CISA and mimikatz add

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -36,6 +36,7 @@ tags:
   - DarkSide Ransomware
   - Living Off The Land
   - ProxyNotShell
+  - CISA AA22-277A
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - FIN7
+  - CISA AA22-277A
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Hidden Cobra Malware
+  - CISA AA22-277A
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_renamed_winrar.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Collection and Staging
+  - CISA AA22-277A
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/excessive_usage_of_taskkill.yml

@@ -29,6 +29,7 @@ tags:
   - Azorult
   - CISA AA22-264A
   - AgentTesla
+  - CISA AA22-277A
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/exchange_powershell_module_usage.yml

@@ -44,6 +44,7 @@ tags:
   - ProxyShell
   - CISA AA22-264A
   - ProxyNotShell
+  - CISA AA22-277A
   asset_type: Endpoint
   confidence: 80
   context:

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -40,6 +40,7 @@ tags:
   - Active Directory Lateral Movement
   - WhisperGate
   - Industroyer2
+  - CISA AA22-277A
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/network_connection_discovery_netstat.yml

@@ -25,6 +25,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - CISA AA22-277A
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/network_discovery_using_route_windows_app.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - CISA AA22-277A
   confidence: 30
   context:
   - Source:Endpoint

lookups/attacker_tools.csv

@@ -25,4 +25,5 @@ NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Au
 ns.exe,A commonly used tool used by attackers to scan and map file shares
 SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
 kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks.
-advanced_port_scanner.exe, Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
+advanced_port_scanner.exe,Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
+mimikatz.exe,utility Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets.