diff --git a/atomics/T1567.002/T1567.002.yaml b/atomics/T1567.002/T1567.002.yaml index 7e4689e1..986f89dc 100644 --- a/atomics/T1567.002/T1567.002.yaml +++ b/atomics/T1567.002/T1567.002.yaml @@ -2,6 +2,7 @@ attack_technique: T1567.002 display_name: 'Exfiltration Over Web Service: Exfiltration to Cloud Storage' atomic_tests: - name: Exfiltrate data with rclone to cloud Storage - Mega (Windows) + auto_generated_guid: 8529ee44-279a-4a19-80bf-b846a40dda58 description: | This test uses rclone to exfiltrate data to a remote cloud storage instance. (Mega) See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index 786ce134..aa443f70 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1185,3 +1185,4 @@ e2480aee-23f3-4f34-80ce-de221e27cd19 f4391089-d3a5-4dd1-ab22-0419527f2672 f0007753-beb3-41ea-9948-760785e4c1e5 766b6c3c-9353-4033-8b7e-38b309fa3a93 +8529ee44-279a-4a19-80bf-b846a40dda58