diff --git a/rules/community/workspace/google_workspace_application_added.yaral b/rules/community/workspace/google_workspace_application_added.yaral index dee1571..6f62496 100644 --- a/rules/community/workspace/google_workspace_application_added.yaral +++ b/rules/community/workspace/google_workspace_application_added.yaral @@ -1,5 +1,5 @@ /* - * Copyright 2023 Google LLC + * Copyright 2026 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -22,9 +22,11 @@ rule google_workspace_application_added { rule_id = "mr_bb4f5ff0-76b8-4b08-8b1b-fcb81e5a10cc" rule_name = "Google Workspace Application Added" mitre_attack_tactic = "Persistence" - mitre_attack_technique = "" - mitre_attack_url = "" - mitre_attack_version = "v13.1" + mitre_attack_technique = "Cloud Application Integration" + mitre_attack_url = "https://attack.mitre.org/versions/v17/techniques/T1671/" + mitre_attack_version = "v17.1" + tactic = "TA0003" + technique = "T1671" type = "Alert" data_source = "Workspace Activity" severity = "High"