Update IPEntity_Workday.yaml

Added Mitre info
Azure · Nov 21, 2024 · 76ddb22 · 76ddb22
1 parent c3b6626
commit 76ddb22
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml
@@ -21,7 +21,9 @@ queryPeriod: 14d
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
+  - CommandAndControl
 relevantTechniques:
+  - T1071
 query: |
   let dtLookBack = 1h; // Define the lookback period for audit events
   let ioc_lookBack = 14d; // Define the lookback period for threat intelligence indicators