From e97b4e50158f691a6f8432beaac21ca74b3ddfdb Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 28 Nov 2022 06:27:13 -0700
Subject: [PATCH] Update common_ransomware_extensions.yml

---
 .../endpoint/common_ransomware_extensions.yml | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml
index 74aa6d9ece..169c6051b9 100644
--- a/detections/endpoint/common_ransomware_extensions.yml
+++ b/detections/endpoint/common_ransomware_extensions.yml
@@ -46,9 +46,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Actions on Objectives
-  message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$,
-    this is indicative of a known ransomware file extension and should be reviewed
-    immediately.
+  message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack.
   mitre_attack_id:
   - T1485
   nist:
@@ -67,6 +65,22 @@ tags:
     type: File Name
     role:
     - Victim
+  - name: file_count
+    type: Other
+    role:
+    - Other
+  - name: path_count
+    type: Other
+    role:
+    - Other
+  - name: file_extension
+    type: Other
+    role:
+    - Other
+  - name: Name
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security