chore: 🧹 Simple Web Update

frack113 · Apr 23, 2024 · 4592fc6 · 4592fc6
1 parent 38db81d
commit 4592fc6
Show file tree

Hide file tree

Showing 322 changed files with 2,754 additions and 902 deletions.
diff --git a/Full_tests.csv b/Full_tests.csv
diff --git a/missing_tests.csv b/missing_tests.csv
diff --git a/mydata.py b/mydata.py
@@ -55,6 +55,9 @@ def add(self, head_info, test):
         for technique in head_info["technique"]:
             if not technique in self.data["technique"]:
                 self.data["technique"].append(technique)
+        if self.data["sigma_rule"] is None:
+            self.data["sigma"] = False
+            self.data["sigma_rule"] = []
         self.data["sigma"] = True if len(self.data["sigma_rule"])>0 else False
 
     def order(self):

diff --git a/sigma_rule.csv b/sigma_rule.csv
diff --git a/yml/007e5672-2088-4853-a562-7490ddc19447.yml b/yml/007e5672-2088-4853-a562-7490ddc19447.yml
@@ -32,14 +32,10 @@ sigma_rule:
     name: posh_ps_susp_networkcredential.yml
   - id: 754ed792-634f-40ae-b3bc-e0448d33f695
     name: proc_creation_win_powershell_susp_parent_process.yml
-  - id: 0332a266-b584-47b4-933d-a00b103e1b37
-    name: posh_ps_susp_gwmi.yml
   - id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd
     name: posh_ps_copy_item_system_directory.yml
   - id: 1f49f2ab-26bc-48b3-96cc-dcffbc93eadf
     name: posh_ps_susp_keywords.yml
-  - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
-    name: posh_ps_file_and_directory_discovery.yml
   - id: e32f92d1-523e-49c3-9374-bdb13b46a3ba
     name: proc_creation_win_mshta_susp_pattern.yml
   - id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471

diff --git a/yml/00e3e3c7-6c3c-455e-bd4b-461c7f0e7797.yml b/yml/00e3e3c7-6c3c-455e-bd4b-461c7f0e7797.yml
@@ -35,10 +35,6 @@ sigma_rule:
     name: posh_pm_susp_invocation_specific.yml
   - id: d93129cd-1ee0-479f-bc03-ca6f129882e3
     name: posh_ps_detect_vm_env.yml
-  - id: 0332a266-b584-47b4-933d-a00b103e1b37
-    name: posh_ps_susp_gwmi.yml
-  - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
-    name: posh_ps_file_and_directory_discovery.yml
   - id: 03d83090-8cba-44a0-b02f-0b756a050306
     name: posh_ps_win_api_susp_access.yml
   - id: 403c2cc0-7f6b-4925-9423-bfa573bed7eb
@@ -76,7 +72,7 @@ sigma_rule:
   - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
     name: net_connection_win_powershell_network_connection.yml
   - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
-    name: net_connection_win_binary_susp_com.yml
+    name: net_connection_win_susp_file_sharing_domains_susp_folders.yml
   - id: 297afac9-5d02-4138-8c58-b977bac60556
     name: file_event_win_susp_binary_dropper.yml
   - id: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33

diff --git a/yml/0128e48e-8c1a-433a-a11a-a5304734f1e1.yml b/yml/0128e48e-8c1a-433a-a11a-a5304734f1e1.yml
@@ -0,0 +1,25 @@
+Attack_name: Process Injection
+Attack_description: "Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code
+  in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution
+  via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of
+  which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment
+  modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. "
+guid: '0128e48e-8c1a-433a-a11a-a5304734f1e1'
+name: UUID custom process Injection
+tactic:
+  - defense-evasion
+  - privilege-escalation
+technique:
+  - T1055
+os:
+  - windows
+description: |
+  The UUIDs Process Injection code was first introduced by the NCC Group. The code can be stored in UUID forms on the heap and converted back to binary via UuidFromStringA at runtime. In this new custom version of UUID injection, EnumSystemLocalesA is the only API called to execute the code. We used custom UuidToString and UuidFromString implementations to avoid using UuidFromStringA and RPCRT4.dll, thereby eliminating the static signatures. This technique also avoided the use of VirtualAlloc, WriteProcessMemory and CreateThread
+
+  The injected shellcode will open a message box and a notepad.
+
+  Reference to NCC Group: https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/
+  Concept from: http://ropgadget.com/posts/abusing_win_functions.html
+executor: powershell
+sigma: false
+sigma_rule: []
diff --git a/yml/0268e63c-e244-42db-bef7-72a9e59fc1fc.yml b/yml/0268e63c-e244-42db-bef7-72a9e59fc1fc.yml
@@ -38,4 +38,4 @@ sigma_rule:
   - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
     name: net_connection_win_powershell_network_connection.yml
   - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
-    name: net_connection_win_binary_susp_com.yml
+    name: net_connection_win_susp_file_sharing_domains_susp_folders.yml
diff --git a/yml/04bb8e3d-1670-46ab-a3f1-5cee64da29b6.yml b/yml/04bb8e3d-1670-46ab-a3f1-5cee64da29b6.yml
@@ -0,0 +1,21 @@
+Attack_name: Data Obfuscation via Steganography
+Attack_description: 'Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital
+  messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such
+  as image or document files, can be used for command and control. '
+guid: 04bb8e3d-1670-46ab-a3f1-5cee64da29b6
+name: Embedded Script in Image Execution via Extract-Invoke-PSImage
+tactic:
+  - command-and-control
+technique:
+  - T1001.002
+os:
+  - windows
+description: "This atomic test demonstrates the technique of data obfuscation via steganography, where a PowerShell script is concealed within an image file. \nThe PowerShell script is embedded using steganography
+  techniques, making it undetectable by traditional security measures. The script is hidden \nwithin the pixels of the image, enabling attackers to covertly transfer and execute malicious code across systems.\n
+  \nThe test begins by ensuring the availability of the malicious image file and the Extract-Invoke-PSImage script. The test proceeds to extract the hidden \nPowerShell script (decoded.ps1) from the image
+  file using the Extract-Invoke-PSImage tool. The extracted script is then decoded from base64 encoding and saved as a \nseparate PowerShell (textExtraction.ps1). Consequently, the textExtraction.ps1 script
+  is executed.\n\nIn the case of this atomic test, the malicious image file which is downloaded has the powershell command Start-Process notepad embedded within in base64. This\nis done to emulate an attackers
+  behaviour in the case they were to execute malware embedded within the image file. \n"
+executor: powershell
+sigma: false
+sigma_rule: []
diff --git a/yml/062f92c9-28b1-4391-a5f8-9d8ca6852091.yml b/yml/062f92c9-28b1-4391-a5f8-9d8ca6852091.yml
@@ -0,0 +1,22 @@
+Attack_name: 'Impair Defenses: Downgrade Attack'
+Attack_description: "Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage
+  of a system’s backward compatibility to force it into less secure modes of operation. \n\nAdversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting
+  Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation:
+  Praetorian TLS Downgrade Attack 2014) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content.
+  However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious
+  scripts that may have otherwise been detected.(Citation: CrowdStrike BGH Ransomware 2021)(Citation: Mandiant BYOL 2018)(Citation: att_def_ps_logging)\n\nAdversaries may similarly target network traffic
+  to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: Crowdstrike Downgrade)"
+guid: 062f92c9-28b1-4391-a5f8-9d8ca6852091
+name: ESXi - Change VIB acceptance level to CommunitySupported via PowerCLI
+tactic:
+  - defense-evasion
+technique:
+  - T1562.010
+os:
+  - linux
+description: |
+  An adversary can change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria.This can be accomplished via PowerCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host.
+  [Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening)
+executor: powershell
+sigma: false
+sigma_rule: []
diff --git a/yml/069258f4-2162-46e9-9a25-c9c6c56150d2.yml b/yml/069258f4-2162-46e9-9a25-c9c6c56150d2.yml
@@ -30,6 +30,6 @@ sigma_rule:
   - id: dcaa3f04-70c3-427a-80b4-b870d73c94c4
     name: proc_creation_win_csc_susp_dynamic_compilation.yml
   - id: 66d31e5f-52d6-40a4-9615-002d3789a119
-    name: create_remote_thread_win_uncommon_source_image.yml
+    name: create_remote_thread_win_susp_uncommon_source_image.yml
   - id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
     name: create_remote_thread_win_powershell_generic.yml
diff --git a/yml/06a220b6-7e29-4bd8-9d07-5b4d86742372.yml b/yml/06a220b6-7e29-4bd8-9d07-5b4d86742372.yml
@@ -34,8 +34,6 @@ sigma_rule:
     name: posh_ps_web_request_cmd_and_cmdlets.yml
   - id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71
     name: posh_ps_susp_invocation_specific.yml
-  - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
-    name: posh_ps_file_and_directory_discovery.yml
   - id: b8af5f36-1361-4ebe-9e76-e36128d947bf
     name: posh_ps_remove_item_path.yml
   - id: 40f9af16-589d-4984-b78d-8c2aec023197
@@ -45,4 +43,4 @@ sigma_rule:
   - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
     name: net_connection_win_powershell_network_connection.yml
   - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
-    name: net_connection_win_binary_susp_com.yml
+    name: net_connection_win_susp_file_sharing_domains_susp_folders.yml
diff --git a/yml/079ee2e9-6f16-47ca-a635-14efcd994118.yml b/yml/079ee2e9-6f16-47ca-a635-14efcd994118.yml
@@ -35,10 +35,6 @@ sigma_rule:
     name: posh_ps_detect_vm_env.yml
   - id: 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
     name: posh_ps_malicious_commandlets.yml
-  - id: 0332a266-b584-47b4-933d-a00b103e1b37
-    name: posh_ps_susp_gwmi.yml
-  - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
-    name: posh_ps_file_and_directory_discovery.yml
   - id: 03d83090-8cba-44a0-b02f-0b756a050306
     name: posh_ps_win_api_susp_access.yml
   - id: 1f49f2ab-26bc-48b3-96cc-dcffbc93eadf
@@ -76,17 +72,15 @@ sigma_rule:
   - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
     name: net_connection_win_powershell_network_connection.yml
   - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
-    name: net_connection_win_binary_susp_com.yml
+    name: net_connection_win_susp_file_sharing_domains_susp_folders.yml
   - id: 297afac9-5d02-4138-8c58-b977bac60556
     name: file_event_win_susp_binary_dropper.yml
   - id: cbb56d62-4060-40f7-9466-d8aaf3123f83
     name: image_load_susp_python_image_load.yml
   - id: fa34b441-961a-42fa-a100-ecc28c886725
-    name: proc_access_win_susp_proc_access_lsass_susp_source.yml
+    name: proc_access_win_lsass_susp_source_process.yml
   - id: 678dfc63-fefb-47a5-a04c-26bcf8cc9f65
-    name: proc_access_win_rare_proc_access_lsass.yml
-  - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
-    name: proc_access_win_cred_dump_lsass_access.yml
+    name: proc_access_win_lsass_uncommon_access_flag.yml
   - id: 91cb43db-302a-47e3-b3c8-7ede481e27bf
     name: file_access_win_browser_credential_access.yml
   - id: 8d31a8ce-46b5-4dd6-bdc3-680931f1db86

diff --git a/yml/07b18a66-6304-47d2-bad0-ef421eb2e107.yml b/yml/07b18a66-6304-47d2-bad0-ef421eb2e107.yml
@@ -38,6 +38,6 @@ sigma_rule:
   - id: 8d31a8ce-46b5-4dd6-bdc3-680931f1db86
     name: posh_pm_bad_opsec_artifacts.yml
   - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
-    name: net_connection_win_binary_susp_com.yml
+    name: net_connection_win_susp_file_sharing_domains_susp_folders.yml
   - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
     name: net_connection_win_powershell_network_connection.yml
diff --git a/yml/09147b61-40f6-4b2a-b6fb-9e73a3437c96.yml b/yml/09147b61-40f6-4b2a-b6fb-9e73a3437c96.yml
@@ -0,0 +1,22 @@
+Attack_name: Modify Registry
+Attack_description: |-
+  Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
+
+  Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.
+
+  Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. (Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. (Citation: TrendMicro POWELIKS AUG 2014) (Citation: SpectorOps Hiding Reg Jul 2017)
+
+  The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. (Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.
+guid: '09147b61-40f6-4b2a-b6fb-9e73a3437c96'
+name: Disabling ShowUI Settings of Windows Error Reporting (WER)
+tactic:
+  - defense-evasion
+technique:
+  - T1112
+os:
+  - windows
+description: "A modification registry to disable ShowUI settings of Windows Error Report. This registry setting can influence the behavior of error reporting dialogs or prompt box. \nThis technique was
+  seen in DarkGate malware as part of its installation.\n"
+executor: command_prompt
+sigma: false
+sigma_rule: []
diff --git a/yml/091a6290-cd29-41cb-81ea-b12f133c66cb.yml b/yml/091a6290-cd29-41cb-81ea-b12f133c66cb.yml
@@ -0,0 +1,29 @@
+Attack_name: 'Impair Defenses: Disable or Modify Tools'
+Attack_description: "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes
+  or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries
+  may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)\n\nAdversaries may also tamper with artifacts deployed and utilized
+  by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify
+  those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added
+  by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) \n\nAdversaries
+  may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Microsoft-Windows-Sysmon-Operational</code>
+  may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) \n\nOn network devices, adversaries may attempt to skip digital signature verification checks
+  by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in
+  Espionage Operation)(Citation: Analysis of FG-IR-22-369)\n\nIn cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch
+  or Google Cloud Monitor.\n\nFurthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these
+  tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find
+  and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)\n\nAdditionally, adversaries may exploit legitimate drivers from anti-virus software to gain access
+  to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)"
+guid: '091a6290-cd29-41cb-81ea-b12f133c66cb'
+name: ESXi - Disable Account Lockout Policy via PowerCLI
+tactic:
+  - defense-evasion
+technique:
+  - T1562.001
+os:
+  - linux
+description: 'An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.
+
+  '
+executor: powershell
+sigma: false
+sigma_rule: []
diff --git a/yml/09210ad5-1ef2-4077-9ad3-7351e13e9222.yml b/yml/09210ad5-1ef2-4077-9ad3-7351e13e9222.yml
@@ -17,6 +17,6 @@ executor: command_prompt
 sigma: true
 sigma_rule:
   - id: 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
-    name: proc_creation_win_net_susp_execution.yml
+    name: proc_creation_win_net_execution.yml
   - id: cb7c4a03-2871-43c0-9bbb-18bbdb079896
     name: proc_creation_win_net_share_unmount.yml
diff --git a/yml/0940a971-809a-48f1-9c4d-b1d785e96ee5.yml b/yml/0940a971-809a-48f1-9c4d-b1d785e96ee5.yml
@@ -24,4 +24,4 @@ executor: command_prompt
 sigma: true
 sigma_rule:
   - id: 1c67a717-32ba-409b-a45d-0fb704a73a81
-    name: proc_creation_win_net_network_connections_discovery.yml
+    name: proc_creation_win_net_use_network_connections_discovery.yml
diff --git a/yml/09480053-2f98-4854-be6e-71ae5f672224.yml b/yml/09480053-2f98-4854-be6e-71ae5f672224.yml
@@ -38,7 +38,7 @@ executor: command_prompt
 sigma: true
 sigma_rule:
   - id: 1c67a717-32ba-409b-a45d-0fb704a73a81
-    name: proc_creation_win_net_network_connections_discovery.yml
+    name: proc_creation_win_net_use_network_connections_discovery.yml
   - id: 502b42de-4306-40b4-9596-6f590c81f073
     name: proc_creation_win_susp_local_system_owner_account_discovery.yml
 
