security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update rules/windows/file_change/file_change_win_unusual_modification_by_dns_exe.yml

Browse Source 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
This commit is contained in:
Gude5
2022-10-10 17:01:59 +02:00
committed by GitHub
parent 7a347cf8eb
commit d33f70668a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/file_change/file_change_win_unusual_modification_by_dns_exe.yml
+1 -1
View File
@@ -3,7 +3,7 @@ id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
status: experimental
author: Tim Rauch
date: 2022/09/27
description: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation
description: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
references:
- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns.exe.html
tags: