Resolved more issues from last commit as per comments

Added the following fixes to text inside the rule:
date
attack.defense_evasion
added custome id
This commit is contained in:
Cyb3rEng
2021-09-09 21:24:05 -06:00
committed by GitHub
parent e64bb1783e
commit 7c9be6da32
@@ -1,4 +1,5 @@
title: LOLBins Process Created With Office Application
id: 7ce4d5ba-11e6-11ec-82a8-0242ac130003
description: This rule will monitor any office apps that spins up a new LOLBin process. This activity is pretty suspicious and should be investigated.
references:
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
@@ -9,9 +10,9 @@ tags:
- attack.t1047
- attack.t1218.010
- attack.execution
- attack.defence_evasion
- attack.defense_evasion
status: experimental
Date: 2021/08/23
date: 2021/08/23
logsource:
product: Windows
category: process_creation