secondbatchwinprivesctaghermeticwiper

detections/endpoint/msi_module_loaded_by_non_system_binary.yml

@@ -39,6 +39,7 @@ references:
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -40,6 +40,7 @@ tags:
   - Suspicious Windows Registry Activities
   - Cloud Federated Credential Abuse
   - Windows Registry Abuse
+  - Hermetic Wiper 
   cis20:
   - CIS 8
   confidence: 95

detections/endpoint/runas_execution_in_commandline.yml

@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/screensaver_event_trigger_execution.yml

@@ -32,6 +32,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Registry Abuse
+  - Hermetic Wiper 
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/time_provider_persistence_registry.yml

@@ -39,6 +39,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Registry Abuse
+  - Hermetic Wiper 
   confidence: 100
   context:
   - Source:Endpoint

detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml

@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   asset_type: Endpoint
   cis20:
   - CIS 5

detections/experimental/endpoint/print_processor_registry_autostart.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Hermetic Wiper 
   asset_type: Endpoint
   confidence: 100
   context: