diff --git a/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml b/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml index 044897ef8..6f01fdf41 100644 --- a/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml +++ b/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml @@ -1,4 +1,4 @@ -title: Suspicious Usage Of ShellExec_RundDLL +title: Suspicious Usage Of ShellExec_RunDLL id: d87bd452-6da1-456e-8155-7dc988157b7d status: experimental description: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack @@ -7,6 +7,7 @@ references: - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ author: Nasreddine Bencherchali date: 2022/09/01 +modified: 2022/10/31 tags: - attack.defense_evasion logsource: