windows Remote Assistance Spawning Process",
            "Windows Remote Create Service",
            "Windows Remote Desktop Network Bruteforce Attempt",
            "Windows Remote Host Computer Management Access",
            "Windows Remote Image Load",
            "Windows Remote Management Execute Shell",
            "Windows Remote Service Rdpwinst Tool Execution",
            "Windows Remote Services Allow Rdp In Firewall",
            "Windows Remote Services Allow Remote Assistance",
            "Windows Remote Services Rdp Enable",
            "Windows Renamed Powershell Execution",
            "Windows Replication Through Removable Media",
            "Windows Root Domain linked policies Discovery",
            "Windows Routing and Remote Access Service Registry Key Change",
            "Windows RunMRU Command Execution",
            "Windows RunMRU Registry Key or Value Deleted",
            "Windows Rundll32 Apply User Settings Changes",
            "Windows Rundll32 Execution With Log.DLL",
            "Windows Rundll32 Load DLL in Temp Dir",
            "Windows Rundll32 WebDAV Request",
            "Windows Rundll32 WebDav With Network Connection",
            "Windows Rundll32 with Non-Standard File Extension",
            "Windows SIP Provider Inventory",
            "Windows SIP WinVerifyTrust Failed Trust Validation",
            "Windows SOAPHound Binary Execution",
            "Windows SQL Server Configuration Option Hunt",
            "Windows SQL Server Critical Procedures Enabled",
            "Windows SQL Server Extended Procedure DLL Loading Hunt",
            "Windows SQL Server Startup Procedure",
            "Windows SQL Server xp_cmdshell Config Change",
            "Windows SQL Spawning CertUtil",
            "Windows SQLCMD Execution",
            "Windows SSH Proxy Command",
            "Windows ScManager Security Descriptor Tampering Via Sc.EXE",
            "Windows Scheduled Task Created Via XML",
            "Windows Scheduled Task Created in a Group Policy Object",
            "Windows Scheduled Task DLL Module Loaded",
            "Windows Scheduled Task Service Spawned Shell",
            "Windows Scheduled Task with Highest Privileges",
            "Windows Scheduled Task with Suspicious Command",
            "Windows Scheduled Task with Suspicious Name",
            "Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr",
            "Windows Schtasks Create Run As System",
            "Windows Screen Capture Via Powershell",
            "Windows Screen Capture in TEMP folder",
            "Windows Security Account Manager Stopped",
            "Windows Security And Backup Services Stop",
            "Windows Security Support Provider Reg Query",
            "Windows Sensitive Group Discovery With Net",
            "Windows Sensitive Registry Hive Dump Via CommandLine",
            "Windows Server Software Component GACUtil Install to GAC",
            "Windows Service Create Kernel Mode Driver",
            "Windows Service Create RemComSvc",
            "Windows Service Create SliverC2",
            "Windows Service Create with Tscon",
            "Windows Service Created with Suspicious Service Name",
            "Windows Service Created with Suspicious Service Path",
            "Windows Service Creation Using Registry Entry",
            "Windows Service Creation on Remote Endpoint",
            "Windows Service Deletion In Registry",
            "Windows Service Execution RemCom",
            "Windows Service Initiation on Remote Endpoint",
            "Windows Service Stop Attempt",
            "Windows Service Stop By Deletion",
            "Windows Service Stop Win Updates",
            "Windows Set Account Password Policy To Unlimited Via Net",
            "Windows Set Custom DNS ServerLevelPlugin Via Dnscmd",
            "Windows Set Network Profile Category to Private via Registry",
            "Windows SharePoint Spinstall0 GET Request",
            "Windows SharePoint Spinstall0 Webshell File Creation",
            "Windows SharePoint ToolPane Endpoint Exploitation Attempt",
            "Windows Shell Process from CrushFTP",
            "Windows Shell or Script Execution From IIS Directory",
            "Windows Short Lived DNS Record",
            "Windows Snake Malware File Modification Crmlog",
            "Windows Snake Malware Kernel Driver Comadmin",
            "Windows Snake Malware Registry Modification wav OpenWithProgIds",
            "Windows Snake Malware Service Create",
            "Windows SnappyBee Create Test Registry",
            "Windows SoftEther VPN Masquerading as Legitimate Binary",
            "Windows Software Discovery Via PowerShell",
