Branch was auto-updated.

detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml

@@ -33,6 +33,7 @@ tags:
   analytic_story:
   - Cobalt Strike
   - NOBELIUM Group
+  - Insider Threat
   cis20: []
   confidence: 60
   context:

detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Ryuk Ransomware
   - Ransomware
+  - Information Sabotage
   cis20:
   - CIS 8
   confidence: 80

detections/endpoint/ssa___deny_permission_using_cacls_utility.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Information Sabotage
   cis20:
   - CIS 14
   - CIS 16

detections/endpoint/ssa___detect_rclone_command_line_usage.yml

@@ -44,6 +44,7 @@ tags:
   analytic_story:
   - DarkSide Ransomware
   - Ransomware
+  - Insider Threat
   cis20: []
   confidence: 70
   context:

detections/endpoint/ssa___fsutil_zeroing_file.yml

@@ -33,6 +33,8 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Insider Threat
+  - Information Sabotage
   cis20: []
   confidence: 90
   context:

detections/endpoint/ssa___grant_permission_using_cacls_utility.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Insider Threat
   cis20:
   - CIS 14
   - CIS 16

detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -36,6 +36,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Windows Persistence Techniques
   - Information Sabotage
+  - Insider Threat
   cis20:
   - CIS 14
   - CIS 16

detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml

@@ -38,6 +38,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
+  - Insider Threat
   cis20:
   - CIS 8
   confidence: 50

detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml

@@ -38,6 +38,7 @@ tags:
   - Windows Log Manipulation
   - Ransomware
   - Clop Ransomware
+  - Insider Threat
   cis20:
   - CIS 8
   - CIS 13

detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml

@@ -34,6 +34,8 @@ tags:
   analytic_story:
   - Windows Log Manipulation
   - Ransomware
+  - Insider Threat
+  - Information Sabotage
   cis20:
   - CIS 8
   - CIS 13

detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml

@@ -52,6 +52,7 @@ references:
 tags:
   analytic_story:
   - Ingress Tool Transfer
+  - Insider Threat
   cis20: []
   confidence: 100
   context:

dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Cobalt Strike
   - NOBELIUM Group
+  - Insider Threat
   cis20: []
   kill_chain_phases:
   - Exploitation

dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - Ryuk Ransomware
   - Ransomware
+  - Information Sabotage
   cis20:
   - CIS 8
   kill_chain_phases:

dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Information Sabotage
   cis20:
   - CIS 14
   - CIS 16

dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
+  - Insider Threat
   cis20:
   - CIS 8
   kill_chain_phases:

dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml

@@ -39,6 +39,7 @@ tags:
   analytic_story:
   - DarkSide Ransomware
   - Ransomware
+  - Insider Threat
   cis20: []
   kill_chain_phases:
   - Exploitation

dist/ssa/srs/ssa___fsutil_zeroing_file.yml

@@ -28,6 +28,8 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Insider Threat
+  - Information Sabotage
   cis20: []
   kill_chain_phases:
   - Exploitation

dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Insider Threat
   cis20:
   - CIS 14
   - CIS 16

dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -31,6 +31,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Windows Persistence Techniques
   - Information Sabotage
+  - Insider Threat
   cis20:
   - CIS 14
   - CIS 16

dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml

@@ -33,6 +33,7 @@ tags:
   - Windows Log Manipulation
   - Ransomware
   - Clop Ransomware
+  - Insider Threat
   cis20:
   - CIS 8
   - CIS 13

dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml

@@ -29,6 +29,8 @@ tags:
   analytic_story:
   - Windows Log Manipulation
   - Ransomware
+  - Insider Threat
+  - Information Sabotage
   cis20:
   - CIS 8
   - CIS 13

dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml

@@ -47,6 +47,7 @@ references:
 tags:
   analytic_story:
   - Ingress Tool Transfer
+  - Insider Threat
   cis20: []
   kill_chain_phases:
   - Exploitation