diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index 858f68a065..2c738a2083 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -39,6 +39,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 5d5fd2ce4c..7892aeb6de 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 9f5e9bb69b..414f1aad14 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -40,6 +40,7 @@ tags: - Suspicious Windows Registry Activities - Cloud Federated Credential Abuse - Windows Registry Abuse + - Hermetic Wiper cis20: - CIS 8 confidence: 95 diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index 5dfbcc9a56..3fd74c50d6 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index f6c6c22d88..b32d2605da 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -32,6 +32,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse + - Hermetic Wiper confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 515de1811b..44b59e6cc7 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -39,6 +39,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml index 9f2e0ccd51..e8a6828420 100644 --- a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper asset_type: Endpoint cis20: - CIS 5 diff --git a/detections/experimental/endpoint/print_processor_registry_autostart.yml b/detections/experimental/endpoint/print_processor_registry_autostart.yml index dbfc6288e0..1ef576ee5a 100644 --- a/detections/experimental/endpoint/print_processor_registry_autostart.yml +++ b/detections/experimental/endpoint/print_processor_registry_autostart.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Hermetic Wiper asset_type: Endpoint confidence: 100 context: