From b8c4992f82eb021b4fb7eab7766e50c34e30438f Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 29 Apr 2021 13:51:45 -0700 Subject: [PATCH] fix text --- detections/endpoint/office_product_spawning_bitsadmin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index 792beb1e47..4b2a3bbc16 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -10,7 +10,7 @@ description: The following detection identifies the latest behavior utilized by malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line - arguments as `/transfer /Download /priority Foreground`. In addition, Threat Research + arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts