diff --git a/rules/windows/process_creation/proc_creation_win_import_cert_susp_locations.yml b/rules/windows/process_creation/proc_creation_win_import_cert_susp_locations.yml index 80ab6442b..38c0bba81 100644 --- a/rules/windows/process_creation/proc_creation_win_import_cert_susp_locations.yml +++ b/rules/windows/process_creation/proc_creation_win_import_cert_susp_locations.yml @@ -7,7 +7,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps author: Nasreddine Bencherchali date: 2022/09/09 -modified: 2022/12/29 +modified: 2023/01/16 tags: - attack.defense_evasion - attack.t1553.004 @@ -18,7 +18,7 @@ detection: selection: CommandLine|contains|all: - 'Import-Certificate' - - ' -File-Path ' + - ' -FilePath ' - 'Cert:\LocalMachine\Root' CommandLine|contains: - '\AppData\Local\Temp\'