From d628b7e8700b29fae651338573dea5a67dcfb35b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 14 Jul 2021 15:04:06 -0400 Subject: [PATCH] minor fix 2 --- detections/endpoint/suspicious_rundll32_rename.yml | 2 +- .../suspicious_searchprotocolhost_no_command_line_arguments.yml | 2 +- .../endpoint/unified_messaging_service_spawning_a_process.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index ec8dfcc08a..9a1c7a04c3 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -65,7 +65,7 @@ tags: context: - Source: Endpoint - Stage: Initial Access, Execution, Defense Evasion - message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user + message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index 244dd84d72..cd741a39fe 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -57,7 +57,7 @@ tags: context: - Source: Endpoint - Stage: Initial Access, Execution, Defense Evasion - message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user + message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index 4ebcc27913..db73de3a45 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -64,7 +64,7 @@ tags: - Stage: Initial Access, Execution message: Possible CVE-2021-26857 exploitation on $dest$ observable: - - name: $dest + - name: dest type: Endpoint role: - Victim \ No newline at end of file