From 07e2ee474cdf90d2ce95173cd493e91a0bdfa3db Mon Sep 17 00:00:00 2001 From: mgreen27 Date: Sat, 15 Jun 2019 20:20:52 +1000 Subject: [PATCH] sigma/Add sysmon_renamed_binary --- rules/windows/sysmon/sysmon_renamed_binary.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/sysmon/sysmon_renamed_binary.yml b/rules/windows/sysmon/sysmon_renamed_binary.yml index 857abc5c9..3659f9352 100644 --- a/rules/windows/sysmon/sysmon_renamed_binary.yml +++ b/rules/windows/sysmon/sysmon_renamed_binary.yml @@ -1,6 +1,6 @@ title: Renamed Binary status: experimental -description: Detects the execution of a renamed binary often used by attackers or malware leveraging new +description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. author: Matthew Green - @mgreen27 date: 2019/06/15 references: