diff --git a/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml b/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml index 43339167966..582635c8a8f 100644 --- a/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml +++ b/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml @@ -11,7 +11,7 @@ references: - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/ author: Gavin Knapp date: 2023-05-01 -modified: 2024-07-16 +modified: 2025-02-22 tags: - attack.command-and-control - attack.t1102 @@ -70,7 +70,7 @@ detection: Image|endswith: '\whale.exe' filter_optional_googleupdate: Image|endswith: '\GoogleUpdate.exe' - filter_optional_outlook.exe: + filter_optional_outlook_exe: Image|endswith: '\outlook.exe' filter_main_null: Image: null