security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2728 from SigmaHQ/rule-devel

Browse Source 
docs: title changed
This commit is contained in:
Florian Roth
2022-02-23 10:27:41 +01:00
committed by GitHub
parent 86892c8f89 a5955730bd
commit bebfe4bfcf
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_image_missing.yml
+2 -2
View File
@@ -1,10 +1,10 @@
title: Execution Of Not Existing File
title: Execution Of Non-Existing File
id: 71158e3f-df67-472b-930e-7d287acaa3e1
status: experimental
description: Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)
author: Max Altgelt
date: 2021/12/09
modified: 2022/01/25
modified: 2022/02/22
references:
- https://pentestlaboratories.com/2021/12/08/process-ghosting/
tags: