security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update revoked technique

Browse Source
This commit is contained in:
brokensound77
2021-01-28 11:03:17 -09:00
parent bf32dec5a4
commit ec4c9e77a2
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/execution_suspicious_mac_ms_office_child_process.toml → rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml
+9 -5
View File
@@ -53,12 +53,16 @@ process where event.type in ("start", "process_started") and
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1193"
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1193/"
reference = "https://attack.mitre.org/techniques/T1566/001/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"