From 249c784dafbc10868f6e7ec7ab65896bc8a39b59 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 4 Jan 2022 08:38:05 -0800 Subject: [PATCH] Small Text Updates Small Text Updates to "Loading Of Dynwrapx Module" --- detections/endpoint/loading_of_dynwrapx_module.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index ca33e90a76..b45944aed5 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed - and registered. With that, registering or loading dynwrapx.dll to a is host highly + and registered. With that, registering or loading dynwrapx.dll to a host highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious