Added missing nist and cis20 fields to 3 experimental detections.

detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - IcedID
   automated_detection_testing: passed
+  cis20: []
   confidence: 70
   context:
   - Source:Endpoint
@@ -47,6 +48,7 @@ tags:
   mitre_attack_id:
   - T1562.001
   - T1562
+  nist: []
   observable:
   - name: dest
     type: Hostname

detections/experimental/endpoint/ssa___excessive_number_of_office_files_copied.yml

@@ -27,6 +27,7 @@ references: []
 tags:
   analytic_story:
   - Insider Threat
+  cis20: []
   confidence: 80
   context:
   - Source:Endpoint
@@ -39,6 +40,7 @@ tags:
   message: High number of files copied
   mitre_attack_id:
   - T1048.003
+  nist: []
   observable:
   - name: dest_user_id
     type: User

detections/experimental/endpoint/ssa___high_file_deletion_frequency.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Clop Ransomware
   - Insider Threat
+  cis20: []
   confidence: 80
   context:
   - Source:Endpoint
@@ -47,6 +48,7 @@ tags:
   message: High frequency file deletion activity detected on host $Computer$
   mitre_attack_id:
   - T1485
+  nist: []
   observable:
   - name: user
     type: User