CARS_UPDATE_MITRE_ID_B2

detections/endpoint/7zip_commandline_to_smb_share_path.yml

@@ -44,6 +44,7 @@ tags:
     $dest$
   mitre_attack_id:
   - T1560.001
+  - T1560
   observable:
   - name: dest
     type: Hostname

detections/endpoint/access_lsass_memory_for_dump_creation.yml

@@ -43,6 +43,7 @@ tags:
     Service (LSASS).
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/account_discovery_with_net_app.yml

@@ -47,6 +47,7 @@ tags:
   message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: user
     type: User

detections/endpoint/active_setup_registry_autostart.yml

@@ -19,9 +19,9 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   Components*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name
   Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting
-  data that records registry activity from your hosts to populate the endpoint data
-  model in the registry node. This is typically populated via endpoint detection-and-response
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
   product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
   used for this search is typically generated via logs that report reads and writes
   to the registry.
@@ -39,6 +39,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1547.014
+  - T1547
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -42,6 +42,7 @@ tags:
     to prepare autoadminlogon
   mitre_attack_id:
   - T1552.002
+  - T1552
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/adsisearcher_account_discovery.yml

@@ -38,6 +38,7 @@ tags:
   message: powershell process having commandline $Message$ for user enumeration
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: ComputerName
     type: Hostname

detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml

@@ -36,6 +36,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1562.007
+  - T1562
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -42,6 +42,7 @@ tags:
     $dest$ by user $user$.
   mitre_attack_id:
   - T1021.001
+  - T1021
   observable:
   - name: user
     type: User

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -38,6 +38,7 @@ tags:
     user $user$.
   mitre_attack_id:
   - T1021.001
+  - T1021
   observable:
   - name: user
     type: User

detections/endpoint/allow_network_discovery_in_firewall.yml

@@ -38,6 +38,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1562.007
+  - T1562
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/anomalous_usage_of_7zip.yml

@@ -47,6 +47,7 @@ tags:
     of 7zip.
   mitre_attack_id:
   - T1560.001
+  - T1560
   observable:
   - name: user
     type: User

detections/endpoint/any_powershell_downloadfile.yml

@@ -48,6 +48,7 @@ tags:
     within PowerShell.
   mitre_attack_id:
   - T1059.001
+  - T1059
   observable:
   - name: user
     type: User

detections/endpoint/any_powershell_downloadstring.yml

@@ -45,6 +45,7 @@ tags:
     within PowerShell.
   mitre_attack_id:
   - T1059.001
+  - T1059
   observable:
   - name: user
     type: User

detections/endpoint/attacker_tools_on_endpoint.yml

@@ -53,6 +53,7 @@ tags:
   - T1036.005
   - T1595
   - T1003
+  - T1036
   nist:
   - ID.AM
   - PR.DS

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -46,6 +46,7 @@ tags:
     attempting to add a certificate to the store on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1553.004
+  - T1553
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/attempt_to_stop_security_service.yml

@@ -49,6 +49,7 @@ tags:
     attempting to disable security services on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -47,6 +47,7 @@ tags:
     on endpoint $dest$ by user $user$ attempting to export the registry keys.
   mitre_attack_id:
   - T1003.002
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/auto_admin_logon_registry_entry.yml

@@ -42,6 +42,7 @@ tags:
     to prepare autoadminlogon
   mitre_attack_id:
   - T1552.002
+  - T1552
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/batch_file_write_to_system32.yml

@@ -51,6 +51,7 @@ tags:
     by user $user$.
   mitre_attack_id:
   - T1204.002
+  - T1204
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/change_default_file_association.yml

@@ -36,6 +36,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1546.001
+  - T1546
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/clear_unallocated_sector_using_cipher_app.yml

@@ -40,6 +40,7 @@ tags:
     of a specific disk.
   mitre_attack_id:
   - T1070.004
+  - T1070
   observable:
   - name: user
     type: User

detections/endpoint/cmd_echo_pipe___escalation.yml

@@ -46,6 +46,8 @@ tags:
   mitre_attack_id:
   - T1059.003
   - T1543.003
+  - T1059
+  - T1543
   observable:
   - name: user
     type: User

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -45,6 +45,7 @@ tags:
     to execute commandline tool in $dest$
   mitre_attack_id:
   - T1059.007
+  - T1059
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -39,6 +39,7 @@ tags:
     on endpoint $Computer$ by user $user$.
   mitre_attack_id:
   - T1218.003
+  - T1218
   observable:
   - name: user
     type: User

detections/endpoint/control_loading_from_world_writable_directory.yml

@@ -48,6 +48,7 @@ tags:
     on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
   mitre_attack_id:
   - T1218.002
+  - T1218
   observable:
   - name: user
     type: User

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -46,6 +46,7 @@ tags:
     group.
   mitre_attack_id:
   - T1136.001
+  - T1136
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -43,6 +43,7 @@ tags:
     on endpoint $dest$ by user $user$ enumerating Windows file shares.
   mitre_attack_id:
   - T1070.005
+  - T1070
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/create_remote_thread_into_lsass.yml

@@ -41,6 +41,7 @@ tags:
     behavior is indicative of credential dumping and should be investigated.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/create_service_in_suspicious_file_path.yml

@@ -37,6 +37,7 @@ tags:
     $Service_Name$, potentially leading to a privilege escalation.
   mitre_attack_id:
   - T1569.002
+  - T1569
   observable:
   - name: Service_File_Name
     type: Other

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -47,6 +47,7 @@ tags:
     to disk. This behavior is related to dumping credentials via Task Manager.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/creation_of_shadow_copy.yml

@@ -45,6 +45,7 @@ tags:
     offline password cracking.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -43,6 +43,7 @@ tags:
     offline password cracking.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -45,6 +45,7 @@ tags:
     password cracking.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -43,6 +43,7 @@ tags:
     to grab credentials.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -39,6 +39,7 @@ tags:
     3, which may be indicative of the pass the hash technique.
   mitre_attack_id:
   - T1550.002
+  - T1550
   nist:
   - PR.PT
   - PR.AT

detections/endpoint/detect_azurehound_command_line_arguments.yml

@@ -46,6 +46,10 @@ tags:
   - T1482
   - T1069.002
   - T1069.001
+  - T1087
+  - T1087
+  - T1069
+  - T1069
   observable:
   - name: user
     type: User

detections/endpoint/detect_azurehound_file_modifications.yml

@@ -49,6 +49,10 @@ tags:
   - T1482
   - T1069.002
   - T1069.001
+  - T1087
+  - T1087
+  - T1069
+  - T1069
   observable:
   - name: user
     type: User

detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml

@@ -49,6 +49,7 @@ tags:
     $ComputerName$ by user $user$.
   mitre_attack_id:
   - T1003.002
+  - T1003
   observable:
   - name: user
     type: User

detections/endpoint/detect_credential_dumping_through_lsass_access.yml

@@ -47,6 +47,7 @@ tags:
     investigated.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - PR.IP
   - PR.AC

detections/endpoint/detect_empire_with_powershell_script_block_logging.yml

@@ -52,6 +52,7 @@ tags:
     on $ComputerName$ by $User$.
   mitre_attack_id:
   - T1059.001
+  - T1059
   observable:
   - name: User
     type: User

detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml

@@ -50,6 +50,7 @@ tags:
     to $user$.
   mitre_attack_id:
   - T1078.002
+  - T1078
   nist:
   - PR.IP
   observable:

detections/endpoint/detect_excessive_user_account_lockouts.yml

@@ -39,6 +39,7 @@ tags:
     related to $user$.
   mitre_attack_id:
   - T1078.003
+  - T1078
   nist:
   - PR.IP
   observable:

detections/endpoint/detect_exchange_web_shell.yml

@@ -66,6 +66,7 @@ tags:
     $dest$ by user $user$.
   mitre_attack_id:
   - T1505.003
+  - T1505
   observable:
   - name: user
     type: User

detections/endpoint/detect_html_help_renamed.yml

@@ -54,6 +54,7 @@ tags:
     $parent_process_name$.
   mitre_attack_id:
   - T1218.001
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -54,6 +54,7 @@ tags:
     behavior.
   mitre_attack_id:
   - T1218.001
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -58,6 +58,7 @@ tags:
     download a malicious payload.
   mitre_attack_id:
   - T1218.001
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -59,6 +59,7 @@ tags:
     a specific file within a CHM on $dest$ under user $user$.
   mitre_attack_id:
   - T1218.001
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -48,6 +48,7 @@ tags:
     to credential dumping on $Computer$. Review for further details.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.AE
   - DE.CM

