From 4e0776d751358505e3237cb2df612357e2d16e19 Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Tue, 23 Mar 2021 13:12:47 -0700
Subject: [PATCH] updates

---
 .../cloud/aws_create_policy_version_to_allow_all_resources.yml  | 2 +-
 detections/cloud/aws_createaccesskey.yml                        | 2 +-
 detections/cloud/aws_createloginprofile.yml                     | 2 +-
 detections/cloud/aws_setdefaultpolicyversion.yml                | 2 +-
 detections/cloud/aws_updateloginprofile.yml                     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
index 792ff3d28b..c9c846f28a 100644
--- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
@@ -34,7 +34,7 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
-  - T1078
+  - T1078.004
   nist:
   - PR.DS
   - PR.AC
diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml
index 271dab0c36..6441c1b7e7 100644
--- a/detections/cloud/aws_createaccesskey.yml
+++ b/detections/cloud/aws_createaccesskey.yml
@@ -30,7 +30,7 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
-  - T1078
+  - T1136.003
   nist:
   - PR.DS
   - PR.AC
diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml
index 35d0b2605e..c15ca04dca 100644
--- a/detections/cloud/aws_createloginprofile.yml
+++ b/detections/cloud/aws_createloginprofile.yml
@@ -32,7 +32,7 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
-  - T1078
+  - T1136.003
   nist:
   - PR.DS
   - PR.AC
diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml
index 95cca93e47..6e770a2178 100644
--- a/detections/cloud/aws_setdefaultpolicyversion.yml
+++ b/detections/cloud/aws_setdefaultpolicyversion.yml
@@ -32,7 +32,7 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
-  - T1078
+  - T1078.004
   nist:
   - PR.DS
   - PR.AC
diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml
index 431d7ae19e..193ebaf94b 100644
--- a/detections/cloud/aws_updateloginprofile.yml
+++ b/detections/cloud/aws_updateloginprofile.yml
@@ -30,7 +30,7 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
-  - T1078
+  - T1136.003
   nist:
   - PR.DS
   - PR.AC