From 22cb51ddd352888f0c5c014f44fc938d56e366cc Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 24 Oct 2022 15:05:41 +0200
Subject: [PATCH] Update windows_dll_side_loading_in_calc.yml

---
 detections/endpoint/windows_dll_side_loading_in_calc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml
index f0121fc557..6b22476513 100644
--- a/detections/endpoint/windows_dll_side_loading_in_calc.yml
+++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml
@@ -35,7 +35,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: a dll modules is loaded in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$
+  message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$
   mitre_attack_id:
   - T1574.002
   - T1574