From de34ea116fac5834bdf32fed450d28a9a3c9dcf2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 29 Sep 2022 13:09:04 -0700 Subject: [PATCH] Update detect_dga_domains_using_pretrained_model_in_dsdl.yml --- .../detect_dga_domains_using_pretrained_model_in_dsdl.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/experimental/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml b/detections/experimental/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml index 96a156c0b1..440f3d94fc 100644 --- a/detections/experimental/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml +++ b/detections/experimental/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml @@ -32,7 +32,7 @@ tags: - Suspicious DNS Traffic - Dynamic DNS - Command and Control - asset_type: Web Server + asset_type: Endpoint cis20: - CIS 8 - CIS 12 @@ -44,7 +44,7 @@ tags: impact: 70 kill_chain_phases: - Command & Control - message: A potentially a DGA domain $domain$ was detected from host $src$, kindly review. + message: A potential connection to a DGA domain $domain$ was detected from host $src$, kindly review. mitre_attack_id: - T1568.002 nist: @@ -54,7 +54,7 @@ tags: - DE.CM observable: - name: domain - type: Other + type: URL Domain role: - Attacker - name: src