From d3322283c39eea6c55e4dfe68f832bd0728bb987 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Fri, 25 Feb 2022 13:49:21 -0600 Subject: [PATCH] Added risk_severity --- detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml | 1 + .../experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml index fa2ece5a8e..78dc50a0cd 100644 --- a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml +++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml @@ -43,6 +43,7 @@ tags: impact: 80 confidence: 100 risk_score: 80 + risk_severity: high context: - Source:Endpoint - Stage:Privilege Escalation diff --git a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml index 7c2e44ce70..68f37f6895 100644 --- a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml +++ b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml @@ -37,6 +37,7 @@ tags: impact: 70 confidence: 90 risk_score: 63 + risk_severity: medium context: - Source:Endpoint - Stage:Persistence