diff --git a/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml b/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml index 5bdacc631..ad78be048 100644 --- a/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml +++ b/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml @@ -8,7 +8,7 @@ related: - id: 19d65a1c-8540-4140-8062-8eb00db0bba5 type: similar status: experimental -description: Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these API to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts. +description: Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts. references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)