adjusted mitre att&ck mapping

terrancedejesus · terrancedejesus · commit 51fb30b8f8ea · 2024-11-05T13:58:54.000-05:00
diff --git a/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user.toml b/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user.toml
@@ -85,7 +85,7 @@ tags = [
     "Data Source: AWS SSM",
     "Use Case: Log Auditing",
     "Use Case: Threat Detection",
-    "Tactic: Initial Access",
+    "Tactic: Execution",
     "Resources: Investigation Guide",
 ]
 timestamp_override = "event.ingested"

Original file line number	Diff line number	Diff line change
`@@ -85,7 +85,7 @@ tags = [`
`85`	`85`	`"Data Source: AWS SSM",`
`86`	`86`	`"Use Case: Log Auditing",`
`87`	`87`	`"Use Case: Threat Detection",`
`88`		`- "Tactic: Initial Access",`
	`88`	`+ "Tactic: Execution",`
`89`	`89`	`"Resources: Investigation Guide",`
`90`	`90`	`]`
`91`	`91`	`timestamp_override = "event.ingested"`