From 667396b4ced467e0e0cc326e55f506cbb35bfdb9 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Jun 2021 17:04:51 -0700
Subject: [PATCH] updated rba spec

---
 .../access_lsass_memory_for_dump_creation.yml | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
index eadbd405d5..288d94ffdd 100644
--- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
@@ -50,3 +50,31 @@ tags:
   - SourceImage
   - SourceProcessId
   security_domain: endpoint
+  impact: 3
+  confidence: 8
+  context:
+  - Scope:Network
+  - Local
+  - Signature
+  - RareDomain
+  message: the $src$ is infected by $client$
+  risk_score: 50
+  risk_observable:
+    - name: dest
+      type: User
+      role: 
+      - Target
+      - Victim
+    - name: user
+      type: Endpoint
+      role: 
+      - Target
+      - Victim
+
+  threat_observable:
+      - name: TargetImage
+        type: TargetImage
+        role: 
+        - Known Bad
+
+