From bc1b90b8a63eaa92f96ddef7630930573b553d6d Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 14 Nov 2022 13:49:55 +0100
Subject: [PATCH] cisa_coverage2

---
 detections/endpoint/office_product_spawning_certutil.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml
index 2e439244cc..d82f0b92d0 100644
--- a/detections/endpoint/office_product_spawning_certutil.yml
+++ b/detections/endpoint/office_product_spawning_certutil.yml
@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - AgentTesla
+  - Trickbot
   confidence: 90
   context:
   - Source:Endpoint