ATT&CK tagging of MSHTA Spawning Windows Shell

2024-11-07 09:48:58 +00:00 · 2018-07-20 09:53:55 +03:00 · 2018-07-20 09:53:55 +03:00 · 080892b5ab
commit 080892b5ab
parent 76f277d5fe
1 changed files with 4 additions and 0 deletions
--- a/rules/windows/sysmon/sysmon_mshta_spawn_shell.yml
+++ b/rules/windows/sysmon/sysmon_mshta_spawn_shell.yml
@ -29,6 +29,10 @@ detection:
 fields:
    - CommandLine
    - ParentCommandLine
+tags:
+    - attack.defense_evasion
+    - attack.execution
+    - attack.t1170
 falsepositives:
    - Printer software / driver installations
 level: high