From 91c83bbe09285cfc51c9ea2f0fcdba5865d5807d Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Sat, 27 Nov 2021 15:20:37 +0100 Subject: [PATCH] docs: changed wording in rule descriptions --- ...levated_msi_spawned_cmd_and_powershell_spawned_processes.yml | 2 +- ...n_always_install_elevated_msi_spawned_cmd_and_powershell.yml | 2 +- .../sysmon_always_install_elevated_windows_installer.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/rules-unsupported/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml b/rules-unsupported/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml index 0fe996cd378..2a8e7c0735b 100644 --- a/rules-unsupported/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml +++ b/rules-unsupported/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml @@ -1,6 +1,6 @@ title: MSI Spawned Cmd and Powershell Spawned Processes id: 38cf8340-461b-4857-bf99-23a41f772b18 -description: This rule will looks for Windows Installer service (msiexec.exe) spawned command line and/or powershell that spawned other processes +description: This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell that spawns other processes status: unsupported author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020/10/13 diff --git a/rules/windows/process_creation/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell.yml b/rules/windows/process_creation/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell.yml index 73a21e2954b..45132f02cc2 100644 --- a/rules/windows/process_creation/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell.yml +++ b/rules/windows/process_creation/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell.yml @@ -1,6 +1,6 @@ title: Always Install Elevated MSI Spawned Cmd And Powershell id: 1e53dd56-8d83-4eb4-a43e-b790a05510aa -description: This rule will looks for Windows Installer service (msiexec.exe) spawned command line and/or powershell +description: This rule looks for Windows Installer service (msiexec.exe) spawned command line and/or powershell status: experimental author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020/10/13 diff --git a/rules/windows/process_creation/sysmon_always_install_elevated_windows_installer.yml b/rules/windows/process_creation/sysmon_always_install_elevated_windows_installer.yml index 4aa3afd0316..fd04cd0ea53 100644 --- a/rules/windows/process_creation/sysmon_always_install_elevated_windows_installer.yml +++ b/rules/windows/process_creation/sysmon_always_install_elevated_windows_installer.yml @@ -1,6 +1,6 @@ title: Always Install Elevated Windows Installer id: cd951fdc-4b2f-47f5-ba99-a33bf61e3770 -description: This rule will looks for Windows Installer service (msiexec.exe) when it tries to install MSI packages with SYSTEM privilege +description: This rule looks for Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege status: experimental author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020/10/13