Skip to content

Commit 377efcc

Browse files
committed
updating name
1 parent e7e5dcb commit 377efcc

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

detections/endpoint/windows_process_injection_into_commonly_abused_process.yml renamed to detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Windows Process Injection into Commonly Abused Process
1+
name: Windows Process Injection into Commonly Abused Processes
22
id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75
33
version: 1
44
date: '2025-03-19'
@@ -21,7 +21,7 @@ search: '`sysmon` EventCode=10 TargetImage IN ("*\\notepad.exe", "*\\wordpad.exe
2121
| `security_content_ctime(firstTime)`
2222
| `security_content_ctime(lastTime)`
2323
| table firstTime lastTime dest user SourceImage TargetImage GrantedAccess CallTrace count
24-
| `windows_process_injection_into_commonly_abused_process_filter`'
24+
| `windows_process_injection_into_commonly_abused_processes_filter`'
2525
how_to_implement: To successfully implement this search, you need to be ingesting
2626
logs with the process name, parent process, and command-line executions from your
2727
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

0 commit comments

Comments
 (0)