From 55dfdddc4fa415f0e676af841eb08874bbbc8754 Mon Sep 17 00:00:00 2001
From: Michael Haag <michaelahaag+net@gmail.com>
Date: Tue, 20 May 2025 10:48:07 -0600
Subject: [PATCH] xworm

---
 detections/endpoint/powershell_4104_hunting.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index 5055866c6c..fe81470f71 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -77,6 +77,7 @@ tags:
     - SystemBC
     - PHP-CGI RCE Attack on Japanese Organizations
     - Water Gamayun
+    - XWorm
   asset_type: Endpoint
   mitre_attack_id:
   - T1059.001