From 970d7e90318b11e6aceb8d6f2fe2a8628ae87ec7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 12 Feb 2021 12:12:37 -0700
Subject: [PATCH] accidental story

---
 .../suspicious_regsvcs_regasm_activity.yml    | 22 -------------------
 1 file changed, 22 deletions(-)
 delete mode 100644 stories/suspicious_regsvcs_regasm_activity.yml

diff --git a/stories/suspicious_regsvcs_regasm_activity.yml b/stories/suspicious_regsvcs_regasm_activity.yml
deleted file mode 100644
index c7def0b598..0000000000
--- a/stories/suspicious_regsvcs_regasm_activity.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-author: Michael Haag, Splunk
-date: '2021-02-11'
-description: Monitor and detect techniques used by attackers who leverage the mshta.exe
-  process to execute malicious code.
-id: 2cdf33a0-4805-4b61-b025-59c20f418fbe
-name: Suspicious Regsvcs Regasm Activity
-narrative: ' Not done yet '
-references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md
-- https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
-tags:
-  analytic_story: Suspicious Regsvcs Regasm Activity
-  category:
-  - Adversary Tactics
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Advanced Threat Detection
-type: ESCU
-version: 1