diff --git a/rules/windows/process_creation/win_regini_ads.yml b/rules/windows/process_creation/win_regini_ads.yml index 967c1588a..f6a238593 100644 --- a/rules/windows/process_creation/win_regini_ads.yml +++ b/rules/windows/process_creation/win_regini_ads.yml @@ -1,7 +1,7 @@ title: Modifies the Registry From a ADS id: 77946e79-97f1-45a2-84b4-f37b5c0d8682 status: experimental -description: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys. +description: Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys. references: - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Regini.yml - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f