diff --git a/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml b/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml index a4494f036..4e79ed023 100644 --- a/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml +++ b/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml @@ -1,7 +1,7 @@ title: MITRE BZAR Indicators for ATT&CK Execution id: b640c0b8-87f8-4daa-aef8-95a24261dd1d description: 'Windows DCE-RPC functions which indicate an ATT&CK-like Execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.' -author: '@neu5ron, @SOC_Prime' +author: '@neu5ron, SOC Prime' date: 2020/03/19 references: - https://github.com/mitre-attack/bzar#indicators-for-attck-execution diff --git a/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml b/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml index cfeffe917..3cce80d46 100644 --- a/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml +++ b/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml @@ -1,7 +1,7 @@ title: MITRE BZAR Indicators for ATT&CK Persistence id: 53389db6-ba46-48e3-a94c-e0f2cefe1583 description: 'Windows DCE-RPC functions which indicate an ATT&CK-like Persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.' -author: '@neu5ron, @SOC_Prime' +author: '@neu5ron, SOC Prime' date: 2020/03/19 references: - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence