From 51b72ea3b35bae5792efab7ec6f98744fafdaa44 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 3 Aug 2021 14:24:34 +0200
Subject: [PATCH] icedid

---
 .../winevent_scheduled_task_created_within_public_path.yml       | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 9e51610551..5312bb558b 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -46,6 +46,7 @@ tags:
   - Windows Persistence Techniques
   - Ransomware
   - Ryuk Ransomware
+  - Icedid
   automated_detection_testing: passed
   confidence: 100
   context: