From c9183fcb1c22840ddb62d8905b05ff2c3471d395 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Thu, 19 Jan 2023 11:54:05 +0100
Subject: [PATCH] whirlpool: attack and mbc

---
 nursery/hash-data-using-whirlpool.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nursery/hash-data-using-whirlpool.yml b/nursery/hash-data-using-whirlpool.yml
index 73a64829b..81342bcec 100644
--- a/nursery/hash-data-using-whirlpool.yml
+++ b/nursery/hash-data-using-whirlpool.yml
@@ -5,6 +5,10 @@ rule:
     authors:
       - william.ballenthin@mandiant.com
     scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
+    mbc:
+      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
     references:
       - https://github.com/jzelinskie/whirlpool/blob/master/const.go
     #examples: