Convert to process_creation

rkondracki · Jun 4, 2020 · bafd6bd · bafd6bd
1 parent 09afae1
commit bafd6bd
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/rules/windows/sysmon/sysmon_apt_muddywater_dnstunnel.yml b/rules/windows/sysmon/sysmon_apt_muddywater_dnstunnel.yml
@@ -1,4 +1,4 @@
-title: "Muddywater DNS tunnel method detection"
+title: "Muddywater DNS tunnel detection"
 description: "Detecting DNS tunnel activity from Muddywater"
 author: Furkan Caliskan
 status: "testing"
@@ -9,8 +9,8 @@ tags:
 - attack.command_and_control
 - attack.t1071
 logsource:
-  product: "windows"
-  service: "sysmon"
+  category: process_creation
+  product: windows
 detection:
   selection:
     EventID: 1