diff --git a/rules/windows/image_load/image_load_side_load_antivirus.yml b/rules/windows/image_load/image_load_side_load_antivirus.yml index 956a53b76..ae12aa511 100644 --- a/rules/windows/image_load/image_load_side_load_antivirus.yml +++ b/rules/windows/image_load/image_load_side_load_antivirus.yml @@ -1,7 +1,7 @@ -title: Antivirus Software DLL Sideloading +title: Potential Antivirus Software DLL Sideloading id: 552b6b65-df37-4d3e-a258-f2fc4771ae54 status: experimental -description: Detects DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc +description: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc references: - https://hijacklibs.net/ # For list of DLLs that could be sideloaded (search for dlls mentioned here in there) author: Nasreddine Bencherchali, Wietze Beukema (project and research)