Add "ICS Phishing" TTP to calendar/ICS rules

detection-rules/attachment_html_smuggling_atob_ics.yml

@@ -65,6 +65,7 @@ attack_types:
 tactics_and_techniques:
   - "Evasion"
   - "HTML smuggling"
+  - "ICS Phishing"
   - "Scripting"
 detection_methods:
   - "File analysis"

detection-rules/attachment_html_smuggling_eval_atob_calendar.yml

@@ -15,6 +15,7 @@ attack_types:
 tactics_and_techniques:
   - "Evasion"
   - "HTML smuggling"
+  - "ICS Phishing"
   - "Scripting"
 detection_methods:
   - "File analysis"

detection-rules/attachment_ics_aws_lambda_url.yml

@@ -19,6 +19,7 @@ attack_types:
 tactics_and_techniques:
   - "Evasion"
   - "Free file host"
+  - "ICS Phishing"
 detection_methods:
   - "Content analysis"
   - "File analysis"

detection-rules/attachment_ics_embedded_document.yml

@@ -26,6 +26,7 @@ attack_types:
   - "Malware/Ransomware"
 tactics_and_techniques:
   - "Evasion"
+  - "ICS Phishing"
 detection_methods:
   - "File analysis"
 id: "8f9957d9-a06a-5c5a-83af-2dc5c25bed86"

detection-rules/attachment_ics_employee_policy.yml

@@ -24,6 +24,7 @@ attack_types:
   - "BEC/Fraud"
 tactics_and_techniques:
   - "Evasion"
+  - "ICS Phishing"
   - "Social engineering"
 detection_methods:
   - "File analysis"

detection-rules/attachment_ics_exessive_custom_properties.yml

@@ -17,6 +17,7 @@ attack_types:
   - "Malware/Ransomware"
 tactics_and_techniques:
   - "Evasion"
+  - "ICS Phishing"
 detection_methods:
   - "File analysis"
   - "Content analysis"

detection-rules/attachment_ics_file_non_rfc_compliant.yml

@@ -32,6 +32,7 @@ tags:
  - "Attack surface reduction"
 tactics_and_techniques:
   - "Evasion"
+  - "ICS Phishing"
   - "Social engineering"
 detection_methods:
   - "Archive analysis"

detection-rules/attachment_ics_google_redirect_invoice.yml

@@ -21,6 +21,7 @@ attack_types:
   - "Credential Phishing"
   - "BEC/Fraud"
 tactics_and_techniques:
+  - "ICS Phishing"
   - "Open redirect"
   - "Social engineering"
 detection_methods:

detection-rules/attachment_ics_meeting_invite.yml

@@ -15,6 +15,7 @@ attack_types:
   - "BEC/Fraud"
   - "Credential Phishing"
 tactics_and_techniques:
+  - "ICS Phishing"
   - "Social engineering"
 detection_methods:
   - "File analysis"

detection-rules/attachment_ics_non-gregorian.yml

@@ -15,6 +15,7 @@ attack_types:
   - "Credential Phishing"
 tactics_and_techniques:
   - "Evasion"
+  - "ICS Phishing"
 detection_methods:
   - "File analysis"
   - "Content analysis"

detection-rules/attachment_ics_open_redirect.yml

@@ -58,6 +58,7 @@ tactics_and_techniques:
   - "Free email provider"
   - "Free file host"
   - "Free subdomain host"
+  - "ICS Phishing"
   - "Open redirect"
 detection_methods:
   - "Content analysis"

detection-rules/attachment_ics_organizer_new_domain.yml

@@ -23,6 +23,7 @@ attack_types:
   - "Callback Phishing"
 tactics_and_techniques:
   - "Evasion"
+  - "ICS Phishing"
   - "Social engineering"
 detection_methods:
   - "File analysis"

detection-rules/attachment_ics_spoofed_with_attachment.yml

@@ -56,6 +56,7 @@ attack_types:
 tactics_and_techniques:
   - "Spoofing"
   - "Evasion"
+  - "ICS Phishing"
 detection_methods:
   - "File analysis"
   - "Header analysis"

detection-rules/attachment_ics_svg_js.yml

@@ -35,6 +35,7 @@ attack_types:
 tactics_and_techniques:
   - "Scripting"
   - "Evasion"
+  - "ICS Phishing"
 detection_methods:
   - "File analysis"
   - "Javascript analysis"

detection-rules/attachment_ics_with_invisible_unicode_characters.yml

@@ -27,6 +27,7 @@ attack_types:
   - "Malware/Ransomware"
 tactics_and_techniques:
   - "Evasion"
+  - "ICS Phishing"
 detection_methods:
   - "File analysis"
   - "Content analysis"

detection-rules/callback_phishing_calendar_invite.yml

@@ -36,6 +36,7 @@ attack_types:
 tactics_and_techniques:
   - "Social engineering"
   - "Evasion"
+  - "ICS Phishing"
 detection_methods:
   - "File analysis"
   - "Header analysis"

detection-rules/link_gcal_invite_open_redirect.yml

@@ -43,6 +43,7 @@ attack_types:
 tactics_and_techniques:
   - "Free email provider"
   - "Free file host"
+  - "ICS Phishing"
   - "Open redirect"
   - "Social engineering"
 detection_methods:

detection-rules/service_abuse_google_calendar_notification.yml

@@ -12,6 +12,7 @@ source: |
 attack_types:
   - "Callback Phishing"
 tactics_and_techniques:
+  - "ICS Phishing"
   - "Out of band pivot"
   - "Social engineering"
 detection_methods: