From f2ceb2520f5bbde92b6cf50170dd76a1e8501d6c Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 14 Mar 2023 16:51:19 +0100
Subject: [PATCH] Update windows_powershell_import_applocker_policy.yml

add mitre attack id for windows powershell import applocker policy related to defense evasion
---
 .../endpoint/windows_powershell_import_applocker_policy.yml    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml
index 1b6154261e..842f271b2f 100644
--- a/detections/endpoint/windows_powershell_import_applocker_policy.yml
+++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml
@@ -41,6 +41,9 @@ tags:
     with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059.001
+  - T1059
+  - T1562.001
+  - T1562
   nist:
   - DE.CM
   observable: