diff --git a/rules/windows/process_creation/process_creation_susp_winzip.yml b/rules/windows/process_creation/process_creation_susp_winzip.yml index da7d2a78b..2e668c63e 100644 --- a/rules/windows/process_creation/process_creation_susp_winzip.yml +++ b/rules/windows/process_creation/process_creation_susp_winzip.yml @@ -2,7 +2,7 @@ title: Compress Data and Lock With Password for Exfiltration With WINZIP id: e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d status: experimental author: frack113 -date: +date: 2021/07/27 description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md