adding sunburst as tags for relavant detections

baselines/previously_seen_running_windows_services.yml

@@ -17,6 +17,7 @@ tags:
   analytics_story:
   - Orangeworm Attack Group
   - Windows Service Abuse
+  - Sunburst Malware
   detections:
   - First Time Seen Running Windows Service
   deployments:

baselines/previously_seen_running_windows_services_update.yml

@@ -22,6 +22,7 @@ tags:
   analytics_story:
   - Orangeworm Attack Group
   - Windows Service Abuse
+  - Sunburst Malware
   detections:
   - First Time Seen Running Windows Service
   deployments:

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -25,6 +25,7 @@ tags:
   - Suspicious Command-Line Executions
   - Suspicious MSHTA Activity
   - Suspicious Zoom Child Processes
+  - Sunburst Malware
   mitre_attack_id:
   - T1059.003
   kill_chain_phases:

detections/endpoint/first_time_seen_running_windows_service.yml

@@ -28,6 +28,7 @@ tags:
   analytics_story:
   - Windows Service Abuse
   - Orangeworm Attack Group
+  - Sunburst Malware
   mitre_attack_id:
   - T1569.002
   kill_chain_phases:

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -23,6 +23,7 @@ known_false_positives: System administrators may use this option, but it's not c
 tags:
   analytics_story:
   - Malicious PowerShell
+  - Sunburst Malware
   mitre_attack_id:
   - T1027
   kill_chain_phases:

detections/endpoint/sc_exe_manipulating_windows_services.yml

@@ -23,6 +23,7 @@ tags:
   - Orangeworm Attack Group
   - Windows Persistence Techniques
   - Disabling Security Tools
+  - Sunburst Malware
   mitre_attack_id:
   - T1543.003
   kill_chain_phases:

detections/network/detect_outbound_smb_traffic.yml

@@ -37,6 +37,7 @@ tags:
   analytics_story:
   - Hidden Cobra Malware
   - DHS Report TA18-074A
+  - Sunburst Malware
   mitre_attack_id:
   - T1071.002
   kill_chain_phases:

detections/network/tor_traffic.yml

@@ -24,6 +24,7 @@ tags:
   - Prohibited Traffic Allowed or Protocol Mismatch
   - Ransomware
   - Command and Control
+  - Sunburst Malware
   mitre_attack_id:
   - T1071.001
   kill_chain_phases: