From cdab1e8c74e3ceb18523f647cf092105a687aa51 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 20 Dec 2021 12:17:04 +0100
Subject: [PATCH 1/9] new_ssa_ifo_sabotage

---
 ...ar_unallocated_sector_using_cipher_app.yml | 91 +++++++++++++++++++
 ..._files_and_directories_with_attrib_exe.yml | 79 ++++++++++++++++
 ...allocated_sector_using_cipher_app.test.yml | 10 ++
 ...s_and_directories_with_attrib_exe.test.yml | 10 ++
 4 files changed, 190 insertions(+)
 create mode 100644 detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
 create mode 100644 detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
 create mode 100644 tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
 create mode 100644 tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml

diff --git a/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
new file mode 100644
index 0000000000..47d459485a
--- /dev/null
+++ b/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
@@ -0,0 +1,91 @@
+name: Clear Unallocated Sector Using Cipher App
+id: 8f907d90-6173-11ec-9c23-acde48001122
+version: 1
+date: '2021-12-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: this search is to detect execution of `cipher.exe` to clear the unallocated
+  sectors of a specific disk. This technique was seen in some ransomware to make it
+  impossible to forensically recover deleted files.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: administrator may execute this app to manage disk
+references:
+- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
+- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
+tags:
+  analytic_story:
+  - Ransomware
+  - Information Sabotage
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1070.004
+  - T1070
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 100 
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
+    of a specific disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  nist:
+  - CIS 4
+  - CIS 16
+  cis20:
+  - DE.CM
\ No newline at end of file
diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
new file mode 100644
index 0000000000..e37890a364
--- /dev/null
+++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -0,0 +1,79 @@
+name: Hiding Files And Directories With Attrib exe
+id: 028e4406-6176-11ec-aec2-acde48001122
+version: 1
+date: '2021-12-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
+  as hidden by using specific flags so that the victim does not see the file.  The
+  search looks for specific command-line arguments to detect the use of attrib.exe
+  to hide files.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) 
+  | into write_ssa_detected_events();'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: 'Some applications and users may legitimately use attrib.exe
+  to interact with the files. '
+references:
+-  https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Persistence Techniques
+  - Information Sabotage
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222.001
+  - T1222
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 80
+  confidence: 90 
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  - Stage:Persistence
+  message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process
+    type: Other
+    role:
+    - Attacker
+    - Parent Process
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 8
\ No newline at end of file
diff --git a/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
new file mode 100644
index 0000000000..2ffd981acd
--- /dev/null
+++ b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
@@ -0,0 +1,10 @@
+name: Saa Clear Unallocated Sector Using Cipher App Unit Test
+tests:
+  - name: Saa Clear Unallocated Sector Using Cipher App
+    file: endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of Cipher Application execution
+    attack_data:
+    - file_name: security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+      source: WinEventLog:Security
diff --git a/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
new file mode 100644
index 0000000000..b6b33ab812
--- /dev/null
+++ b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
@@ -0,0 +1,10 @@
+name: Ssa Hiding Files And Directories With Attrib exe Unit Test
+tests:
+  - name: Ssa Hiding Files And Directories With Attrib exe
+    file: endpoint/ssa_hiding_files_and_directories_with_attrib_exe.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of attrib Application execution
+    attack_data:
+    - file_name: security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+      source: WinEventLog:Security
\ No newline at end of file

From d6581e728b7a7a392d9d6eaf733b4dd4c55ee586 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 20 Dec 2021 12:21:04 +0100
Subject: [PATCH 2/9] new_ssa_info_sabotage

---
 .../ssa___clear_unallocated_sector_using_cipher_app.yml         | 2 +-
 .../ssa___hiding_files_and_directories_with_attrib_exe.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
index 47d459485a..2e79a679e7 100644
--- a/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+++ b/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: this search is to detect execution of `cipher.exe` to clear the unallocated
   sectors of a specific disk. This technique was seen in some ransomware to make it
   impossible to forensically recover deleted files.
diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
index e37890a364..2d218b9850 100644
--- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
   as hidden by using specific flags so that the victim does not see the file.  The
   search looks for specific command-line arguments to detect the use of attrib.exe

From 9cf834a5f10901c6cb5247de7a35939ed7bf0402 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 20 Dec 2021 12:25:34 +0100
Subject: [PATCH 3/9] new_ssa_info_sabotage

---
 ...ssa___clear_unallocated_sector_using_cipher_app.test.yml | 4 ++--
 ...___hiding_files_and_directories_with_attrib_exe.test.yml | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
index 2ffd981acd..783042d77d 100644
--- a/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
+++ b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
@@ -1,6 +1,6 @@
-name: Saa Clear Unallocated Sector Using Cipher App Unit Test
+name: Clear Unallocated Sector Using Cipher App Unit Test
 tests:
-  - name: Saa Clear Unallocated Sector Using Cipher App
+  - name: Clear Unallocated Sector Using Cipher App
     file: endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
     pass_condition: '@count_gt(0)'
     description: Test detection of Cipher Application execution
diff --git a/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
index b6b33ab812..dc26b98475 100644
--- a/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
+++ b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
@@ -1,7 +1,7 @@
-name: Ssa Hiding Files And Directories With Attrib exe Unit Test
+name: Hiding Files And Directories With Attrib exe Unit Test
 tests:
-  - name: Ssa Hiding Files And Directories With Attrib exe
-    file: endpoint/ssa_hiding_files_and_directories_with_attrib_exe.yml
+  - name: Hiding Files And Directories With Attrib exe
+    file: endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
     pass_condition: '@count_gt(0)'
     description: Test detection of attrib Application execution
     attack_data:

