Resolved more issues from last commit as per comments
Added the following fixes to text inside the rule: date attack.defense_evasion added custome id
This commit is contained in:
@@ -1,4 +1,5 @@
|
||||
title: LOLBins Process Created With Office Application
|
||||
id: 7ce4d5ba-11e6-11ec-82a8-0242ac130003
|
||||
description: This rule will monitor any office apps that spins up a new LOLBin process. This activity is pretty suspicious and should be investigated.
|
||||
references:
|
||||
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
|
||||
@@ -9,9 +10,9 @@ tags:
|
||||
- attack.t1047
|
||||
- attack.t1218.010
|
||||
- attack.execution
|
||||
- attack.defence_evasion
|
||||
- attack.defense_evasion
|
||||
status: experimental
|
||||
Date: 2021/08/23
|
||||
date: 2021/08/23
|
||||
logsource:
|
||||
product: Windows
|
||||
category: process_creation
|
||||
|
||||
Reference in New Issue
Block a user