From 4bceed97461967eca1f37cbf5d1885eb044ea982 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 11 Nov 2022 15:20:55 +0100 Subject: [PATCH] cisa_coverage --- .../endpoint/office_product_spawning_windows_script_host.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 9c2dba2783..5794eb6433 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -18,9 +18,11 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed. references: - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ + - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing tags: analytic_story: - Spearphishing Attachments + - Remcos confidence: 90 context: - Source:Endpoint