From b3c0301bde30e47a8fcfb3044fa4e45111e72229 Mon Sep 17 00:00:00 2001 From: Qasim Qlf Date: Mon, 31 Oct 2022 15:23:05 +0500 Subject: [PATCH] Title Fix --- .../proc_creation_win_susp_shellexec_rundll_usage.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml b/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml index 044897ef8..6f01fdf41 100644 --- a/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml +++ b/rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml @@ -1,4 +1,4 @@ -title: Suspicious Usage Of ShellExec_RundDLL +title: Suspicious Usage Of ShellExec_RunDLL id: d87bd452-6da1-456e-8155-7dc988157b7d status: experimental description: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack @@ -7,6 +7,7 @@ references: - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ author: Nasreddine Bencherchali date: 2022/09/01 +modified: 2022/10/31 tags: - attack.defense_evasion logsource: