diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index f9895cc7a6..cb2b417336 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -35,6 +35,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 50 impact: 50 message: A registry modification in Windows auto update notification on $dest$ diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index 0f8ea8a05d..0524d51310 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -33,6 +33,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification to disable Windows Defender notification on $dest$ diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index e7626c0387..fbe6a51061 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -37,6 +37,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 50 impact: 50 message: a registry modification in Windows auto update configuration in $dest$ diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index acc6dd1b97..af7aa24426 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -35,6 +35,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 30 impact: 30 message: A registry modification in Windows auto update configuration on $dest$ diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index 6f2e7be2b1..95972af220 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -35,6 +35,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification in Windows auto update configuration on $dest$ diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index 058432a56e..b635a29529 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -33,6 +33,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification to tamper Windows Defender protection on $dest$