            "Windows Spearphishing Attachment Connect To None MS Office Domain",
            "Windows Spearphishing Attachment Onenote Spawn Mshta",
            "Windows Special Privileged Logon On Multiple Hosts",
            "Windows SpeechRuntime COM Hijacking DLL Load",
            "Windows SpeechRuntime Suspicious Child Process",
            "Windows SqlWriter SQLDumper DLL Sideload",
            "Windows Sqlservr Spawning Shell",
            "Windows Steal Authentication Certificates - ESC1 Abuse",
            "Windows Steal Authentication Certificates - ESC1 Authentication",
            "Windows Steal Authentication Certificates CS Backup",
            "Windows Steal Authentication Certificates CertUtil Backup",
            "Windows Steal Authentication Certificates Certificate Issued",
            "Windows Steal Authentication Certificates Certificate Request",
            "Windows Steal Authentication Certificates CryptoAPI",
            "Windows Steal Authentication Certificates Export Certificate",
            "Windows Steal Authentication Certificates Export PfxCertificate",
            "Windows Steal or Forge Kerberos Tickets Klist",
            "Windows SubInAcl Execution",
            "Windows Suspect Process With Authentication Traffic",
            "Windows Suspicious Burst of Password Changes",
            "Windows Suspicious C2 Named Pipe",
            "Windows Suspicious Child Process Spawned From WebServer",
            "Windows Suspicious Child Process of TieringEngineService.exe",
            "Windows Suspicious Defender Engine or Signature Files Created",
            "Windows Suspicious Defender Update Activity in INetCache",
            "Windows Suspicious Driver Loaded Path",
            "Windows Suspicious File in EFI Volume",
            "Windows Suspicious Named Pipe",
            "Windows Suspicious Process File Path",
            "Windows Suspicious QEMU Execution",
            "Windows Suspicious React or Next.js Child Process",
            "Windows Suspicious VMWare Tools Child Process",
            "Windows Svchost.exe Parent Process Anomaly",
            "Windows SymbolicLink-Testing-Tools Utility Execution",
            "Windows Symlink Evaluation Change via Fsutil",
            "Windows System Binary Proxy Execution Compiled HTML File Decompile",
            "Windows System Discovery Using Qwinsta",
            "Windows System Discovery Using ldap Nslookup",
            "Windows System File on Disk",
            "Windows System LogOff Commandline",
            "Windows System Network Config Discovery Display DNS",
            "Windows System Network Connections Discovery Netsh",
            "Windows System Reboot CommandLine",
            "Windows System Remote Discovery With Query",
            "Windows System Script Proxy Execution Syncappvpublishingserver",
            "Windows System Shutdown CommandLine",
            "Windows System Time Discovery W32tm Delay",
            "Windows System User Discovery Via Quser",
            "Windows System User Privilege Discovery",
            "Windows TOR Client Execution",
            "Windows TeamCity Payload Execution from Temp Directory",
            "Windows TeamCity Plugin Installed",
            "Windows Terminating Lsass Process",
            "Windows Theme File Creation in Unusual Location",
            "Windows Time Based Evasion",
            "Windows Time Based Evasion via Choice Exec",
            "Windows TinyCC Shellcode Execution",
            "Windows UAC Bypass Suspicious Child Process",
            "Windows UAC Bypass Suspicious Escalation Behavior",
            "Windows USBSTOR Registry Key Modification",
            "Windows Uncommon Remote Thread Creation In Browser Process",
            "Windows Universal Data Link File Creation",
            "Windows Unsecured Outlook Credentials Access In Registry",
            "Windows Unsigned DLL Side-Loading",
            "Windows Unsigned DLL Side-Loading In Same Process Path",
            "Windows Unsigned MS DLL Side-Loading",
            "Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos",
            "Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos",
            "Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM",
            "Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials",
            "Windows Unusual Count Of Users Failed To Auth Using Kerberos",
            "Windows Unusual Count Of Users Failed To Authenticate From Process",
            "Windows Unusual Count Of Users Failed To Authenticate Using NTLM",
            "Windows Unusual Count Of Users Remotely Failed To Auth From Host",
            "Windows Unusual File Creation in Confluence Directory",
            "Windows Unusual FileZilla XML Config Access",
            "Windows Unusual Intelliform Storage Registry Access",
            "Windows Unusual NTLM Authentication Destinations By Source",
            "Windows Unusual NTLM Authentication Destinations By User",
            "Windows Unusual NTLM Authentication Users By Destination",
            "Windows Unusual NTLM Authentication Users By Source",
            "Windows Unusual Process Load Mozilla NSS-Mozglue Module",
            "Windows Unusual SysWOW64 Process Run System32 Executable",
            "Windows User Deletion Via Net",
            "Windows User Disabled Via Net",
            "Windows User Discovery Via Net",
            "Windows User Execution Malicious URL Shortcut File",
            "Windows VSSVC Process Accessing Defender Engine",
            "Windows Visual Basic Commandline Compiler DNSQuery",
            "Windows Vulnerable 3CX Software",
            "Windows Vulnerable Driver Installed",
            "Windows Vulnerable Driver Loaded",
            "Windows WBAdmin File Recovery From Backup",
            "Windows WMI Impersonate Token",
            "Windows WMI Process And Service List",
            "Windows WMI Process Call Create",
            "Windows WMI Reconnaissance Class Query",
            "Windows WMIC Shadowcopy Delete",
            "Windows WPDBusEnum Registry Key Modification",
            "Windows WSUS Spawning Shell",
            "Windows Wermgr Alternate Data Stream in Temp Dir",
            "Windows WinDBG Spawning AutoIt3",
            "Windows WinLogon with Public Network Connection",
            "Windows WinPEAS PowerShell Script Execution",
            "Windows WinRAR Launched Outside Default Installation Directory",
            "Windows WinSCP Configuration Security Access",
            "Windows Wmic CPU Discovery",
            "Windows Wmic DiskDrive Discovery",
            "Windows Wmic Memory Chip Discovery",
            "Windows Wmic Network Discovery",
            "Windows Wmic Systeminfo Discovery",
            "Windows XLL File Creation Outside of Typical Location",
            "Winhlp32 Spawning a Process",
            "Wmic Group Discovery",
            "Wmic NonInteractive App Uninstallation",
            "Wmiprvse LOLBAS Execution Process Spawn",
            "WordPress Bricks Builder plugin RCE",
            "Wscript Or Cscript Suspicious Child Process",
            "Wsmprovhost LOLBAS Execution Process Spawn",
            "XMRIG Driver Loaded",
            "XSL Script Execution With WMIC",
            "Zeek x509 Certificate with Punycode",
            "Zoom High Video Latency",
            "Zoom Rare Audio Devices",
            "Zoom Rare Input Devices",
            "Zoom Rare Video Devices",
            "Zscaler Adware Activities Threat Blocked",
            "Zscaler Behavior Analysis Threat Blocked",
            "Zscaler CryptoMiner Downloaded Threat Blocked",
            "Zscaler Employment Search Web Activity",
            "Zscaler Exploit Threat Blocked",
            "Zscaler Legal Liability Threat Blocked",
            "Zscaler Malware Activity Threat Blocked",
            "Zscaler Phishing Activity Threat Blocked",
            "Zscaler Potentially Abused File Download",
            "Zscaler Privacy Risk Destinations Threat Blocked",
            "Zscaler Scam Destinations Threat Blocked",
            "Zscaler Virus Download threat blocked"
         ],
         "title": "EventBasedDetectionEnum",
         "type": "string"
      },
      "PlaybookLabel": {
         "description": "List of Supported Playbook Labels.",
         "enum": [
            "risk_notable"
         ],
         "title": "PlaybookLabel",
         "type": "string"
      },
      "PlaybookOutput": {
         "description": "List of Supported Playbook Output Types.",
         "enum": [
            "note_title",
            "note_content"
         ],
         "title": "PlaybookOutput",
         "type": "string"
      },
      "PlaybookProduct": {
         "description": "List of Supported Playbook Products.",
         "enum": [
            "Splunk SOAR",
            "Splunk Enterprise Security"
         ],
         "title": "PlaybookProduct",
         "type": "string"
      },
      "PlaybookType": {
         "description": "PlayBook Type field.\n\nThis is intentionally different than the Type Enum\nabove due to legacy naming in the playbook files.",
         "enum": [
            "Automation",
            "Input",
            "Enterprise Security"
         ],
         "title": "PlaybookType",
         "type": "string"
      },
      "PlaybookUseCase": {
         "description": "List of Supported Playbook Use Cases.",
         "enum": [
            "Collection",
            "Endpoint",
            "Enrichment",
            "Malware",
            "Phishing",
            "Response",
            "Utility"
         ],
         "title": "PlaybookUseCase",
         "type": "string"
      },
      "StoryEnum": {
         "description": "Empty Placeholder Enum for stories.\n\nNOTE: This enum is dynamically populated at runtime by the Story.UpdateDynamicEnum method.",
         "enum": [
            "0bj3ctivity Stealer",
            "3CX Supply Chain Attack",
            "AMOS Stealer",
            "APT29 Diplomatic Deceptions with WINELOADER",
            "APT37 Rustonotto and FadeStealer",
            "AWS Bedrock Security",
            "AWS Defense Evasion",
            "AWS IAM Privilege Escalation",
            "AWS Identity and Access Management Account Takeover",
            "AWS Network ACL Activity",
            "AWS S3 Bucket Security Monitoring",
            "AWS Security Hub Alerts",
            "AWS User Monitoring",
            "Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring",
            "AcidPour",
            "AcidRain",
            "Active Directory Discovery",
            "Active Directory Kerberos Attacks",
            "Active Directory Lateral Movement",
            "Active Directory Password Spraying",
            "Active Directory Privilege Escalation",
            "Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360",
            "AgentTesla",
            "Amadey",
            "Apache Struts Vulnerability",
            "Apache Tomcat Session Deserialization Attacks",
            "ArcaneDoor",
            "Asset Tracking",
            "AsyncRAT",
            "Atlassian Confluence Server and Data Center CVE-2022-26134",
            "AwfulShred",
            "Axios Supply Chain Post Compromise",
            "Azorult",
            "Azure Active Directory Account Takeover",
            "Azure Active Directory Persistence",
            "Azure Active Directory Privilege Escalation",
            "BITS Jobs",
            "Backdoor Pingpong",
            "Baron Samedit CVE-2021-3156",
            "BishopFox Sliver Adversary Emulation Framework",
            "Black Basta Ransomware",
            "BlackByte Ransomware",
            "BlackLotus Campaign",
            "BlackMatter Ransomware",
            "BlackSuit Ransomware",
            "BlankGrabber Stealer",
            "BlueHammer",
            "Brand Monitoring",
            "Braodo Stealer",
            "Browser Hijacking",
            "Brute Ratel C4",
            "CISA AA22-257A",
            "CISA AA22-264A",
            "CISA AA22-277A",
            "CISA AA22-320A",
            "CISA AA23-347A",
            "CISA AA24-241A",
            "CVE-2022-40684 Fortinet Appliance Auth bypass",
            "CVE-2023-21716 Word RTF Heap Corruption",
            "CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server",
            "CVE-2023-23397 Outlook Elevation of Privilege",
            "CVE-2023-36884 Office and Windows HTML RCE Vulnerability",
            "Cactus Ransomware",
            "Caddy Wiper",
            "Castle RAT",
            "Chaos Ransomware",
            "China-Nexus Threat Activity",
            "Cisco Catalyst SD-WAN Analytics",
            "Cisco Duo Suspicious Activity",
            "Cisco IOS XE Software Web Management User Interface vulnerability",
            "Cisco Isovalent Suspicious Activity",
            "Cisco Network Visibility Module Analytics",
            "Cisco Secure Access Analytics",
            "Cisco Secure Firewall Threat Defense Analytics",
            "Cisco Smart Install Remote Code Execution CVE-2018-0171",
            "Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966",
            "Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777",
            "Citrix Netscaler ADC CVE-2023-3519",
            "Citrix ShareFile RCE CVE-2023-24489",
            "Cleo File Transfer Software",
            "Clop Ransomware",
            "Cloud Cryptomining",
            "Cloud Federated Credential Abuse",
            "Cobalt Strike",
            "ColdRoot MacOS RAT",
            "Collection and Staging",
            "Command And Control",
            "Compromised Linux Host",
            "Compromised User Account",
            "Compromised Windows Host",
            "Confluence Data Center and Confluence Server Vulnerabilities",
            "ConnectWise ScreenConnect Vulnerabilities",
            "Credential Dumping",
            "Critical Alerts",
            "CrushFTP Vulnerabilities",
            "Crypto Stealer",
            "Cyclops Blink",
            "DHS Report TA18-074A",
            "DNS Amplification Attacks",
            "DNS Hijacking",
            "DarkCrystal RAT",
            "DarkGate Malware",
            "DarkSide Ransomware",
            "Data Destruction",
            "Data Exfiltration",
            "Data Protection",
            "Defense Evasion or Unauthorized Access Via SDDL Tampering",
            "Deobfuscate-Decode Files or Information",
            "Derusbi",
            "Detect Zerologon Attack",
            "Dev Sec Ops",
            "Disabling Security Tools",
            "Disk Wiper",
            "Domain Trust Discovery",
            "Double Zero Destructor",
            "Dynamic DNS",
            "DynoWiper",
            "ESXi Post Compromise",
            "Earth Alux",
            "Emotet Malware DHS Report TA18-201A",
            "F5 Authentication Bypass with TMUI",
            "F5 BIG-IP Vulnerability CVE-2022-1388",
            "F5 TMUI RCE CVE-2020-5902",
            "FIN7",
            "Fake CAPTCHA Campaigns",
            "Flax Typhoon",
            "Forest Blizzard",
            "Fortinet FortiNAC CVE-2022-39952",
            "GCP Account Takeover",
            "GCP Cross Account Activity",
            "Gh0st RAT",
            "GhostRedirector IIS Module and Rungan Backdoor",
            "GitHub Malicious Activity",
            "Gomir",
            "Gozi Malware",
            "Graceful Wipe Out Attack",
            "HAFNIUM Group",
            "HTTP Request Smuggling",
            "Handala Wiper",
            "Hellcat Ransomware",
            "Hermetic Wiper",
            "Hidden Cobra Malware",
            "IIS Components",
            "IcedID",
            "Industroyer2",
            "Information Sabotage",
            "Ingress Tool Transfer",
            "Insider Threat",
            "Interlock Ransomware",
            "Interlock Rat",
            "Ivanti Connect Secure VPN Vulnerabilities",
            "Ivanti EPM Vulnerabilities",
            "Ivanti EPMM Remote Unauthenticated Access",
            "Ivanti Sentry Authentication Bypass CVE-2023-38035",
            "Ivanti Virtual Traffic Manager CVE-2024-7593",
            "JBoss Vulnerability",
            "Jenkins Server Vulnerabilities",
            "JetBrains TeamCity Unauthenticated RCE",
            "JetBrains TeamCity Vulnerabilities",
            "Juniper JunOS Remote Code Execution",
            "Kerberos Coercion with DNS",
            "Kubernetes Scanning Activity",
            "Kubernetes Security",
            "Kubernetes Sensitive Object Access Activity",
            "LAMEHUG",
            "Linux Living Off The Land",
            "Linux Persistence Techniques",
            "Linux Post-Exploitation",
            "Linux Privilege Escalation",
            "Linux Rootkit",
            "Living Off The Land",
            "Local Privilege Escalation With KrbRelayUp",
            "LockBit Ransomware",
            "Log4Shell CVE-2021-44228",
            "Lokibot",
            "Lotus Blossom Chrysalis Backdoor",
            "Lumma Stealer",
            "MOVEit Transfer Authentication Bypass",
            "MOVEit Transfer Critical Vulnerability",
            "MSIX Package Abuse",
            "MacOS Persistence Techniques",
            "MacOS Post-Exploitation",
            "MacOS Privilege Escalation",
            "Malicious Inno Setup Loader",
            "Malicious PowerShell",
            "Masquerading - Rename System Utilities",
            "Medusa Ransomware",
            "Medusa Rootkit",
            "Meduza Stealer",
            "MetaSploit",
            "Meterpreter",
            "Microsoft MSHTML Remote Code Execution CVE-2021-40444",
            "Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357",
            "Microsoft SharePoint Vulnerabilities",
            "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190",
            "Microsoft WSUS CVE-2025-59287",
            "Monitor for Updates",
            "MoonPeak",
            "MuddyWater",
            "NOBELIUM Group",
            "NPM Supply Chain Compromise",
            "NailaoLocker Ransomware",
            "NetSupport RMM Tool Abuse",
            "Netsh Abuse",
            "Network Discovery",
            "NjRAT",
            "NotDoor Malware",
            "Office 365 Account Takeover",
            "Office 365 Collection Techniques",
            "Office 365 Persistence Mechanisms",
            "Okta Account Takeover",
            "Okta MFA Exhaustion",
            "OpenSSL CVE-2022-3602",
            "Oracle E-Business Suite Exploitation",
            "Orangeworm Attack Group",
            "Outlook RCE CVE-2024-21378",
            "PHP-CGI RCE Attack on Japanese Organizations",
