diff --git a/detections/endpoint/windows_theme_command_execution.yml b/detections/endpoint/windows_theme_command_execution.yml index 663ecd7964..0a48491e51 100644 --- a/detections/endpoint/windows_theme_command_execution.yml +++ b/detections/endpoint/windows_theme_command_execution.yml @@ -7,7 +7,7 @@ status: experimental type: TTP description: 'The vulnerability, referred to as "ThemeBleed", is a high-severity issue with a score of 8.8. It allows remote attackers to execute code if the target user opens a malicious .THEME file crafted by the attacker. The exploit takes advantage of a race condition when handling .MSSTYLES files. Specifically, when a version number "999" is used, there's a discrepancy between the time a DLL’s (“_vrf.dll”) signature is verified and when the library loads. -This allows an attacker to replace a verified DLL with a malicious one, leading to arbitrary code execution.'' +This allows an attacker to replace a verified DLL with a malicious one, leading to arbitrary code execution.' data_source: - Sysmon search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)