diff --git a/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4624_Med_Logon-Type9-NewInteractive_SuspProc.yml b/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4624_Med_Logon-Type9-NewInteractive_SuspProc.yml index 08e6e69f0..6b40ce9b3 100644 --- a/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4624_Med_Logon-Type9-NewInteractive_SuspProc.yml +++ b/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4624_Med_Logon-Type9-NewInteractive_SuspProc.yml @@ -2,7 +2,7 @@ author: Zach Mathis date: 2022/04/18 modified: 2022/12/16 -title: NewInteractive Logon (Suspicous Process) +title: NewInteractive Logon (Suspicious Process) description: Tries to detect token impersonation by tools like Cobalt Strike. id: 9e8b6cdb-9991-488b-a7b3-2eec7aa64679 diff --git a/hayabusa/builtin/System/Sys_7045_High_ServiceInstalled_SuspiciousServiceName.yml b/hayabusa/builtin/System/Sys_7045_High_ServiceInstalled_SuspiciousServiceName.yml index f3bfe190f..7d06e2b74 100644 --- a/hayabusa/builtin/System/Sys_7045_High_ServiceInstalled_SuspiciousServiceName.yml +++ b/hayabusa/builtin/System/Sys_7045_High_ServiceInstalled_SuspiciousServiceName.yml @@ -2,7 +2,7 @@ author: Zach Mathis date: 2022/02/06 modified: 2024/10/01 -title: 'Suspicous Service Name' +title: 'Suspicious Service Name' details: 'Svc: %ServiceName% ¦ Path: %ImagePath% ¦ Acct: %AccountName% ¦ StartType: %StartType%' description: Tries to look for random-looking service names that are often used by malware for persistence.