From 9a2e7a23fa232a42ce90cd1994ae88b69a009b45 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Mon, 22 Nov 2021 14:06:50 +0100
Subject: [PATCH] docs: tags for CVE-2021-41379

---
 .../process_creation/win_exploit_lpe_cve_2021_41379.yml        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/win_exploit_lpe_cve_2021_41379.yml b/rules/windows/process_creation/win_exploit_lpe_cve_2021_41379.yml
index e6db15cf9..4fd4ecd5b 100644
--- a/rules/windows/process_creation/win_exploit_lpe_cve_2021_41379.yml
+++ b/rules/windows/process_creation/win_exploit_lpe_cve_2021_41379.yml
@@ -7,7 +7,8 @@ date: 2021/11/22
 references:
     - https://github.com/klinix5/InstallerFileTakeOver
 tags:
-
+    - attack.privilege_escalation
+    - attack.t1068
 logsource:
     category: process_creation
     product: windows