From a5955730bda231c3293a0458423166d93728a561 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Tue, 22 Feb 2022 19:10:20 +0100 Subject: [PATCH] docs: title changed --- .../process_creation/proc_creation_win_susp_image_missing.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml b/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml index 32d736f8b..2cc216d60 100644 --- a/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml +++ b/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml @@ -1,10 +1,10 @@ -title: Execution Of Not Existing File +title: Execution Of Non-Existing File id: 71158e3f-df67-472b-930e-7d287acaa3e1 status: experimental description: Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process) author: Max Altgelt date: 2021/12/09 -modified: 2022/01/25 +modified: 2022/02/22 references: - https://pentestlaboratories.com/2021/12/08/process-ghosting/ tags: