diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index 86fc6419ed..a9ef52f8a6 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -31,7 +31,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1055 - T1068 - T1078 diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 76033240cc..ff9570b530 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -33,7 +33,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1055 - T1068 - T1078 diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index a9fbfe364a..1928fadc18 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -28,7 +28,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1078 - T1098 - T1087 diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index 10669bcbc2..15a818e898 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -38,7 +38,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.AC diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 99d03f526a..6eb4d35391 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -39,7 +39,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.AC diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 9c8372ab3e..66165baa8a 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -35,7 +35,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.AC diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index deb6c19961..6290060a2b 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -33,7 +33,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.AC diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 312e52193e..077bfe34eb 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -31,7 +31,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.IP diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index e2bdad87a2..16eccd2dfd 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -29,7 +29,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 - T1555 nist: diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index e0596efb21..ae9272f7b9 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -34,7 +34,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.AC diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 319a629ae4..cb9db98b20 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -38,7 +38,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.IP diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index f01749197a..474b91d093 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -34,7 +34,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.AC diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index dd77c7a10e..b571a165e0 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -35,7 +35,7 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1003 nist: - PR.AC diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index d948947380..86ef3bd37e 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -37,12 +37,7 @@ tags: kill_chain_phases: - Command and Control - Actions on Objectives - mitre_attack: - - Execution - - Scripting - - Persistence - - Command-Line Interface - mitre_technique_id: + mitre_attack_id: - T1059 - T1117 - T1202 diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index 932ff82f8b..b376126867 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -33,7 +33,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1021 - T1113 - T1123 diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 7295c87e80..957ba2115a 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -28,7 +28,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1585 nist: - PR.AC diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 708b8caa17..68037b59c2 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -29,7 +29,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1078 - T1098 nist: diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 801c3a48a3..a60f17bbc7 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -29,7 +29,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1070 nist: - PR.AC diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 9cae8d5559..336d4e8372 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -31,7 +31,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1098 - T1207 - T1484 diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index b10f0022d7..c85690fd9a 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -32,7 +32,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1098 - T1207 - T1484 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 5fca5d3491..af57bf40cd 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -32,7 +32,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1053 - T1134 - T1548 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index dfc7caecd4..abe229cae2 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -29,7 +29,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1134 - T1548 nist: diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index e48c0e2dc7..48bc0d341c 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -32,7 +32,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1055 - T1106 - T1569 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index f4873171d8..35bcc45b53 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -40,7 +40,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1055 - T1106 - T1569 diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 49aabffa48..533125e359 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -30,7 +30,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1078 - T1098 nist: diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 96e8b9d861..b95526d78d 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -36,7 +36,7 @@ tags: - CIS 8 kill_chain_phases: - Exploitation - mitre_technique_id: + mitre_attack_id: - T1059 nist: - PR.PT diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index cae920db5c..1c77e8e1a6 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -60,7 +60,7 @@ tags: - CIS 8 kill_chain_phases: - Exploitation - mitre_technique_id: + mitre_attack_id: - T1203 - T1059 - T1053 diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index c9e5137bbb..0b7719dba9 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -41,7 +41,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1053 - T1068 - T1078 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 3b17eac833..231ab0a12c 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -50,7 +50,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1078 - T1087 - T1484 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 2f883249b5..734b7f6ffa 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -29,7 +29,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1078 - T1087 - T1484 diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index 79294b6bc3..c690611bab 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -40,7 +40,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1199 - T1482 - T1590 diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 85e186cde5..8d367a6176 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -33,7 +33,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1592 - T1590 - T1087 diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index 8cd9d7b26b..b560b3e926 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -28,7 +28,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1592 nist: - PR.AC diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 943a54c3d8..322a14cd76 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -35,7 +35,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1007 - T1012 - T1046 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index 9e5d48b30b..0531d79905 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -28,7 +28,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1021.002 - T1135 - T1039 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 585c65b3ab..014a52e628 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -33,7 +33,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1021.002 - T1135 - T1039 diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index fb6b7dc776..00376d8266 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -34,7 +34,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1021.002 - T1135 - T1039 diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 9acc663a70..e68d1bbf83 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -31,7 +31,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1589.001 - T1590.001 - T1590.003 diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index c4c33b45d7..3144c0201a 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -28,7 +28,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1595.002 - T1592.002 nist: diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index 0bbbbd47da..2b23aa38ef 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -28,7 +28,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1068 - T1078 - T1098 diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 131c82ca42..a2bfc5c823 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -33,7 +33,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1543 - T1055 - T1574 diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index f6f89efba7..d388dc0620 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -29,7 +29,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1007 - T1046 - T1057 diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index d59251a5a9..305ad3a7b3 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -34,7 +34,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1068 - T1078 - T1098 diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 7e48a5013d..e41310e82d 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -29,7 +29,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1068 - T1078 - T1098 diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index b06a294d1c..137e20b0e0 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -28,7 +28,7 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1068 - T1078 - T1098 diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index e99736c215..00a043d53a 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -235,7 +235,7 @@ tags: - CIS 8 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1036 nist: - PR.PT diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index c813c5bc12..3f2f33ae95 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -54,7 +54,7 @@ tags: - CIS 8 kill_chain_phases: - Exploitation - mitre_technique_id: + mitre_attack_id: - T1059 - T1053 nist: diff --git a/detections/experimental/application/detect_phishing_content___ssa.yml b/detections/experimental/application/detect_phishing_content___ssa.yml index 9fc137905b..404d5e4d92 100644 --- a/detections/experimental/application/detect_phishing_content___ssa.yml +++ b/detections/experimental/application/detect_phishing_content___ssa.yml @@ -49,7 +49,7 @@ tags: - CIS 8 kill_chain_phases: - Actions on Objectives - mitre_technique_id: + mitre_attack_id: - T1566 nist: - PR.PT