From 308420bf7f2bcf61bfbb520d0e81c1d22ad005b2 Mon Sep 17 00:00:00 2001 From: Bart Date: Mon, 13 Jul 2020 21:20:55 +0200 Subject: [PATCH] Update sysmon_dllhost_net_connections.yml Fix @ --- .../network_connection/sysmon_dllhost_net_connections.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/windows/network_connection/sysmon_dllhost_net_connections.yml b/rules/windows/network_connection/sysmon_dllhost_net_connections.yml index 6b11396dd..884bedc1a 100644 --- a/rules/windows/network_connection/sysmon_dllhost_net_connections.yml +++ b/rules/windows/network_connection/sysmon_dllhost_net_connections.yml @@ -4,7 +4,7 @@ status: experimental description: Detects Dllhost that communicates with public IP addresses references: - https://github.com/Neo23x0/sigma/blob/master/rules/windows/network_connection/sysmon_rundll32_net_connections.yml -author: @bartblaze +author: bartblaze date: 2020/07/13 tags: - attack.defense_evasion @@ -40,4 +40,4 @@ detection: condition: selection and not filter falsepositives: - Communication to other corporate systems that use IP addresses from public address spaces -level: medium \ No newline at end of file +level: medium