diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 7b5444fb72..8aaaed0b6c 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -56,6 +56,7 @@ tags: $dest$ executed by user $user$. mitre_attack_id: - T1059.001 + - T1059 nist: - PR.PT - DE.CM diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index d0687e4c57..f26c884958 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -32,6 +32,7 @@ tags: - Exploitation mitre_attack_id: - T1127.001 + - T1127 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 33f290cdd1..621e1e0782 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -64,6 +64,7 @@ tags: message: A registry activity in $registry_path$ related to persistence in host $dest$ mitre_attack_id: - T1547.001 + - T1547 nist: - PR.PT - DE.CM diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 0ded4ef8bc..ee1942f7f2 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -33,6 +33,7 @@ tags: mitre_attack_id: - T1485 - T1070.004 + - T1070 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 3eb05fde0f..522c819fbe 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -31,6 +31,7 @@ tags: - Exploitation mitre_attack_id: - T1036.003 + - T1036 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 4c32b8f3d4..c85fa3b2b0 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -47,6 +47,7 @@ tags: message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ mitre_attack_id: - T1070.001 + - T1070 nist: - DE.DP - PR.IP diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 5cb1e55d97..3b24917446 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -32,6 +32,7 @@ tags: - Exploitation mitre_attack_id: - T1059.005 + - T1059 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 556ef2e416..105298f16c 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -34,6 +34,7 @@ tags: - Exploitation mitre_attack_id: - T1218.012 + - T1218 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 1d680f7db2..9d44bd1adf 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -41,6 +41,7 @@ tags: - T1055 - T1543 - T1134.004 + - T1134 product: - Splunk Enterprise - Splunk Enterprise Security