diff --git a/rules/windows/registry_event/sysmon_office_test_regadd.yml b/rules/windows/registry_event/sysmon_office_test_regadd.yml index f8ec62128..c6d2069ed 100644 --- a/rules/windows/registry_event/sysmon_office_test_regadd.yml +++ b/rules/windows/registry_event/sysmon_office_test_regadd.yml @@ -1,7 +1,7 @@ title: Office Application Startup - Office Test id: 3d27f6dd-1c74-4687-b4fa-ca849d128d1c status: experimental -description: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started +description: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed everytime an Office application is started references: - https://attack.mitre.org/techniques/T1137/002/ author: omkar72