From 9da9da80d3bde4ee62f1fa3fbcba2dd31bc76424 Mon Sep 17 00:00:00 2001
From: Zeta <38060942+0xzeta@users.noreply.github.com>
Date: Fri, 10 Mar 2023 07:21:42 +0700
Subject: [PATCH] Update ATT&CK Techniques and Tactics (#4096)

---
 .../registry_set_persistence_event_viewer_events_asp.yml        | 2 ++
 .../registry_set_winlogon_allow_multiple_tssessions.yml         | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml b/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml
index 9d2c8201f..a79a3148a 100644
--- a/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml
+++ b/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml
@@ -12,6 +12,8 @@ date: 2023/02/17
 modified: 2023/03/05
 tags:
     - attack.persistence
+    - attack.defense_evasion
+    - attack.t1112
 logsource:
     category: registry_set
     product: windows
diff --git a/rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml b/rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml
index acd441e60..0b7be724e 100644
--- a/rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml
+++ b/rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml
@@ -11,6 +11,8 @@ author: Nasreddine Bencherchali (Nextron Systems)
 date: 2022/09/09
 tags:
     - attack.persistence
+    - attack.defense_evasion
+    - attack.t1112
 logsource:
     category: registry_set
     product: windows