admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update office_product_spawn_cmd_process.yml

Browse Source
This commit is contained in:
tccontre
2022-11-11 15:19:20 +01:00
committed by GitHub
parent d7830ab523
commit f05df4e446
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_product_spawn_cmd_process.yml
+2
View File
@@ -28,11 +28,13 @@ known_false_positives: IT or network admin may create an document automation tha
references:
- https://twitter.com/cyb3rops/status/1416050325870587910?s=21
- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
tags:
analytic_story:
- Trickbot
- DarkCrystal RAT
- Azorult
- Remcos
confidence: 80
context:
- Source:Endpoint