From 5eb042fb6441af2ebbebf540dae3a75afa0b8425 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 May 2023 09:17:57 -0600 Subject: [PATCH] Atomic GUIDs --- .../endpoint/windows_snake_malware_file_modification_crmlog.yml | 2 +- .../endpoint/windows_snake_malware_kernel_driver_comadmin.yml | 2 +- ..._snake_malware_registry_modification_wav_openwithprogids.yml | 2 +- detections/endpoint/windows_snake_malware_service_create.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 7cb441be9a..4f0e729352 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -21,7 +21,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - 7e47ee60-9dd1-4269-9c4f-97953b183268 confidence: 50 impact: 50 message: A file related to Snake Malware has been identified on $dest$. diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index f60d0fdd6b..b71f4fb3de 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -22,7 +22,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - e5cb5564-cc7b-4050-86e8-f2d9eec1941f confidence: 80 impact: 70 message: A kernel driver comadmin.dat related to Snake Malware was written to disk on $dest$. diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index c19688f512..c4cb696858 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -23,7 +23,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - 8318ad20-0488-4a64-98f4-72525a012f6b confidence: 50 impact: 50 message: A registry modification related to Snake Malware has been identified on $dest$. diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index eefa69cc05..eccc77b28e 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -24,7 +24,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - b8db787e-dbea-493c-96cb-9272296ddc49 confidence: 90 impact: 80 message: A service, WerFaultSvc, was created on $dest$ and is related to Snake Malware.