diff --git a/Splunk_Rules/3cx_supply_chain_attack_network_indicators.yml b/Splunk_Rules/3cx_supply_chain_attack_network_indicators.yml
new file mode 100644
index 0000000000..7227ba40d3
--- /dev/null
+++ b/Splunk_Rules/3cx_supply_chain_attack_network_indicators.yml
@@ -0,0 +1,230 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/1cbbb051f3605ce782d16c34a48665b3670a43c4
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:08:42 GMT
+  etag: W/"4c5521092815e2cfc902557edbc21c0c511e79dd"
+  last-modified: Thu, 11 May 2023 20:15:18 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F416:6D84:BF91C8:18A2D78:645D6769
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, project, repo, user, workflow, write:discussion, write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4985'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '15'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: 3cx_supply_chain_attack_network_indicators.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/1cbbb051f3605ce782d16c34a48665b3670a43c4
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/1cbbb051f3605ce782d16c34a48665b3670a43c4
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+  name: 3cx_supply_chain_attack_network_indicators.yml
+  path: detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+  sha: 1cbbb051f3605ce782d16c34a48665b3670a43c4
+  size: 2729
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - TRACE
+          - HEAD
+          - OPTIONS
+          - GET
+          - DELETE
+          - PUT
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683842911
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683842911
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4983
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: 1cbbb051f3605ce782d16c34a48665b3670a43c4
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 2729
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml?ref=develop
diff --git a/Splunk_Rules/7zip_commandline_to_smb_share_path.yml b/Splunk_Rules/7zip_commandline_to_smb_share_path.yml
new file mode 100644
index 0000000000..4b5aa188a9
--- /dev/null
+++ b/Splunk_Rules/7zip_commandline_to_smb_share_path.yml
@@ -0,0 +1,230 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/9d5ee37152332758535bf43d4e4fb60bb946f1d9
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:08:42 GMT
+  etag: W/"4c5521092815e2cfc902557edbc21c0c511e79dd"
+  last-modified: Thu, 11 May 2023 20:15:18 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F416:6D84:BF91C8:18A2D78:645D6769
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, project, repo, user, workflow, write:discussion, write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4985'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '15'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: 7zip_commandline_to_smb_share_path.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/7zip_commandline_to_smb_share_path.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/9d5ee37152332758535bf43d4e4fb60bb946f1d9
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/7zip_commandline_to_smb_share_path.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/9d5ee37152332758535bf43d4e4fb60bb946f1d9
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+  name: 7zip_commandline_to_smb_share_path.yml
+  path: detections/endpoint/7zip_commandline_to_smb_share_path.yml
+  sha: 9d5ee37152332758535bf43d4e4fb60bb946f1d9
+  size: 2837
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/7zip_commandline_to_smb_share_path.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - TRACE
+          - HEAD
+          - OPTIONS
+          - GET
+          - DELETE
+          - PUT
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683842911
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683842911
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4981
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: 9d5ee37152332758535bf43d4e4fb60bb946f1d9
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 2837
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/7zip_commandline_to_smb_share_path.yml?ref=develop
diff --git a/Splunk_Rules/access_lsass_memory_for_dump_creation.yml b/Splunk_Rules/access_lsass_memory_for_dump_creation.yml
new file mode 100644
index 0000000000..7caa2c3171
--- /dev/null
+++ b/Splunk_Rules/access_lsass_memory_for_dump_creation.yml
@@ -0,0 +1,233 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/de729a784cc938f3ba9845249ae8b301e15e7532
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:17:26 GMT
+  etag: W/"40f7a9fa8edbf11fbe5118f5ce4797f1aea55c6a"
+  last-modified: Thu, 11 May 2023 22:09:05 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F513:1A64:1D68:3E66:645D6975
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, gist, notifications, project, repo, user, workflow, write:discussion,
+    write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4973'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '27'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: access_lsass_memory_for_dump_creation.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/access_lsass_memory_for_dump_creation.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/de729a784cc938f3ba9845249ae8b301e15e7532
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/access_lsass_memory_for_dump_creation.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/de729a784cc938f3ba9845249ae8b301e15e7532
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+  name: access_lsass_memory_for_dump_creation.yml
+  path: detections/endpoint/access_lsass_memory_for_dump_creation.yml
+  sha: de729a784cc938f3ba9845249ae8b301e15e7532
+  size: 2548
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/access_lsass_memory_for_dump_creation.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - DELETE
+          - GET
+          - TRACE
+          - PUT
+          - HEAD
+          - OPTIONS
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683843435
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683843435
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/Splunk_Rules
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - gist
+  - notifications
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4967
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: de729a784cc938f3ba9845249ae8b301e15e7532
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 2548
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/access_lsass_memory_for_dump_creation.yml?ref=develop
diff --git a/Splunk_Rules/account_discovery_with_net_app.yml b/Splunk_Rules/account_discovery_with_net_app.yml
new file mode 100644
index 0000000000..1d622af9da
--- /dev/null
+++ b/Splunk_Rules/account_discovery_with_net_app.yml
@@ -0,0 +1,233 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/account_discovery_with_net_app.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/de4b3c47d4f4f4589b7ff314c5089e562ca87164
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:17:26 GMT
+  etag: W/"40f7a9fa8edbf11fbe5118f5ce4797f1aea55c6a"
+  last-modified: Thu, 11 May 2023 22:09:05 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F513:1A64:1D68:3E66:645D6975
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, gist, notifications, project, repo, user, workflow, write:discussion,
+    write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4973'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '27'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: account_discovery_with_net_app.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/account_discovery_with_net_app.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/de4b3c47d4f4f4589b7ff314c5089e562ca87164
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/account_discovery_with_net_app.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/account_discovery_with_net_app.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/de4b3c47d4f4f4589b7ff314c5089e562ca87164
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml
+  name: account_discovery_with_net_app.yml
+  path: detections/endpoint/account_discovery_with_net_app.yml
+  sha: de4b3c47d4f4f4589b7ff314c5089e562ca87164
+  size: 3242
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/account_discovery_with_net_app.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - DELETE
+          - GET
+          - TRACE
+          - PUT
+          - HEAD
+          - OPTIONS
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683843436
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683843436
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/Splunk_Rules
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - gist
+  - notifications
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4965
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: de4b3c47d4f4f4589b7ff314c5089e562ca87164
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 3242
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/account_discovery_with_net_app.yml?ref=develop
diff --git a/Splunk_Rules/active_directory_lateral_movement_identified.yml b/Splunk_Rules/active_directory_lateral_movement_identified.yml
new file mode 100644
index 0000000000..a87fc047f2
--- /dev/null
+++ b/Splunk_Rules/active_directory_lateral_movement_identified.yml
@@ -0,0 +1,233 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/active_directory_lateral_movement_identified.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/a591a4a73a791695bd18aa045afc5dc5cafd6ea3
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:17:26 GMT
+  etag: W/"40f7a9fa8edbf11fbe5118f5ce4797f1aea55c6a"
+  last-modified: Thu, 11 May 2023 22:09:05 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F513:1A64:1D68:3E66:645D6975
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, gist, notifications, project, repo, user, workflow, write:discussion,
+    write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4973'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '27'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/active_directory_lateral_movement_identified.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: active_directory_lateral_movement_identified.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/active_directory_lateral_movement_identified.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/a591a4a73a791695bd18aa045afc5dc5cafd6ea3
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/active_directory_lateral_movement_identified.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/active_directory_lateral_movement_identified.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/active_directory_lateral_movement_identified.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/a591a4a73a791695bd18aa045afc5dc5cafd6ea3
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/active_directory_lateral_movement_identified.yml
+  name: active_directory_lateral_movement_identified.yml
+  path: detections/endpoint/active_directory_lateral_movement_identified.yml
+  sha: a591a4a73a791695bd18aa045afc5dc5cafd6ea3
+  size: 4059
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/active_directory_lateral_movement_identified.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - DELETE
+          - GET
+          - TRACE
+          - PUT
+          - HEAD
+          - OPTIONS
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683843436
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683843436
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/Splunk_Rules
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - gist
+  - notifications
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4963
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: a591a4a73a791695bd18aa045afc5dc5cafd6ea3
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 4059
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/active_directory_lateral_movement_identified.yml?ref=develop
diff --git a/Splunk_Rules/active_setup_registry_autostart.yml b/Splunk_Rules/active_setup_registry_autostart.yml
new file mode 100644
index 0000000000..f51abf31cb
--- /dev/null
+++ b/Splunk_Rules/active_setup_registry_autostart.yml
@@ -0,0 +1,233 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/active_setup_registry_autostart.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/8a8f458623b1961864e925dcf95d06b00445b677
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:26:09 GMT
+  etag: W/"42ce4381c12f6446596e7890f852548c8437a8d0"
+  last-modified: Thu, 11 May 2023 22:09:05 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F629:1066:95D054:13402E1:645D6B81
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, gist, notifications, project, repo, user, workflow, write:discussion,
+    write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4954'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '46'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/active_setup_registry_autostart.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: active_setup_registry_autostart.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/active_setup_registry_autostart.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/8a8f458623b1961864e925dcf95d06b00445b677
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/active_setup_registry_autostart.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/active_setup_registry_autostart.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/active_setup_registry_autostart.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/8a8f458623b1961864e925dcf95d06b00445b677
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/active_setup_registry_autostart.yml
+  name: active_setup_registry_autostart.yml
+  path: detections/endpoint/active_setup_registry_autostart.yml
+  sha: 8a8f458623b1961864e925dcf95d06b00445b677
+  size: 3815
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/active_setup_registry_autostart.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - PUT
+          - GET
+          - DELETE
+          - OPTIONS
+          - HEAD
+          - TRACE
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683843960
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683843960
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/Splunk_Rules
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - gist
+  - notifications
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4942
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: 8a8f458623b1961864e925dcf95d06b00445b677
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 3815
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/active_setup_registry_autostart.yml?ref=develop
diff --git a/Splunk_Rules/add_defaultuser_and_password_in_registry.yml b/Splunk_Rules/add_defaultuser_and_password_in_registry.yml
new file mode 100644
index 0000000000..cfb9bb3a51
--- /dev/null
+++ b/Splunk_Rules/add_defaultuser_and_password_in_registry.yml
@@ -0,0 +1,233 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/7cf4de2234a5dbae193ab353949191005c4acd55
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:26:09 GMT
+  etag: W/"42ce4381c12f6446596e7890f852548c8437a8d0"
+  last-modified: Thu, 11 May 2023 22:09:05 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F629:1066:95D054:13402E1:645D6B81
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, gist, notifications, project, repo, user, workflow, write:discussion,
+    write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4954'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '46'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: add_defaultuser_and_password_in_registry.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/add_defaultuser_and_password_in_registry.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/7cf4de2234a5dbae193ab353949191005c4acd55
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/add_defaultuser_and_password_in_registry.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/7cf4de2234a5dbae193ab353949191005c4acd55
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+  name: add_defaultuser_and_password_in_registry.yml
+  path: detections/endpoint/add_defaultuser_and_password_in_registry.yml
+  sha: 7cf4de2234a5dbae193ab353949191005c4acd55
+  size: 3549
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/add_defaultuser_and_password_in_registry.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - PUT
+          - GET
+          - DELETE
+          - OPTIONS
+          - HEAD
+          - TRACE
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683843960
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683843960
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/Splunk_Rules
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - gist
+  - notifications
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4940
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: 7cf4de2234a5dbae193ab353949191005c4acd55
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 3549
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/add_defaultuser_and_password_in_registry.yml?ref=develop
diff --git a/Splunk_Rules/add_or_set_windows_defender_exclusion.yml b/Splunk_Rules/add_or_set_windows_defender_exclusion.yml
new file mode 100644
index 0000000000..4e31c12e8e
--- /dev/null
+++ b/Splunk_Rules/add_or_set_windows_defender_exclusion.yml
@@ -0,0 +1,233 @@
+!!python/object:github.ContentFile.ContentFile
+_CompletableGithubObject__completed: false
+_content: &id001 !!python/object:github.GithubObject._NotSetType {}
+_download_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+_encoding: *id001
+_git_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/git/blobs/cd9ae227df4fb41094f4eca43dd23471d49a9087
+_headers:
+  access-control-allow-origin: '*'
+  access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP,
+    X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource,
+    X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type,
+    X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
+  cache-control: private, max-age=60, s-maxage=60
+  content-encoding: gzip
+  content-security-policy: default-src 'none'
+  content-type: application/json; charset=utf-8
+  date: Thu, 11 May 2023 22:26:09 GMT
+  etag: W/"42ce4381c12f6446596e7890f852548c8437a8d0"
+  last-modified: Thu, 11 May 2023 22:09:05 GMT
+  referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
+  server: GitHub.com
+  strict-transport-security: max-age=31536000; includeSubdomains; preload
+  transfer-encoding: chunked
+  vary: Accept, Authorization, Cookie, X-GitHub-OTP, Accept-Encoding, Accept, X-Requested-With
+  x-accepted-oauth-scopes: ''
+  x-content-type-options: nosniff
+  x-frame-options: deny
+  x-github-api-version-selected: '2022-11-28'
+  x-github-media-type: github.v3; format=json
+  x-github-request-id: F629:1066:95D054:13402E1:645D6B81
+  x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key,
+    admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, delete:packages,
+    delete_repo, gist, notifications, project, repo, user, workflow, write:discussion,
+    write:packages
+  x-ratelimit-limit: '5000'
+  x-ratelimit-remaining: '4954'
+  x-ratelimit-reset: '1683844596'
+  x-ratelimit-resource: core
+  x-ratelimit-used: '46'
+  x-xss-protection: '0'
+_html_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+_license: *id001
+_name: !!python/object:github.GithubObject._ValuedAttribute
+  value: add_or_set_windows_defender_exclusion.yml
+_path: !!python/object:github.GithubObject._ValuedAttribute
+  value: detections/endpoint/add_or_set_windows_defender_exclusion.yml
+_rawData:
+  _links:
+    git: https://api.github.com/repos/Simbaz22/security_content/git/blobs/cd9ae227df4fb41094f4eca43dd23471d49a9087
+    html: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+    self: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/add_or_set_windows_defender_exclusion.yml?ref=develop
+  download_url: https://raw.githubusercontent.com/Simbaz22/security_content/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+  git_url: https://api.github.com/repos/Simbaz22/security_content/git/blobs/cd9ae227df4fb41094f4eca43dd23471d49a9087
+  html_url: https://github.com/Simbaz22/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+  name: add_or_set_windows_defender_exclusion.yml
+  path: detections/endpoint/add_or_set_windows_defender_exclusion.yml
+  sha: cd9ae227df4fb41094f4eca43dd23471d49a9087
+  size: 3228
+  type: file
+  url: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/add_or_set_windows_defender_exclusion.yml?ref=develop
+_repository: *id001
+_requester: !!python/object:github.Requester.Requester
+  FIX_REPO_GET_GIT_REF: true
+  _Requester__app_auth: null
+  _Requester__authorizationHeader: token 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
+  _Requester__base_url: https://api.github.com
+  _Requester__connection: !!python/object:github.Requester.HTTPSRequestsConnectionClass
+    adapter: &id002 !!python/object:requests.adapters.HTTPAdapter
+      _pool_block: false
+      _pool_connections: 10
+      _pool_maxsize: 10
+      config: {}
+      max_retries: !!python/object:urllib3.util.retry.Retry
+        allowed_methods: &id003 !!python/object/apply:builtins.frozenset
+        - - PUT
+          - GET
+          - DELETE
+          - OPTIONS
+          - HEAD
+          - TRACE
+        backoff_factor: 0
+        connect: null
+        history: !!python/tuple []
+        other: null
+        raise_on_redirect: true
+        raise_on_status: true
+        read: false
+        redirect: null
+        remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+        - - authorization
+        respect_retry_after_header: true
+        status: null
+        status_forcelist: !!set {}
+        total: 0
+    headers:
+      Authorization: token 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
+      User-Agent: PyGithub/Python
+    host: api.github.com
+    input: null
+    pool_size: 10
+    port: 443
+    protocol: https
+    retry: 0
+    session: !!python/object:requests.sessions.Session
+      adapters: !!python/object/apply:collections.OrderedDict
+      - - - https://
+          - *id002
+        - - http://
+          - !!python/object:requests.adapters.HTTPAdapter
+            _pool_block: false
+            _pool_connections: 10
+            _pool_maxsize: 10
+            config: {}
+            max_retries: !!python/object:urllib3.util.retry.Retry
+              allowed_methods: *id003
+              backoff_factor: 0
+              connect: null
+              history: !!python/tuple []
+              other: null
+              raise_on_redirect: true
+              raise_on_status: true
+              read: false
+              redirect: null
+              remove_headers_on_redirect: !!python/object/apply:builtins.frozenset
+              - - authorization
+              respect_retry_after_header: true
+              status: null
+              status_forcelist: !!set {}
+              total: 0
+      auth: null
+      cert: null
+      cookies: !!python/object:requests.cookies.RequestsCookieJar
+        _cookies: {}
+        _now: 1683843961
+        _policy: !!python/object:http.cookiejar.DefaultCookiePolicy
+          _allowed_domains: null
+          _blocked_domains: !!python/tuple []
+          _now: 1683843961
+          hide_cookie2: false
+          netscape: true
+          rfc2109_as_netscape: null
+          rfc2965: false
+          secure_protocols: !!python/tuple
+          - https
+          - wss
+          strict_domain: false
+          strict_ns_domain: 0
+          strict_ns_set_initial_dollar: false
+          strict_ns_set_path: false
+          strict_ns_unverifiable: false
+          strict_rfc2965_unverifiable: true
+      headers: !!python/object:requests.structures.CaseInsensitiveDict
+        _store: !!python/object/apply:collections.OrderedDict
+        - - - user-agent
+            - !!python/tuple
+              - User-Agent
+              - python-requests/2.28.2
+          - - accept-encoding
+            - !!python/tuple
+              - Accept-Encoding
+              - gzip, deflate
+          - - accept
+            - !!python/tuple
+              - Accept
+              - '*/*'
+          - - connection
+            - !!python/tuple
+              - Connection
+              - keep-alive
+      hooks:
+        response: []
+      max_redirects: 30
+      params: {}
+      proxies: {}
+      stream: false
+      trust_env: true
+      verify: true
+    timeout: 15
+    url: /repos/mts-engineering/SIEM_Management/contents/Splunk_Rules
+    verb: GET
+    verify: true
+  _Requester__connectionClass: !!python/name:github.Requester.HTTPSRequestsConnectionClass ''
+  _Requester__hostname: api.github.com
+  _Requester__installation_authorization: null
+  _Requester__logger: !!python/object/apply:logging.getLogger
+  - github.Requester
+  _Requester__pool_size: null
+  _Requester__port: null
+  _Requester__prefix: ''
+  _Requester__retry: null
+  _Requester__scheme: https
+  _Requester__timeout: 15
+  _Requester__userAgent: PyGithub/Python
+  _Requester__verify: true
+  _frameBuffer: []
+  _frameCount: 0
+  oauth_scopes:
+  - admin:enterprise
+  - admin:gpg_key
+  - admin:org
+  - admin:org_hook
+  - admin:public_key
+  - admin:repo_hook
+  - admin:ssh_signing_key
+  - audit_log
+  - codespace
+  - delete:packages
+  - delete_repo
+  - gist
+  - notifications
+  - project
+  - repo
+  - user
+  - workflow
+  - write:discussion
+  - write:packages
+  per_page: 30
+  rate_limiting: !!python/tuple
+  - 4938
+  - 5000
+  rate_limiting_resettime: 1683844596
+_sha: !!python/object:github.GithubObject._ValuedAttribute
+  value: cd9ae227df4fb41094f4eca43dd23471d49a9087
+_size: !!python/object:github.GithubObject._ValuedAttribute
+  value: 3228
+_text_matches: *id001
+_type: !!python/object:github.GithubObject._ValuedAttribute
+  value: file
+_url: !!python/object:github.GithubObject._ValuedAttribute
+  value: https://api.github.com/repos/Simbaz22/security_content/contents/detections/endpoint/add_or_set_windows_defender_exclusion.yml?ref=develop