From 346e7000e27bdaef610c8e2ea34021ee8b3f2285 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 26 Aug 2022 15:39:48 +0200 Subject: [PATCH] fix-desc --- .../endpoint/rundll32_create_remote_thread_to_a_process.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 40862aa624..b6273c5ab3 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -7,9 +7,9 @@ type: TTP datamodel: - Endpoint description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe - process to cmd.exe process. This technique was seen in IcedID malware to execute + to any process. This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive - information the the compromised host. browser process. + information in the compromised host. search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)`