From 3ffe83bd70635ffaf81fa27bdf51f2f72e18bcbb Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Fri, 10 Jun 2022 13:18:55 +0200 Subject: [PATCH] fix: typo --- .../proc_creation_win_archiver_iso_phishing.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/process_creation/proc_creation_win_archiver_iso_phishing.yml b/rules/windows/process_creation/proc_creation_win_archiver_iso_phishing.yml index de6c58641..17176eadc 100644 --- a/rules/windows/process_creation/proc_creation_win_archiver_iso_phishing.yml +++ b/rules/windows/process_creation/proc_creation_win_archiver_iso_phishing.yml @@ -1,6 +1,6 @@ title: Phishing Pattern ISO in Archive id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1 -status: experminetal +status: experimental description: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is open a signa of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web) author: Florian Roth references: