diff --git a/rules/windows/network_connection/sysmon_dllhost_net_connections.yml b/rules/windows/network_connection/sysmon_dllhost_net_connections.yml index 6b11396dd..884bedc1a 100644 --- a/rules/windows/network_connection/sysmon_dllhost_net_connections.yml +++ b/rules/windows/network_connection/sysmon_dllhost_net_connections.yml @@ -4,7 +4,7 @@ status: experimental description: Detects Dllhost that communicates with public IP addresses references: - https://github.com/Neo23x0/sigma/blob/master/rules/windows/network_connection/sysmon_rundll32_net_connections.yml -author: @bartblaze +author: bartblaze date: 2020/07/13 tags: - attack.defense_evasion @@ -40,4 +40,4 @@ detection: condition: selection and not filter falsepositives: - Communication to other corporate systems that use IP addresses from public address spaces -level: medium \ No newline at end of file +level: medium