Branch was auto-updated.

detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml

@@ -56,6 +56,7 @@ tags:
     $dest$ executed by user $user$.
   mitre_attack_id:
   - T1059.001
+  - T1059
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml

@@ -32,6 +32,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1127.001
+  - T1127
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -64,6 +64,7 @@ tags:
   message: A registry activity in $registry_path$ related to persistence in host $dest$
   mitre_attack_id:
   - T1547.001
+  - T1547
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/sdelete_application_execution.yml

@@ -33,6 +33,7 @@ tags:
   mitre_attack_id:
   - T1485
   - T1070.004
+  - T1070
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/suspicious_copy_on_system32.yml

@@ -31,6 +31,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1036.003
+  - T1036
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/suspicious_wevtutil_usage.yml

@@ -47,6 +47,7 @@ tags:
   message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$
   mitre_attack_id:
   - T1070.001
+  - T1070
   nist:
   - DE.DP
   - PR.IP

detections/endpoint/vbscript_execution_using_wscript_app.yml

@@ -32,6 +32,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1059.005
+  - T1059
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/verclsid_clsid_execution.yml

@@ -34,6 +34,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1218.012
+  - T1218
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/wscript_or_cscript_suspicious_child_process.yml

@@ -41,6 +41,7 @@ tags:
   - T1055
   - T1543
   - T1134.004
+  - T1134
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security