warzone_rat

[tccontre]

Tagged

   modified:   detections/endpoint/cmd_carry_out_string_command_parameter.yml
    modified:   detections/endpoint/create_remote_thread_in_shell_application.yml
    modified:   detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
    modified:   detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
    modified:   detections/endpoint/office_application_drop_executable.yml
    modified:   detections/endpoint/office_product_spawn_cmd_process.yml
    modified:   detections/endpoint/ping_sleep_batch_command.yml
    modified:   detections/endpoint/powershell_windows_defender_exclusion_commands.yml
    modified:   detections/endpoint/registry_keys_used_for_persistence.yml
    modified:   detections/endpoint/suspicious_process_file_path.yml
    modified:   detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
    modified:   detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
    modified:   detections/endpoint/windows_defender_exclusion_registry_entry.yml
    modified:   detections/endpoint/windows_iso_lnk_file_creation.yml
    modified:   detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
    modified:   detections/endpoint/windows_process_injection_remote_thread.yml
    modified:   detections/endpoint/hide_user_account_from_sign_in_screen.yml

story

    new file:   stories/warzone_rat.yml

What does this PR have in it? Screenshots are worth 1000 words 😄

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.