update: description

Author: swachchhanda000

rules-threat-hunting/windows/process_creation/proc_creation_win_html_phishing_attempt.yml

@@ -1,7 +1,10 @@
 title: Potential HTML Phishing Attachment Clicked
 id: 538c5851-8c03-4724-8ec4-623bc7aadaea
 status: experimental
-description: The rule is Created Based On Observed Phishing Campaigns Where a HTML Attachment Is Delivered To a User It Attempts To Catch Successful Clicks Or Opening Of The Attachment. 
+description: |
+    Detects potential HTML phishing attachment click. Threat actors often use HTML attachments in phishing campaigns to deliver malicious payloads or redirect users to harmful websites.
+    When a user clicks on the HTML attachment, it can lead to the execution of scripts or the download of malware, compromising the user's system.
+    During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.
 references:
     - https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
     - https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
@@ -17,16 +20,16 @@ logsource:
 detection:
     selection:
         Image|endswith:
-            - \msedge.exe
-            - \firefox.exe
-            - \chrome.exe
-            - \brave.exe
-            - \vivaldi.exe
-            - \opera.exe
+            - '\msedge.exe'
+            - '\firefox.exe'
+            - '\chrome.exe'
+            - '\brave.exe'
+            - '\vivaldi.exe'
+            - '\opera.exe'
         CommandLine|contains|all:
-            - :\users\
-            - .htm
+            - 'C:\users\'
+            - '.htm'
     condition: selection
 falsepositives:
-    -Opening of random HTML files via browsers.
+    - Opening of random HTML files via browsers.
 level: medium

rules-threat-hunting/windows/process_creation/proc_creation_win_potential_hex_staging_attack.yml

@@ -1,8 +1,10 @@
 title: Potential Hex Staging Attack
 id: 647c1b89-d717-4a0a-816b-2f129500f76f
 status: experimental
-description: This Rule Hex Staging Whereby a Threat Actor Delivers Malicious Executable Payload in Hexadecimal Chunks By Writing The Data To a Temporary File Using Cmd.exe.The /p Parameter Takes The Hexadecimal Payload as Input.
-The Encoded Payload Is Later Decoded Using Inbuilt Tools e.g certutil For Further Execution.
+description: |
+    Detects potential hex staging attack. Threat Actor often delivers malicious executable payload in hexadecimal chunks by writing the data to a temporary file using cmd.exe.
+    The /p parameter takes the hexadecimal payload as input. The encoded payload is later decoded using inbuilt tools e.g certutil for further execution.
+    During investigation, examine the temporary files created, analyze the hex content for malicious patterns, check for subsequent process executions (particularly certutil), and investigate the source of the command execution and the parent process.
 references:
     - https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities
 author: Joseph Kamau
@@ -16,11 +18,11 @@ logsource:
     category: process_creation
 detection:
     selection:
-        Image|endswith: \cmd.exe
+        Image|endswith: '\cmd.exe'
         CommandLine|contains|all:
-            - set
-            - /p=
-            - .tmp
+            - 'set'
+            - '/p='
+            - '.tmp'
     condition: selection
 falsepositives:
     - Legitimate Use Of The Listed Parameters To Encode Data.