Update rules/windows/process_creation/proc_creation_win_susp_eventlog…

…_content_recon.yml
SigmaHQ · Nov 20, 2023 · 544c220 · 544c220
1 parent 89b79c5
commit 544c220
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml b/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml
@@ -5,7 +5,7 @@ related:
       type: derived
 status: experimental
 description: |
-    Detects execution of different log query utilities to search dump the content of specific event logs or look for specific event IDs.
+    Detects execution of different log query utilities to search and dump the content of specific event logs or look for specific event IDs.
 references:
     - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
     - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/