diff --git a/yml/0afb5163-8181-432e-9405-4322710c0c37.yml b/yml/0afb5163-8181-432e-9405-4322710c0c37.yml
@@ -18,4 +18,4 @@ executor: command_prompt
 sigma: true
 sigma_rule:
   - id: 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
-    name: proc_creation_win_net_susp_execution.yml
+    name: proc_creation_win_net_execution.yml
diff --git a/yml/0bb64470-582a-4155-bde2-d6003a95ed34.yml b/yml/0bb64470-582a-4155-bde2-d6003a95ed34.yml
@@ -31,10 +31,6 @@ sigma_rule:
     name: posh_ps_susp_invocation_specific.yml
   - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090
     name: posh_pm_susp_invocation_specific.yml
-  - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
-    name: posh_ps_file_and_directory_discovery.yml
-  - id: 0332a266-b584-47b4-933d-a00b103e1b37
-    name: posh_ps_susp_gwmi.yml
   - id: 403c2cc0-7f6b-4925-9423-bfa573bed7eb
     name: posh_ps_susp_download.yml
   - id: 03d83090-8cba-44a0-b02f-0b756a050306
@@ -76,7 +72,7 @@ sigma_rule:
   - id: 162e69a7-7981-4344-84a9-0f1c9a217a52
     name: posh_ps_susp_directory_enum.yml
   - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
-    name: net_connection_win_binary_susp_com.yml
+    name: net_connection_win_susp_file_sharing_domains_susp_folders.yml
   - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
     name: net_connection_win_powershell_network_connection.yml
   - id: 8d31a8ce-46b5-4dd6-bdc3-680931f1db86

diff --git a/yml/0be2230c-9ab3-4ac2-8826-3199b9a0ebf8.yml b/yml/0be2230c-9ab3-4ac2-8826-3199b9a0ebf8.yml
@@ -58,10 +58,8 @@ sigma_rule:
     name: proc_creation_win_sysinternals_eula_accepted.yml
   - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133
     name: registry_add_pua_sysinternals_execution_via_eula.yml
-  - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
-    name: proc_access_win_cred_dump_lsass_access.yml
   - id: a18dd26b-6450-46de-8c91-9659150cf088
-    name: proc_access_win_susp_proc_access_lsass.yml
+    name: proc_access_win_lsass_susp_access_flag.yml
   - id: a5a2d357-1ab8-4675-a967-ef9990a59391
     name: file_event_win_lsass_default_dump_file_names.yml
   - id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da