tagging existing detections

splunk · Apr 20, 2023 · 71e3a99 · 71e3a99
1 parent aa48a5d
commit 71e3a99
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
+  - Active Directory Privilege Escalation
   automated_detection_testing: passed
   confidence: 70
   context:

diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   automated_detection_testing: passed
   confidence: 60
   context:

diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
   - Active Directory Kerberos Attacks
+  - Active Directory Privilege Escalation
   automated_detection_testing: passed
   confidence: 60
   context: