From 8a06af13645941637f6ea03bda142f481ad89dc6 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Jun 2023 10:54:18 +0200 Subject: [PATCH] feat: apply suggestions from code review Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com> --- ...web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml | 2 +- .../proc_creation_win_powershell_susp_child_processes.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rules-emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml b/rules-emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml index 1f3f1aaa1..aa062448f 100644 --- a/rules-emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml +++ b/rules-emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml @@ -1,7 +1,7 @@ title: Potential CVE-2023-25717 Exploitation Attempt id: 043c1609-0e32-4462-a6f2-5a0c2da3fafe status: experimental -description: Detects the potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin +description: Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin references: - https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/ author: Nasreddine Bencherchali (Nextron Systems) diff --git a/rules/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml b/rules/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml index 917742a7a..2e913cdca 100644 --- a/rules/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml +++ b/rules/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml @@ -1,7 +1,7 @@ title: Potentially Suspicious PowerShell Child Processes id: e4b6d2a7-d8a4-4f19-acbd-943c16d90647 status: experimental -description: Detects potential suspicious child processes spawned by PowerShell +description: Detects potentially suspicious child processes spawned by PowerShell references: - https://twitter.com/ankit_anubhav/status/1518835408502620162 author: Florian Roth (Nextron Systems), Tim Shelton