Skip to content

Commit d112f35

Browse files
authored
Update proc_creation_win_regsvcs_suspicious_calltrace.yml
1 parent fe80073 commit d112f35

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

rules/windows/process_creation/proc_creation_win_regsvcs_suspicious_calltrace.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: Detects potential shellcode injection into RegSvcs.exe based on sus
55
references:
66
- https://osintteam.blog/opened-a-can-of-xworms-33fde9d2aee6
77
author: Kelvin "grepStrength" Winborne
8-
date: 2025/10/15
8+
date: 2025-10-15
99
tags:
1010
- attack.execution
1111
- attack.t1055
@@ -30,3 +30,4 @@ fields:
3030
falsepositives:
3131
- Known .NET assembly registration
3232
level: high
33+

0 commit comments

Comments
 (0)