Update taxonomy to be more consistent

.index.json

@@ -8988,7 +8988,7 @@
   },
   "crowdsecurity/CVE-2023-4911": {
    "path": "scenarios/crowdsecurity/CVE-2023-4911.yaml",
-   "version": "0.5",
+   "version": "0.6",
    "versions": {
     "0.1": {
      "digest": "c9be24878aab5602152e6873ee337e62eb3edb0e2ce9b3d2c873ee7112660379",
@@ -9009,13 +9009,17 @@
     "0.5": {
      "digest": "f5a94401d7320b28d98147631aed97d6e9912ae842fc17efebd5239a105eed28",
      "deprecated": false
+    },
+    "0.6": {
+     "digest": "7af1594c47d034e3c39b10ccf4058d6a17b1d63fe33f81814e4e8977d6d2548b",
+     "deprecated": false
     }
    },
-   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTQ5MTEKZGVzY3JpcHRpb246ICJleHBsb2l0YXRpb24gb2YgQ1ZFLTIwMjMtNDkxMTogc2VnZmF1bHRpbmcgaW4gZHluYW1pYyBsb2FkZXIiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdrZXJuZWwnICYmIGV2dC5NZXRhLnN1Yl9sb2dfdHlwZSA9PSAnc2VnZmF1bHQnICYmIGV2dC5NZXRhLmxpYnJhcnkgc3RhcnRzV2l0aCAnbGQtbGludXgtJyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1NDguMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpleHBsb2l0YXRpb24iCiAgbGFiZWw6ICJDVkUtMjAyMy00OTExIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IGV4ZQogIGV4cHJlc3Npb246IGV2dC5NZXRhLmJpbmFyeQo=",
+   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTQ5MTEKZGVzY3JpcHRpb246ICJleHBsb2l0YXRpb24gb2YgQ1ZFLTIwMjMtNDkxMTogc2VnZmF1bHRpbmcgaW4gZHluYW1pYyBsb2FkZXIiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdrZXJuZWwnICYmIGV2dC5NZXRhLnN1Yl9sb2dfdHlwZSA9PSAnc2VnZmF1bHQnICYmIGV2dC5NZXRhLmxpYnJhcnkgc3RhcnRzV2l0aCAnbGQtbGludXgtJyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1NDguMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpleHBsb2l0IgogIGxhYmVsOiAiQ1ZFLTIwMjMtNDkxMSIKICBzZXJ2aWNlOiBsaW51eAogIHJlbWVkaWF0aW9uOiBmYWxzZQpzY29wZToKICB0eXBlOiBleGUKICBleHByZXNzaW9uOiBldnQuTWV0YS5iaW5hcnkK",
    "description": "exploitation of CVE-2023-4911: segfaulting in dynamic loader",
    "author": "crowdsecurity",
    "labels": {
-    "behavior": "linux:exploitation",
+    "behavior": "linux:exploit",
     "classification": [
      "attack.T1548.004"
     ],
@@ -9349,7 +9353,7 @@
   },
   "crowdsecurity/auditd-suid-crash": {
    "path": "scenarios/crowdsecurity/auditd-suid-crash.yaml",
-   "version": "0.6",
+   "version": "0.7",
    "versions": {
     "0.1": {
      "digest": "363efa4bbcda1abd870a49673ab402da63312259200e69bf9f80d565b24e4f45",
@@ -9374,14 +9378,18 @@
     "0.6": {
      "digest": "de0dd532eba64e3b20c8ef7103e8523c36248bbb13ed09239ace03e88b5d1862",
      "deprecated": false
+    },
+    "0.7": {
+     "digest": "0ccbfea09f7e9a8eb5f207bc6a4c3da3f91b917acf387da6aaa0adf0357b76f0",
+     "deprecated": false
     }
    },
    "long_description": "IyMgQXVkaXRkIDogQ3Jhc2ggb2Ygc3VpZCBiaW5hcnkKCkF0dGVtcHQgdG8gZGV0ZWN0IGEgU1VJRCBiaW5hcnkgdGhhdCBjcmFzaGVzIHdpdGggYFNJR0lMTGAsIGBTSUdUUkFQYCwgYFNJR0FCUlRgLCBgU0lHQlVTYCwgYFNJR1NFR1ZgLgoKSXQgbWlnaHQgYmUgcmVsYXRlZCB0byBzb21lb25lIHRyeWluZyB0byBleHBsb2l0IGxvY2FsIHByaXZpbGVnZSBlc2NhbGF0aW9uIHN1Y2ggYXMgW0NWRS0yMDIzLTQ5MTFdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIzLTQ5MTEpLgo=",
-   "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtc3VpZC1jcmFzaApkZXNjcmlwdGlvbjogIkRldGVjdCByb290IHN1aWQgcHJvY2VzcyBjcmFzaGluZyIKZmlsdGVyOiB8CiAgKGV2dC5NZXRhLmxvZ190eXBlID09ICdleGVjdmUnICYmIGV2dC5NZXRhLmV1aWQgPT0gJzAnICYmIGV2dC5NZXRhLmF1aWQgIT0gJzAnKSB8fAogIChldnQuTWV0YS5sb2dfdHlwZSA9PSAnYW5vbV9hYmVuZCcgJiYgZXZ0Lk1ldGEuc2lnIGluIFsiNCIsICI1IiwgIjYiLCAiNyIsICIxMSJdKQpncm91cGJ5OiBldnQuTWV0YS5waWQKZGlzdGluY3Q6IGV2dC5NZXRhLmxvZ190eXBlCmNvbmRpdGlvbjogfAogIGxlbihxdWV1ZS5RdWV1ZSkgPj0gMiBhbmQgCiAgICBxdWV1ZS5RdWV1ZVswXS5NZXRhLmV4ZSA9PSBxdWV1ZS5RdWV1ZVsxXS5NZXRhLmV4ZQpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAtMQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU0OC4wMDQKICBiZWhhdmlvcjogImxpbnV4OmV4cGxvaXRhdGlvbiIKICBsYWJlbDogIlN1c3BpY2lvdXMgc3VpZCBwcm9jZXNzIGNyYXNoIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IGV4ZQogIGV4cHJlc3Npb246IGV2dC5NZXRhLmV4ZQo=",
+   "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtc3VpZC1jcmFzaApkZXNjcmlwdGlvbjogIkRldGVjdCByb290IHN1aWQgcHJvY2VzcyBjcmFzaGluZyIKZmlsdGVyOiB8CiAgKGV2dC5NZXRhLmxvZ190eXBlID09ICdleGVjdmUnICYmIGV2dC5NZXRhLmV1aWQgPT0gJzAnICYmIGV2dC5NZXRhLmF1aWQgIT0gJzAnKSB8fAogIChldnQuTWV0YS5sb2dfdHlwZSA9PSAnYW5vbV9hYmVuZCcgJiYgZXZ0Lk1ldGEuc2lnIGluIFsiNCIsICI1IiwgIjYiLCAiNyIsICIxMSJdKQpncm91cGJ5OiBldnQuTWV0YS5waWQKZGlzdGluY3Q6IGV2dC5NZXRhLmxvZ190eXBlCmNvbmRpdGlvbjogfAogIGxlbihxdWV1ZS5RdWV1ZSkgPj0gMiBhbmQgCiAgICBxdWV1ZS5RdWV1ZVswXS5NZXRhLmV4ZSA9PSBxdWV1ZS5RdWV1ZVsxXS5NZXRhLmV4ZQpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAtMQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU0OC4wMDQKICBiZWhhdmlvcjogImxpbnV4OmV4cGxvaXQiCiAgbGFiZWw6ICJTdXNwaWNpb3VzIHN1aWQgcHJvY2VzcyBjcmFzaCIKICBzZXJ2aWNlOiBsaW51eAogIHJlbWVkaWF0aW9uOiBmYWxzZQpzY29wZToKICB0eXBlOiBleGUKICBleHByZXNzaW9uOiBldnQuTWV0YS5leGUK",
    "description": "Detect root suid process crashing",
    "author": "crowdsecurity",
    "labels": {
-    "behavior": "linux:exploitation",
+    "behavior": "linux:exploit",
     "classification": [
      "attack.T1548.004"
     ],
@@ -13047,7 +13055,7 @@
   },
   "crowdsecurity/windows-CVE-2022-30190-msdt": {
    "path": "scenarios/crowdsecurity/windows-CVE-2022-30190-msdt.yaml",
-   "version": "0.2",
+   "version": "0.3",
    "versions": {
     "0.1": {
      "digest": "6cac369ca1553245cf9a837275492822387a43a0a4f138560dfdda208def1103",
@@ -13056,14 +13064,18 @@
     "0.2": {
      "digest": "2e41d1c94e7af7e2cdb8eb0c22152a44f320b9e7ef00b6604b3f77977e86f3ed",
      "deprecated": false
+    },
+    "0.3": {
+     "digest": "72686edaab2f083196376f0658620382c46e3bb66922082f05e93c4d451fe5b0",
+     "deprecated": false
     }
    },
    "long_description": "VGhpcyBzY2VuYXJpbyBkZXRlY3RzIHNvbWUgYXR0ZW1wdHMgYXQgZXhwbG9pdGluZyBbQ1ZFLTIwMjItMzAxOTBdKGh0dHBzOi8vbXNyYy1ibG9nLm1pY3Jvc29mdC5jb20vMjAyMi8wNS8zMC9ndWlkYW5jZS1mb3ItY3ZlLTIwMjItMzAxOTAtbWljcm9zb2Z0LXN1cHBvcnQtZGlhZ25vc3RpYy10b29sLXZ1bG5lcmFiaWxpdHkvKSBvbiBXaW5kb3dzLgoKSXQgZG9lcyBzbyBieSBwYXJzaW5nIHN5c21vbiBsb2dzLCBtb3JlIHNwZWNpZmljYWxseSB0aGUgb25lIHdpdGggZXZlbnQgSUQgMSAocHJvY2VzcyBjcmVhdGlvbikuCgpUaGlzIG1lYW5zIHRoYXQgeW91IG5lZWQgYSB3b3JraW5nIHN5c21vbiBpbnN0YWxsYXRpb24gdG8gYmUgYWJsZSB0byB1c2UgdGhpcyBzY2VuYXJpby4g",
-   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTMwMTkwLW1zZHQKZGVzY3JpcHRpb246ICJEZXRlY3QgQ1ZFLTIwMjItMzAxOTAgZnJvbSBzeXNtb24gZXZlbnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5zZXJ2aWNlID09ICdzeXNtb24nICYmIGV2dC5QYXJzZWQuRXZlbnRJRCA9PSAnMScgJiYgCiAgVXBwZXIoZXZ0LlBhcnNlZC5JbWFnZSkgZW5kc1dpdGggJ01TRFQuRVhFJyAmJiAKICBVcHBlcihldnQuUGFyc2VkLlBhcmVudEltYWdlKSBlbmRzV2l0aCAnV0lOV09SRC5FWEUnICYmCiAgKFVwcGVyKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUpIGNvbnRhaW5zICdQQ1dESUFHTk9TVElDJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfUkVCUk9XU0VGT1JGSUxFJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfQlJPV1NFRk9SRklMRScpCmxhYmVsczoKICB0eXBlOiByY2UKICBub3RpZmljYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA1OQogICAgLSBhdHRhY2suVDEyMDMKICAgIC0gY3ZlLkNWRS0yMDIyLTMwMTkwCiAgYmVoYXZpb3JzOiAid2luZG93czpyY2UiCiAgbGFiZWw6ICJDVkUtMjAyMi0zMDE5MCIKICBzZXJ2aWNlOiB3aW5kb3dzCnNjb3BlOgogIHR5cGU6IHVzZXJfYWNjb3VudAogIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuVXNlcgo=",
+   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTMwMTkwLW1zZHQKZGVzY3JpcHRpb246ICJEZXRlY3QgQ1ZFLTIwMjItMzAxOTAgZnJvbSBzeXNtb24gZXZlbnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5zZXJ2aWNlID09ICdzeXNtb24nICYmIGV2dC5QYXJzZWQuRXZlbnRJRCA9PSAnMScgJiYgCiAgVXBwZXIoZXZ0LlBhcnNlZC5JbWFnZSkgZW5kc1dpdGggJ01TRFQuRVhFJyAmJiAKICBVcHBlcihldnQuUGFyc2VkLlBhcmVudEltYWdlKSBlbmRzV2l0aCAnV0lOV09SRC5FWEUnICYmCiAgKFVwcGVyKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUpIGNvbnRhaW5zICdQQ1dESUFHTk9TVElDJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfUkVCUk9XU0VGT1JGSUxFJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfQlJPV1NFRk9SRklMRScpCmxhYmVsczoKICB0eXBlOiByY2UKICBub3RpZmljYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA1OQogICAgLSBhdHRhY2suVDEyMDMKICAgIC0gY3ZlLkNWRS0yMDIyLTMwMTkwCiAgYmVoYXZpb3JzOiAid2luZG93czpleHBsb2l0IgogIGxhYmVsOiAiQ1ZFLTIwMjItMzAxOTAiCiAgc2VydmljZTogd2luZG93cwpzY29wZToKICB0eXBlOiB1c2VyX2FjY291bnQKICBleHByZXNzaW9uOiBldnQuUGFyc2VkLlVzZXIK",
    "description": "Detect CVE-2022-30190 from sysmon events",
    "author": "crowdsecurity",
    "labels": {
-    "behaviors": "windows:rce",
+    "behaviors": "windows:exploit",
     "classification": [
      "attack.T1059",
      "attack.T1203",

scenarios/crowdsecurity/CVE-2023-4911.yaml

@@ -8,7 +8,7 @@ labels:
   spoofable: 0
   classification:
     - attack.T1548.004
-  behavior: "linux:exploitation"
+  behavior: "linux:exploit"
   label: "CVE-2023-4911"
   service: linux
   remediation: false

scenarios/crowdsecurity/auditd-suid-crash.yaml

@@ -17,7 +17,7 @@ labels:
   spoofable: 0
   classification:
     - attack.T1548.004
-  behavior: "linux:exploitation"
+  behavior: "linux:exploit"
   label: "Suspicious suid process crash"
   service: linux
   remediation: false

scenarios/crowdsecurity/windows-CVE-2022-30190-msdt.yaml

@@ -15,7 +15,7 @@ labels:
     - attack.T1059
     - attack.T1203
     - cve.CVE-2022-30190
-  behaviors: "windows:rce"
+  behaviors: "windows:exploit"
   label: "CVE-2022-30190"
   service: windows
 scope:

taxonomy/behaviors.json

@@ -119,10 +119,10 @@
         "label": "SMB/RDP bruteforce",
         "name": "windows:bruteforce"
     },
-    "windows:rce": {
+    "windows:exploit": {
         "description": "IP has been reported for exploiting Windows",
         "label": "Windows Exploit",
-        "name": "windows:rce"
+        "name": "windows:exploit"
     },
     "linux:post-exploitation": {
         "description": "IP has been reported for post exploitation on Linux",
@@ -164,9 +164,9 @@
         "label": "K8s Audit",
         "name": "k8s:audit"
     },
-    "linux:exploitation": {
+    "linux:exploit": {
         "description": "Attempt to exploit a Linux vulnerability to escalate privilege",
         "label": "Linux Exploitation",
-        "name": "linux:exploitation"
+        "name": "linux:exploit"
     }
 }