Edit ThemeBleed

detections/endpoint/windows_theme_command_execution.yml

@@ -11,7 +11,7 @@ description: The vulnerability, referred to as ThemeBleed, is a high-severity is
   there is a discrepancy between the time a _vrf.dll signature is verified and when the library loads.
   This allows an attacker to replace a verified DLL with a malicious one, leading to arbitrary code execution.
 data_source:
-- Sysmon
+- Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where 
   (Processes.process="C:\\Windows\\system32\\rundll32.exe*themecpl.dll,OpenThemeAction*theme") OR (Processes.process="*rundll32.exe uxtheme.dll,#64 *.msstyles*") by Processes.dest Processes.user Processes.parent_process
@@ -70,7 +70,6 @@ tags:
   - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
   - Processes.process_name
   - Processes.parent_process
   - Processes.process_id