diff --git a/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml b/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml index 32d736f8b..2cc216d60 100644 --- a/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml +++ b/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml @@ -1,10 +1,10 @@ -title: Execution Of Not Existing File +title: Execution Of Non-Existing File id: 71158e3f-df67-472b-930e-7d287acaa3e1 status: experimental description: Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process) author: Max Altgelt date: 2021/12/09 -modified: 2022/01/25 +modified: 2022/02/22 references: - https://pentestlaboratories.com/2021/12/08/process-ghosting/ tags: