From df4623a652e1ae2b2e22ecc61c23b8438fb1084f Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Wed, 3 Nov 2021 17:04:39 -0500
Subject: [PATCH] Update ssa___modify_acls_permission_of_files_or_folders.yml

---
 .../ssa___modify_acls_permission_of_files_or_folders.yml   | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 1c0ffacf41..e0aac55457 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -49,6 +49,12 @@ tags:
     a permission of a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
+  cis20:
+  - CIS 8
+  - CIS 13
+  nist:
+  - PR.DS
+  - PR.IP
   observable:
   - name: dest_device_id
     type: Hostname
@@ -69,4 +75,5 @@ tags:
   - dest_user_id
   - process
   risk_score: 35
+  risk_severity: medium
   security_domain: endpoint