From d749860e46b160131d825a7a675c92a07bf103fe Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 24 Oct 2022 15:05:19 +0200 Subject: [PATCH 1/2] Update windows_dll_side_loading_in_calc.yml --- detections/endpoint/windows_dll_side_loading_in_calc.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml index 16d59c55a5..f0121fc557 100644 --- a/detections/endpoint/windows_dll_side_loading_in_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml @@ -35,7 +35,7 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: + message: a dll modules is loaded in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$ mitre_attack_id: - T1574.002 - T1574 @@ -61,4 +61,4 @@ tags: - ProcessId risk_score: 90 security_domain: endpoint - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint From 22cb51ddd352888f0c5c014f44fc938d56e366cc Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 24 Oct 2022 15:05:41 +0200 Subject: [PATCH 2/2] Update windows_dll_side_loading_in_calc.yml --- detections/endpoint/windows_dll_side_loading_in_calc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml index f0121fc557..6b22476513 100644 --- a/detections/endpoint/windows_dll_side_loading_in_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml @@ -35,7 +35,7 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: a dll modules is loaded in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$ + message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$ mitre_attack_id: - T1574.002 - T1574