Merge branch 'qakbot_2' of github.com:splunk/security_content into qakbot_2

detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml

@@ -6,7 +6,7 @@ author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies a suspicious registry entry created by Qakbot malware as part of malicious execution. 
+description: The following analytic identifies a suspicious registry entry created by Qakbot malware as part of its malicious execution. 
   This "Binary Data" Registry  was created by newly spawn explorer.exe where its malicious code is injected to it. The registry consist of 8 random registry value name 
   with encrypted binary data on its registry value data. This anomaly detections can be a good pivot for possible Qakbot malware infection or other malware that uses registry 
   to save or store there config or malicious code on the registry data stream. 

detections/endpoint/windows_wmi_impersonate_token.yml

@@ -38,7 +38,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log
   impact: 50
   kill_chain_phases:
   - Exploitation