Merge pull request #116 from suleymanozarslan/master

ATT&CK tagging of Suspicious Certutil Command rule

rules/windows/sysmon/sysmon_susp_certutil_command.yml

@@ -25,6 +25,11 @@ detection:
 fields:
     - CommandLine
     - ParentCommandLine
+tags:
+    - attack.defense_evasion
+    - attack.t1140
+    - attack.s0189
+    - attack.g0007
 falsepositives:
     - False positives depend on scripts and administrative tools used in the monitored environment
 level: high