Updated Analytic Stories

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -35,6 +35,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
+  - Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_renamed_psexec.yml

@@ -32,6 +32,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
+  - Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
   kill_chain_phases:

detections/endpoint/detect_sharphound_command_line_arguments.yml

@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Discovery Techniques
+  - Ransomware
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:

detections/endpoint/detect_sharphound_file_modifications.yml

@@ -41,6 +41,7 @@ references:
 tags:
   analytic_story:
   - Discovery Techniques
+  - Ransomware
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:

detections/endpoint/detect_sharphound_usage.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Discovery Techniques
+  - Ransomware
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases: