From 2db2f77d69f71d17b9805ea8ce1d84d697fb1fea Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 31 Mar 2021 11:32:45 -0600
Subject: [PATCH] Ingress Tool Transfer Story Adds

---
 detections/endpoint/any_powershell_downloadfile.yml   | 1 +
 detections/endpoint/any_powershell_downloadstring.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index 55cbd2377c..afe2f0cf0b 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Malicious PowerShell
+  - Ingress Tool Transfer
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 9b335941a7..018246a866 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - HAFNIUM Group
+  - Ingress Tool Transfer
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log