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -50,6 +50,7 @@ tags:
     evasion.
   mitre_attack_id:
   - T1218.005
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_mshta_renamed.yml

@@ -47,6 +47,7 @@ tags:
     $parent_process_name$.
   mitre_attack_id:
   - T1218.005
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -51,6 +51,7 @@ tags:
     download an additional payload.
   mitre_attack_id:
   - T1218.005
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_new_local_admin_account.yml

@@ -42,6 +42,7 @@ tags:
     behavior or not.
   mitre_attack_id:
   - T1136.001
+  - T1136
   nist:
   - PR.AC
   - DE.CM

detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml

@@ -45,6 +45,7 @@ tags:
     using unquoted service paths.
   mitre_attack_id:
   - T1574.009
+  - T1574
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -49,6 +49,7 @@ tags:
     on endpoint $dest$ by user $user$ running prohibited applications.
   mitre_attack_id:
   - T1059.003
+  - T1059
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -54,6 +54,7 @@ tags:
     on endpoint $dest$ by user $user$ running the utility for possibly the first time.
   mitre_attack_id:
   - T1021.002
+  - T1021
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_regasm_spawning_a_process.yml

@@ -51,6 +51,7 @@ tags:
     behavior for $parent_process_name$.
   mitre_attack_id:
   - T1218.009
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_regasm_with_network_connection.yml

@@ -50,6 +50,7 @@ tags:
     on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
   mitre_attack_id:
   - T1218.009
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -49,6 +49,7 @@ tags:
     any command-line arguments on $dest$ by $user$.
   mitre_attack_id:
   - T1218.009
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -49,6 +49,7 @@ tags:
     on endpoint $dest$ by user $user$ typically not normal for this process.
   mitre_attack_id:
   - T1218.009
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_regsvcs_with_network_connection.yml

@@ -50,6 +50,7 @@ tags:
     on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
   mitre_attack_id:
   - T1218.009
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml

@@ -49,6 +49,7 @@ tags:
     any command-line arguments on $dest$ by $user$.
   mitre_attack_id:
   - T1218.009
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_regsvr32_application_control_bypass.yml

@@ -57,6 +57,7 @@ tags:
     by user $user$.
   mitre_attack_id:
   - T1218.010
+  - T1218
   nist:
   - DE.CM
   observable:

detections/endpoint/detect_renamed_7_zip.yml

@@ -42,6 +42,7 @@ tags:
     $parent_process_name$ on $dest$ by $user$.
   mitre_attack_id:
   - T1560.001
+  - T1560
   observable:
   - name: user
     type: User

detections/endpoint/detect_renamed_psexec.yml

@@ -50,6 +50,7 @@ tags:
     $parent_process_name$ on $dest$ by $user$.
   mitre_attack_id:
   - T1569.002
+  - T1569
   observable:
   - name: user
     type: User

detections/endpoint/detect_renamed_winrar.yml

@@ -45,6 +45,7 @@ tags:
     $parent_process_name$ on $dest$ by $user$.
   mitre_attack_id:
   - T1560.001
+  - T1560
   observable:
   - name: user
     type: User

detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

@@ -55,6 +55,7 @@ tags:
     was identified on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1218.011
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

@@ -53,6 +53,7 @@ tags:
     was identified on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1218.011
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml

@@ -55,6 +55,7 @@ tags:
     endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1218.011
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_rundll32_inline_hta_execution.yml

@@ -53,6 +53,7 @@ tags:
   message: Suspicious rundll32.exe inline HTA execution on $dest$
   mitre_attack_id:
   - T1218.005
+  - T1218
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_sharphound_command_line_arguments.yml

@@ -49,6 +49,10 @@ tags:
   - T1482
   - T1069.002
   - T1069.001
+  - T1087
+  - T1087
+  - T1069
+  - T1069
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_sharphound_file_modifications.yml

@@ -59,6 +59,10 @@ tags:
   - T1482
   - T1069.002
   - T1069.001
+  - T1087
+  - T1087
+  - T1069
+  - T1069
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_sharphound_usage.yml

@@ -54,6 +54,10 @@ tags:
   - T1482
   - T1069.002
   - T1069.001
+  - T1087
+  - T1087
+  - T1069
+  - T1069
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

@@ -44,6 +44,7 @@ tags:
   message: cmd.exe launching script interpreters on $dest$
   mitre_attack_id:
   - T1059.003
+  - T1059
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_wmi_event_subscription_persistence.yml

@@ -57,6 +57,7 @@ tags:
   message: Possible malicious WMI Subscription created on $dest$
   mitre_attack_id:
   - T1546.003
+  - T1546
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/disable_amsi_through_registry.yml

@@ -35,6 +35,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1562.001
+  - T1562
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/disable_etw_through_registry.yml

@@ -33,6 +33,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1562.001
+  - T1562
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/disable_logs_using_wevtutil.yml

@@ -39,6 +39,7 @@ tags:
   message: WevtUtil.exe used to disable Event Logging on $dest
   mitre_attack_id:
   - T1070.001
+  - T1070
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/disable_registry_tool.yml

@@ -41,6 +41,7 @@ tags:
   message: Disabled Registry Tools on $dest$
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/disable_show_hidden_files.yml

@@ -44,6 +44,8 @@ tags:
   mitre_attack_id:
   - T1564.001
   - T1562.001
+  - T1564
+  - T1562
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/disable_uac_remote_restriction.yml

@@ -37,6 +37,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1548.002
+  - T1548
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -43,6 +43,7 @@ tags:
   message: Disabled 'Windows App Hotkeys' on $dest$
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -49,6 +49,7 @@ tags:
   message: Windows Defender real time behavior monitoring disabled on $dest
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/disable_windows_smartscreen_protection.yml

@@ -41,6 +41,7 @@ tags:
   message: The Windows Smartscreen was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/disabling_cmd_application.yml

@@ -40,6 +40,7 @@ tags:
   message: The Windows command prompt was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/disabling_controlpanel.yml

@@ -39,6 +39,7 @@ tags:
   message: The Windows Control Panel was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/disabling_firewall_with_netsh.yml

@@ -42,6 +42,7 @@ tags:
   message: The Windows Firewall was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/disabling_folderoptions_windows_feature.yml

@@ -41,6 +41,7 @@ tags:
   message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/disabling_norun_windows_app.yml

@@ -43,6 +43,7 @@ tags:
     start menu on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/disabling_remote_user_account_control.yml

@@ -43,6 +43,7 @@ tags:
     Account Control (UAC) were modified on $dest$ by $user$.
   mitre_attack_id:
   - T1548.002
+  - T1548
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -43,6 +43,7 @@ tags:
     $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/disabling_task_manager.yml

@@ -41,6 +41,7 @@ tags:
   message: The Windows Task Manager was disabled on $dest$ by $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   observable:
   - name: user
     type: User

detections/endpoint/domain_account_discovery_with_dsquery.yml

@@ -40,6 +40,7 @@ tags:
   message: an instance of process $process_name$ with commandline $process$ in $dest$
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: user
     type: User

detections/endpoint/domain_account_discovery_with_net_app.yml

@@ -40,6 +40,7 @@ tags:
   message: an instance of process $process_name$ with commandline $process$ in $dest$
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: user
     type: User

detections/endpoint/domain_account_discovery_with_wmic.yml

@@ -41,6 +41,7 @@ tags:
   message: an instance of process $process_name$ with commandline $process$ in $dest$
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: user
     type: User

detections/endpoint/domain_group_discovery_with_adsisearcher.yml

@@ -38,6 +38,7 @@ tags:
   message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
   mitre_attack_id:
   - T1069.002
+  - T1069
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/domain_group_discovery_with_dsquery.yml

@@ -39,6 +39,7 @@ tags:
   message: Domain group discovery enumeration on $dest$ by $user$
   mitre_attack_id:
   - T1069.002
+  - T1069
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/domain_group_discovery_with_net.yml

@@ -39,6 +39,7 @@ tags:
   message: Domain group discovery enumeration on $dest$ by $user$
   mitre_attack_id:
   - T1069.002
+  - T1069
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/domain_group_discovery_with_wmic.yml

@@ -40,6 +40,7 @@ tags:
   message: Domain group discovery enumeration on $dest$ by $user$
   mitre_attack_id:
   - T1069.002
+  - T1069
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/drop_icedid_license_dat.yml

@@ -36,6 +36,7 @@ tags:
   message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
   mitre_attack_id:
   - T1204.002
+  - T1204
   observable:
   - name: Computer
     type: Hostname

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -45,6 +45,7 @@ tags:
     accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.CM
   observable: