diff --git a/rules/windows/file_event/sysmon_powershell_startup_shortcuts.yml b/rules/windows/file_event/sysmon_powershell_startup_shortcuts.yml index 2f0b954bf..70c82df34 100644 --- a/rules/windows/file_event/sysmon_powershell_startup_shortcuts.yml +++ b/rules/windows/file_event/sysmon_powershell_startup_shortcuts.yml @@ -1,4 +1,4 @@ -title: PowerShell writing startup shortcuts +title: PowerShell Writing Startup Shortcuts id: 92fa78e7-4d39-45f1-91a3-8b23f3f1088d description: Attempts to detect PowerShell writing startup shortcuts. status: experimental @@ -17,7 +17,7 @@ tags: - attack.registry_run_keys_/_startup_folder - attack.t1547.001 date: 2021/10/24 -author: Christopher Peacock (@securepeacock), SCYTHE +author: Christopher Peacock '@securepeacock', SCYTHE level: high logsource: product: windows