From c53510c42ae18546c5001490674e03abc96cc1ca Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 20 Dec 2021 12:31:21 +0100
Subject: [PATCH 4/9] new_ssa_info_sabotage

---
 ...ssa___clear_unallocated_sector_using_cipher_app.test.yml | 6 +++---
 ...___hiding_files_and_directories_with_attrib_exe.test.yml | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
index 783042d77d..8767741649 100644
--- a/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
+++ b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
@@ -5,6 +5,6 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test detection of Cipher Application execution
     attack_data:
-    - file_name: security.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
-      source: WinEventLog:Security
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+        source: WinEventLog:Security
diff --git a/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
index dc26b98475..1068befe82 100644
--- a/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
+++ b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
@@ -5,6 +5,6 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test detection of attrib Application execution
     attack_data:
-    - file_name: security.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
-      source: WinEventLog:Security
\ No newline at end of file
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+        source: WinEventLog:Security
\ No newline at end of file

From f144fc5df3ce93b9da87f34223b012c308736c1a Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 20 Dec 2021 12:37:12 +0100
Subject: [PATCH 5/9] new_ssa_info_sabotage

---
 .../ssa___clear_unallocated_sector_using_cipher_app.test.yml    | 2 +-
 .../ssa___hiding_files_and_directories_with_attrib_exe.test.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
index 8767741649..887a505741 100644
--- a/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
+++ b/tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml
@@ -1,4 +1,4 @@
-name: Clear Unallocated Sector Using Cipher App Unit Test
+name: Clear Unallocated Sector Using Cipher - SSA Unit test
 tests:
   - name: Clear Unallocated Sector Using Cipher App
     file: endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
diff --git a/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
index 1068befe82..4c6dcff395 100644
--- a/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
+++ b/tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml
@@ -1,4 +1,4 @@
-name: Hiding Files And Directories With Attrib exe Unit Test
+name: Hiding Files And Directories With Attrib exe - SSA Unit test
 tests:
   - name: Hiding Files And Directories With Attrib exe
     file: endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml

From b61311f72ba28392782ec8ca4f5f7c3e40f52f94 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 20 Dec 2021 13:44:02 +0100
Subject: [PATCH 6/9] new_ssa_info_sabotage

---
 ...a___clear_unallocated_sector_using_cipher_app.yml | 12 ++++++------
 ..._hiding_files_and_directories_with_attrib_exe.yml | 10 +++++-----
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
index 2e79a679e7..52b81583ba 100644
--- a/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+++ b/detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
@@ -40,9 +40,7 @@ tags:
   - T1070.004
   - T1070
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+  - Splunk Behavioral Analytics
   required_fields:
   - _time
   - Processes.dest
@@ -85,7 +83,9 @@ tags:
     role:
     - Child Process
   nist:
-  - CIS 4
-  - CIS 16
+  - PR.AC
+  - PR.IP
   cis20:
-  - DE.CM
\ No newline at end of file
+  - CIS 14
+  - CIS 16
+  
\ No newline at end of file
diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
index 2d218b9850..640b0cf941 100644
--- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -44,9 +44,7 @@ tags:
   - T1222.001
   - T1222
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+  - Splunk Behavioral Analytics
   required_fields:
   - _time
   security_domain: endpoint
@@ -74,6 +72,8 @@ tags:
     - Attacker
     - Parent Process
   nist:
-  - DE.CM
+  - PR.AC
+  - PR.IP
   cis20:
-  - CIS 8
\ No newline at end of file
+  - CIS 14
+  - CIS 16
\ No newline at end of file

From e1261b36caee858ee87a402205e698c40daf1323 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 20 Dec 2021 17:18:44 +0100
Subject: [PATCH 7/9] Update
 ssa___hiding_files_and_directories_with_attrib_exe.yml

---
 .../ssa___hiding_files_and_directories_with_attrib_exe.yml     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
index 640b0cf941..5b392447be 100644
--- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -76,4 +76,5 @@ tags:
   - PR.IP
   cis20:
   - CIS 14
-  - CIS 16
\ No newline at end of file
+  - CIS 16
+  

From 11dbcdf4739c206a5c08a4b5657d33a53b17f497 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 21 Dec 2021 15:13:54 +0100
Subject: [PATCH 8/9] Update
 ssa___hiding_files_and_directories_with_attrib_exe.yml

---
 .../ssa___hiding_files_and_directories_with_attrib_exe.yml       | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
index 5b392447be..87b201c0a2 100644
--- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -78,3 +78,4 @@ tags:
   - CIS 14
   - CIS 16
   
+

From 7549ae7c7bf0043bdc7b3ad8ca515493577486bc Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 22 Dec 2021 10:22:49 +0100
Subject: [PATCH 9/9] Update
 ssa___hiding_files_and_directories_with_attrib_exe.yml

---
 .../ssa___hiding_files_and_directories_with_attrib_exe.yml       | 1 -
 1 file changed, 1 deletion(-)

diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
index 87b201c0a2..5b392447be 100644
--- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -78,4 +78,3 @@ tags:
   - CIS 14
   - CIS 16
   
-