Fix typo in win_apt_lazarus_session_hijack.yml

2020-11-03 14:46:29 +01:00
parent 413abf13cd
commit 4a5b2d642e
1 changed files with 2 additions and 2 deletions
@@ -8,7 +8,7 @@ tags:
    - attack.defense_evasion
    - attack.t1036 # an old one
    - attack.t1036.005
-author: Trent Liffick (@tliffick)
+author: Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)
 date: 2020/06/03
 logsource:
    category: process_creation
@@ -16,7 +16,7 @@ logsource:
 detection:
    selection:
        Image: 
-            - '*\mstdc.exe'
+            - '*\msdtc.exe'
            - '*\gpvc.exe'
    filter:
        Image: