diff --git a/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml b/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml index 995ce7f2d5f..34b6b4e6773 100644 --- a/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml +++ b/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml @@ -40,7 +40,7 @@ process where event.type in ("start", "process_started") and framework = "MITRE ATT&CK" [[rule.threat.technique]] id = "T1218" -name = "Signed Binary Proxy Execution" +name = "System Binary Proxy Execution" reference = "https://attack.mitre.org/techniques/T1218/"