fix: wrong MITRE ATT&CK ids used in the beta version

rules/network/cisco/aaa/cisco_cli_clear_logs.yml

@@ -11,8 +11,8 @@ tags:
     - attack.defense_evasion
     - attack.t1146
     - attack.t1070
-    - attack.t1551.003
-    - attack.t1551
+    - attack.t1070.003
+    - attack.t1070
 logsource:
     product: cisco
     service: aaa

rules/network/cisco/aaa/cisco_cli_file_deletion.yml

@@ -15,7 +15,7 @@ tags:
     - attack.t1488
     - attack.t1487
     - attack.t1561.002
-    - attack.t1551.004
+    - attack.t1070.004
     - attack.t1561.001
 logsource:
     product: cisco

rules/windows/builtin/win_susp_backup_delete.yml

@@ -10,7 +10,7 @@ date: 2017/05/12
 tags:
     - attack.defense_evasion
     - attack.t1107
-    - attack.t1551.004
+    - attack.t1070.004
 logsource:
     product: windows
     service: application

rules/windows/builtin/win_susp_eventlog_cleared.yml

@@ -10,7 +10,7 @@ tags:
     - attack.defense_evasion
     - attack.t1070
     - car.2016-04-002
-    - attack.t1551
+    - attack.t1070
 logsource:
     product: windows
     service: system

rules/windows/builtin/win_susp_sdelete.yml

@@ -13,7 +13,7 @@ tags:
     - attack.t1107
     - attack.t1066
     - attack.s0195
-    - attack.t1551.004
+    - attack.t1070.004
     - attack.t1027
 logsource:
     product: windows

rules/windows/builtin/win_susp_security_eventlog_cleared.yml

@@ -5,7 +5,7 @@ tags:
     - attack.defense_evasion
     - attack.t1070
     - car.2016-04-002
-    - attack.t1551
+    - attack.t1070
 author: Florian Roth
 date: 2017/02/19
 logsource:

rules/windows/builtin/win_susp_time_modification.yml

@@ -11,7 +11,7 @@ midified: 2020/01/27
 tags:
     - attack.defense_evasion
     - attack.t1099
-    - attack.t1551.006
+    - attack.t1070.006
 logsource:
     product: windows
     service: security

rules/windows/powershell/powershell_clear_powershell_history.yml

@@ -9,7 +9,7 @@ references:
 tags:
     - attack.defense_evasion
     - attack.t1146
-    - attack.t1551.003
+    - attack.t1070.003
 logsource:
     product: windows
     service: powershell

rules/windows/process_creation/win_etw_trace_evasion.yml

@@ -12,7 +12,7 @@ tags:
     - attack.execution
     - attack.t1070
     - car.2016-04-002
-    - attack.t1551
+    - attack.t1070
 level: high
 logsource:
     category: process_creation

rules/windows/process_creation/win_malware_notpetya.yml

@@ -16,7 +16,7 @@ tags:
     - attack.t1003
     - car.2016-04-002
     - attack.t1218.011
-    - attack.t1551
+    - attack.t1070
 logsource:
     category: process_creation
     product: windows

rules/windows/process_creation/win_shadow_copies_deletion.yml

@@ -15,7 +15,7 @@ tags:
     - attack.impact
     - attack.t1070
     - attack.t1490
-    - attack.t1551
+    - attack.t1070
 logsource:
     category: process_creation
     product: windows

rules/windows/process_creation/win_susp_bcdedit.yml

@@ -11,7 +11,7 @@ tags:
     - attack.t1070
     - attack.persistence
     - attack.t1067
-    - attack.t1551
+    - attack.t1070
     - attack.t1542.003
 logsource:
     category: process_creation

rules/windows/process_creation/win_susp_eventlog_clear.yml

@@ -11,7 +11,7 @@ tags:
     - attack.defense_evasion
     - attack.t1070
     - car.2016-04-002
-    - attack.t1551
+    - attack.t1070
 level: high
 logsource:
     category: process_creation

rules/windows/process_creation/win_susp_fsutil_usage.yml

@@ -12,7 +12,7 @@ references:
 tags:
     - attack.defense_evasion
     - attack.t1070
-    - attack.t1551
+    - attack.t1070
 logsource:
     category: process_creation
     product: windows