Skip to content

Commit fd53a21

Browse files
authored
Fix Broken RBA Message (#3984)
1 parent 39849c0 commit fd53a21

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

detections/endpoint/windows_rundll32_with_non_standard_file_extension.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ drilldown_searches:
115115
earliest_offset: $info_min_time$
116116
latest_offset: $info_max_time$
117117
rba:
118-
message: An instance of [$parent_process_path] launched [$process_name$] loading a non-standard DLL extension [$process$] in host [$dest$]
118+
message: An instance of [$parent_process_path$] launched [$process_name$] loading a non-standard DLL extension [$process$] in host [$dest$]
119119
risk_objects:
120120
- field: dest
121121
type: system

0 commit comments

Comments
 (0)