Merge PR #5388 from @david-syk - Update MITRE ATT&CK tags

chore: update the tags of multiple rules

rules/linux/auditd/lnx_auditd_data_compressed.yml

@@ -9,6 +9,7 @@ date: 2019-10-21
 modified: 2023-07-28
 tags:
     - attack.exfiltration
+    - attack.collection
     - attack.t1560.001
 logsource:
     product: linux

rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml

@@ -10,6 +10,7 @@ author: Omar Khaled (@beacon_exe)
 date: 2024-08-10
 tags:
     - attack.initial-access
+    - attack.collection
     - attack.t1566.001
     - attack.t1560.001
 logsource:

rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml

@@ -15,6 +15,7 @@ author: '@neu5ron, @Antonlovesdnb, Mike Remen'
 date: 2021-08-17
 modified: 2022-11-28
 tags:
+    - attack.credential-access
     - attack.t1557.001
     - attack.t1187
 logsource:

rules/windows/builtin/security/win_security_alert_ruler.yml

@@ -14,6 +14,7 @@ modified: 2022-10-09
 tags:
     - attack.discovery
     - attack.execution
+    - attack.collection
     - attack.t1087
     - attack.t1114
     - attack.t1059

rules/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml

@@ -9,6 +9,7 @@ date: 2022-10-07
 modified: 2023-04-14
 tags:
     - attack.execution
+    - attack.credential-access
     - attack.t1557.001
 logsource:
     product: windows

rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml

@@ -14,6 +14,7 @@ author: Nasreddine Bencherchali (Nextron Systems)
 date: 2022-12-23
 tags:
     - attack.credential-access
+    - attack.collection
     - attack.t1185
 logsource:
     category: process_creation

rules/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml

@@ -15,6 +15,7 @@ date: 2022-07-27
 modified: 2022-12-23
 tags:
     - attack.credential-access
+    - attack.collection
     - attack.t1185
 logsource:
     category: process_creation

rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml

@@ -14,6 +14,7 @@ date: 2021-07-24
 modified: 2023-02-14
 tags:
     - attack.execution
+    - attack.credential-access
     - attack.t1557.001
 logsource:
     category: process_creation