From da754be569fada47ff96b7b06c2cf77f84095dcb Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 17 Nov 2022 16:03:40 +0100
Subject: [PATCH] cisa_coverage2

---
 .../windows_dll_search_order_hijacking_hunt_with_sysmon.yml      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
index e3499d4da1..f3c9682262 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
@@ -22,6 +22,7 @@ tags:
   analytic_story:
   - Living Off The Land
   - Windows Defense Evasion Tactics
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 3