From 3dcec803a023355d513fa5d3731a3edcff044e39 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 11 Nov 2022 14:25:39 +0100
Subject: [PATCH] Update windows_iso_lnk_file_creation.yml

---
 detections/endpoint/windows_iso_lnk_file_creation.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml
index a3bdb3d472..d74e99f947 100644
--- a/detections/endpoint/windows_iso_lnk_file_creation.yml
+++ b/detections/endpoint/windows_iso_lnk_file_creation.yml
@@ -19,6 +19,7 @@ known_false_positives: False positives may be high depending on the environment
 references:
 - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
 - https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1
+- https://isc.sans.edu/diary/Recent+AZORult+activity/25120
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -26,6 +27,7 @@ tags:
   - AgentTesla
   - Qakbot
   - IcedID
+  - Azorult
   asset_type: Endpoint
   cis20:
   - CIS 3