            "PTC Windchill Exploitation",
            "PXA Stealer",
            "PaperCut MF NG Vulnerability",
            "PathWiper",
            "PetitPotam NTLM Relay on Active Directory Certificate Services",
            "Phantom Stealer",
            "Phemedrone Stealer",
            "PlugX",
            "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
            "Prestige Ransomware",
            "PrintNightmare CVE-2021-34527",
            "Prohibited Traffic Allowed or Protocol Mismatch",
            "PromptFlux",
            "PromptLock",
            "ProxyNotShell",
            "ProxyShell",
            "Qakbot",
            "Quasar RAT",
            "QuietVault",
            "Ransomware",
            "Ransomware Cloud",
            "React2Shell",
            "RedLine Stealer",
            "RedSun",
            "Remcos",
            "Remote Employment Fraud",
            "Remote Monitoring and Management Software",
            "Reverse Network Proxy",
            "Revil Ransomware",
            "Rhysida Ransomware",
            "RoguePlanet",
            "Router and Infrastructure Security",
            "Ryuk Ransomware",
            "SAP NetWeaver Exploitation",
            "SQL Injection",
            "SQL Server Abuse",
            "Salat Stealer",
            "Salt Typhoon",
            "SamSam Ransomware",
            "Sandworm Tools",
            "Scattered Lapsus$ Hunters",
            "Scattered Spider",
            "Scheduled Tasks",
            "Seashell Blizzard",
            "Secret Blizzard",
            "Security Solution Tampering",
            "SesameOp",
            "ShrinkLocker",
            "Signed Binary Proxy Execution InstallUtil",
            "Silver Sparrow",
            "Snake Keylogger",
            "Snake Malware",
            "SnappyBee",
            "Sneaky Active Directory Persistence Tricks",
            "SolarWinds WHD RCE Post Exploitation",
            "Spearphishing Attachments",
            "Splunk Vulnerabilities",
            "Spring4Shell CVE-2022-22965",
            "StealC Stealer",
            "Storm-0501 Ransomware",
            "Storm-2460 CLFS Zero Day Exploitation",
            "Subvert Trust Controls SIP and Trust Provider Hijacking",
            "Suspicious AWS Bedrock Claude Activities",
            "Suspicious AWS Login Activities",
            "Suspicious AWS S3 Activities",
            "Suspicious AWS Traffic",
            "Suspicious Cisco Adaptive Security Appliance Activity",
            "Suspicious Cloud Authentication Activities",
            "Suspicious Cloud Instance Activities",
            "Suspicious Cloud Provisioning Activities",
            "Suspicious Cloud User Activities",
            "Suspicious Command-Line Executions",
            "Suspicious Compiled HTML Activity",
            "Suspicious DNS Traffic",
            "Suspicious Emails",
            "Suspicious GCP Storage Activities",
            "Suspicious Local LLM Frameworks",
            "Suspicious MCP Activities",
            "Suspicious MSHTA Activity",
            "Suspicious Microsoft 365 Copilot Activities",
            "Suspicious Okta Activity",
            "Suspicious Ollama Activities",
            "Suspicious Regsvcs Regasm Activity",
            "Suspicious Regsvr32 Activity",
            "Suspicious Rundll32 Activity",
            "Suspicious User Agents",
            "Suspicious WMI Use",
            "Suspicious Windows Registry Activities",
            "Suspicious Zoom Child Processes",
            "Swift Slicer",
            "SysAid On-Prem Software CVE-2023-47246 Vulnerability",
            "SystemBC",
            "Telnetd CVE-2026-24061",
            "Termite Ransomware",
            "Text4Shell CVE-2022-42889",
            "Trickbot",
            "Trusted Developer Utilities Proxy Execution",
            "Trusted Developer Utilities Proxy Execution MSBuild",
            "Tuoni",
            "Unusual Processes",
            "Use of Cleartext Protocols",
            "VIP Keylogger",
            "VMware Aria Operations vRealize CVE-2023-20887",
            "VMware ESXi AD Integration Authentication Bypass CVE-2024-37085",
            "VMware Server Side Injection and Privilege Escalation",
            "ValleyRAT",
            "VanHelsing Ransomware",
            "Void Manticore",
            "VoidLink Cloud-Native Linux Malware",
            "Volt Typhoon",
            "WS FTP Server Critical Vulnerabilities",
            "Warzone RAT",
            "Water Gamayun",
            "WhisperGate",
            "WinDealer RAT",
            "WinRAR Spoofing Attack CVE-2023-38831",
            "Windows AppLocker",
            "Windows Attack Surface Reduction",
            "Windows Audit Policy Tampering",
            "Windows BootKits",
            "Windows Certificate Services",
            "Windows DNS SIGRed CVE-2020-1350",
            "Windows Defense Evasion Tactics",
            "Windows Discovery Techniques",
            "Windows Drivers",
            "Windows Error Reporting Service Elevation of Privilege Vulnerability",
            "Windows File Extension and Association Abuse",
            "Windows Log Manipulation",
            "Windows Persistence Techniques",
            "Windows Post-Exploitation",
            "Windows Privilege Escalation",
            "Windows RDP Artifacts and Defense Evasion",
            "Windows Registry Abuse",
            "Windows Service Abuse",
            "Windows System Binary Proxy Execution MSIExec",
            "Winter Vivern",
            "WordPress Vulnerabilities",
            "XML Runner Loader",
            "XMRig",
            "XWorm",
            "XorDDos",
            "ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day",
            "ZOVWiper",
            "Zscaler Browser Proxy Threats",
            "sAMAccountName Spoofing and Domain Controller Impersonation"
         ],
         "title": "StoryEnum",
         "type": "string"
      },
      "Type": {
         "description": "List of Supported Playbook Types.\n\nThis is intentionally different than the PlaybookType Enum\nabove due to legacy naming in the playbook files.",
         "enum": [
            "Investigation",
            "Response"
         ],
         "title": "Type",
         "type": "string"
      },
      "VpeType": {
         "description": "List of Supported VPE Types.",
         "enum": [
            "Modern",
            "Classic"
         ],
         "title": "VpeType",
         "type": "string"
      }
   },
   "additionalProperties": false,
   "description": "Represents a Playbook object for Splunk SOAR.\n\nPlaybooks define automated response and investigation workflows that run\nin Splunk SOAR.  The tags section from legacy contentctl is flattened\nso that all fields live directly on this object.",
   "properties": {
      "name": {
         "description": "Each Security Content Object must have a unique name. Due to issues with how local/default stanzas are merged in the Splunk products, these names MUST NOT change between subsequent releases of content packs.",
         "title": "Name",
         "type": "string"
      },
      "id": {
         "description": "Each Security Content Object must have a unique identifier. This is particularly important when leveraging many of the Content Versioning features built into Enterprise Security 8+. Unique ids may be generated with a python command such as `uuid.uuid4()` or similar.",
         "format": "uuid",
         "title": "Id",
         "type": "string"
      },
      "version": {
         "description": "The version of this object. This number MUST be incremented in the following circumstances:\n1. Any time the object in this file is modified\n2. Any time that the serialization logic for this object changes, changing what is written in its conf file stanza(s)\n3. Any time that an object this object references, for example via enrichment, causes a change in its associated conf file stanzas(s).\nThis final determination is challenging to make manually, so the `contentctl inspect command` will help identify when this a version increment is required.",
         "exclusiveMinimum": 0,
         "title": "Version",
         "type": "integer"
      },
      "creation_date": {
         "description": "The date that this object was created. This should NEVER be updated.",
         "format": "date",
         "title": "Creation Date",
         "type": "string"
      },
      "modification_date": {
         "description": "The date that this object was last modified. This should be updated whenever the object is modified.",
         "format": "date",
         "title": "Modification Date",
         "type": "string"
      },
      "author": {
         "description": "The author of this object. This is a freeform string that can be used to identify the author of the object. It will eventually be replaced by a more detailed Contributors list.",
         "title": "Author",
         "type": "string"
      },
      "description": {
         "description": "A description of the Security Content Object. This should be a human-readable description of the object, including its purpose.",
         "title": "Description",
         "type": "string"
      },
      "references": {
         "description": "A list of references to external resources that are relevant to this object. This can include links to documentation, blog posts, or other resources that provide additional context or information about the object.",
         "items": {
            "format": "uri",
            "maxLength": 2083,
            "minLength": 1,
            "type": "string"
         },
         "minItems": 0,
         "title": "References",
         "type": "array",
         "uniqueItems": true
      },
      "playbook": {
         "description": "The name of the SOAR playbook as it appears in the SOAR platform. While most playbooks declare this field as lower-cased version of the name field with spaces replaced by underscores, this is not true for all playbooks. As such, there is no further validation on this field, it is just treated as a string.",
         "title": "Playbook",
         "type": "string"
      },
      "how_to_implement": {
         "description": "Instructions for configuring or deploying the playbook.",
         "minLength": 4,
         "title": "How To Implement",
         "type": "string"
      },
      "app_list": {
         "description": "SOAR apps required by this playbook. This is broad, so it is intentionally not backed by an enum. Please use special care when updating this field since validation is limited.",
         "items": {
            "type": "string"
         },
         "title": "App List",
         "type": "array"
      },
      "platform_tags": {
         "description": "Free-form tags describing the observable types and platform context that this playbook operates on (e.g. 'user', 'endpoint', 'D3-AL').",
         "items": {
            "type": "string"
         },
         "title": "Platform Tags",
         "type": "array"
      },
      "type": {
         "$ref": "#/$defs/Type",
         "description": "The functional role of this playbook: Input, Automation, or Enterprise Security."
      },
      "vpe_type": {
         "$ref": "#/$defs/VpeType",
         "description": "The Visual Playbook Editor type used to build this playbook: Modern or Classic."
      },
      "playbook_fields": {
         "description": "Input fields exposed by this playbook.",
         "items": {
            "type": "string"
         },
         "title": "Playbook Fields",
         "type": "array"
      },
      "labels": {
         "description": "Labels for the playbook",
         "items": {
            "$ref": "#/$defs/PlaybookLabel"
         },
         "title": "Labels",
         "type": "array"
      },
      "product": {
         "description": "Splunk products this playbook targets.",
         "items": {
            "$ref": "#/$defs/PlaybookProduct"
         },
         "title": "Product",
         "type": "array"
      },
      "use_cases": {
         "description": "Security use cases addressed by this playbook.",
         "items": {
            "$ref": "#/$defs/PlaybookUseCase"
         },
         "title": "Use Cases",
         "type": "array"
      },
      "defend_technique_id": {
         "anyOf": [
            {
               "items": {
                  "$ref": "#/$defs/DefendTechnique"
               },
               "type": "array"
            },
            {
               "type": "null"
            }
         ],
         "default": null,
         "description": "D3FEND technique IDs that describe the defensive action taken by this playbook.",
         "title": "Defend Technique Id"
      },
      "analytic_story": {
         "description": "Analytic Stories that reference this playbook.",
         "items": {
            "$ref": "#/$defs/StoryEnum"
         },
         "title": "Analytic Story",
         "type": "array"
      },
      "detections": {
         "description": "Event-based detections that reference this playbook.",
         "items": {
            "$ref": "#/$defs/EventBasedDetectionEnum"
         },
         "title": "Detections",
         "type": "array"
      },
      "playbook_outputs": {
         "description": "Descriptions of the output artifacts generated by this playbook.",
         "items": {
            "$ref": "#/$defs/PlaybookOutput"
         },
         "title": "Playbook Outputs",
         "type": "array"
      },
      "playbook_type": {
         "$ref": "#/$defs/PlaybookType",
         "description": "Legacy playbook type field. This is intentionally different than the 'type' field."
      }
   },
   "required": [
      "name",
      "id",
      "version",
      "creation_date",
      "modification_date",
      "author",
      "description",
      "playbook",
      "how_to_implement",
      "platform_tags",
      "type",
      "vpe_type",
      "playbook_type"
   ],
   "title": "Playbook",
   "type": "object"
}