From 74ea79b41903c44c9245d6fb98bfdb243be3cecd Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 11 Jul 2022 11:55:12 +0200
Subject: [PATCH] Update windows_powershell_import_applocker_policy.yml

---
 .../endpoint/windows_powershell_import_applocker_policy.yml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml
index c64491aeb1..ba99852e2a 100644
--- a/detections/endpoint/windows_powershell_import_applocker_policy.yml
+++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic is to identify a process that importing applocker xml rule using powershell commandlet.
+description: The following analytic is to identify a process that imports applocker xml rules using powershell commandlet.
   This technique was seen in Azorult malware where it drop an xml applocker rules that will deny several AV product and then executed using powershell aplocker 
   commandlet. This event is really suspicious and need to be check that may lead for further IOC that tries to evade detections, persistence or even 
   privilege escalation.