From 12c8dccc593f0625edb72e3d7a0b44d027a7cae0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 7 Dec 2021 14:46:35 -0700
Subject: [PATCH] added T

---
 detections/endpoint/detect_exchange_web_shell.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index ef48bc9c3b..6f2e31b762 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -67,6 +67,7 @@ tags:
   mitre_attack_id:
   - T1505
   - T1505.003
+  - T1190
   observable:
   - name: user
     type: User