From 38fc323b98bd7bb57f5e4d31d3fdcb6d8e03b151 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 2 Mar 2023 08:19:01 -0700
Subject: [PATCH] Update suspicious_rundll32_dllregisterserver.yml

---
 .../suspicious_rundll32_dllregisterserver.yml | 22 +++++++++++++------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index c8be5358d0..ceace0ff05 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -52,7 +52,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: $Processes.process_path.file_path$ process potentially loading malicious
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL.
     code
   mitre_attack_id:
   - T1218
@@ -61,14 +61,22 @@ tags:
   - PR.PT
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -89,4 +97,4 @@ tags:
   risk_score: 35
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon
\ No newline at end of file