From a57caed90599a3841d2bf89c4485e71dd6a07678 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 1 Mar 2022 10:38:11 -0800
Subject: [PATCH] Update windows_file_without_extension_in_critical_folder.yml

---
 ...s_file_without_extension_in_critical_folder.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
index f2b2cb9510..aa1a544d87 100644
--- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
+++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
@@ -29,7 +29,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: unknown
+known_false_positives: Unknown at this point
 references:
 -  https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
@@ -53,16 +53,20 @@ tags:
   - Filesystem.user 
   - Filesystem.file_path 
   - Filesystem.dest
+  - Processes.process_name 
+  - Processes.dest 
+  - Processes.process_guid
+  - Processes.user 
   security_domain: endpoint
   impact: 90
   confidence: 100 
   # (impact * confidence)/100
   risk_score: 90
   context: 
-  - source:endpoint
-  - stage:Persistence
+  - Source:Endpoint
+  - Stage:Persistence
   - Privilege Escalation
-  message: driver file with out file extension drop in $file_path$ in $dest$
+  message: Driver file with out file extension drop in $file_path$ in $dest$
   observable:
   - name: user
     type: User
@@ -73,4 +77,4 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16