From 437d4a30e5a3cd2f918e8f2004c90f44743d1f30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=BCrgen=20L=C3=B6hel?= <juergen.loehel@inlyse.com>
Date: Wed, 8 Mar 2023 21:45:13 -0600
Subject: [PATCH] chg [tds]: Add 404 TDS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
---
 clusters/tds.json | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/clusters/tds.json b/clusters/tds.json
index 5b7658f..7475e55 100644
--- a/clusters/tds.json
+++ b/clusters/tds.json
@@ -132,7 +132,20 @@
       },
       "uuid": "ec0048f2-a7b2-4a71-83de-6e8fe4fef252",
       "value": "Orchid TDS"
+    },
+    {
+      "description": "Proofpoint has tracked the 404 TDS since at least September 2022. Proofpoint is not aware if this is a service sold on underground forums, but it is likely a shared or sold tool due to its involvement in a variety of phishing and malware campaigns.",
+      "meta": {
+        "refs": [
+          "https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me"
+        ],
+        "type": [
+          "Underground"
+        ]
+      },
+      "uuid": "7b956ff0-9021-499c-82a4-24b958cb32d9",
+      "value": "404 TDS"
     }
   ],
-  "version": 4
+  "version": 5
 }