added att&ck tag

2024-11-07 09:48:58 +00:00 · 2018-08-07 08:45:58 +02:00 · 2018-08-07 08:45:58 +02:00 · 99253763af
commit 99253763af
parent 0bff27ec21
1 changed files with 4 additions and 0 deletions
--- a/rules/windows/sysmon/sysmon_susp_powershell_rundll32.yml
+++ b/rules/windows/sysmon/sysmon_susp_powershell_rundll32.yml
@ -14,6 +14,10 @@ detection:
        SourceImage: '*\powershell.exe'
        TargetImage: '*\rundll32.exe'
    condition: selection
+tags:
+    - attack.defense_evasion
+    - attack.execution
+    - attack.t1085
 falsepositives:
    - Unkown
 level: high