Update net_connection_win_malware_pikabot_rundll32_activity.yml

swachchhanda000 · Jan 26, 2024 · 0476f18 · 0476f18
1 parent f1a9cfc
commit 0476f18
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/...ing-threats/2023/Malware/Pikabot/net_connection_win_malware_pikabot_rundll32_activity.yml b/...ing-threats/2023/Malware/Pikabot/net_connection_win_malware_pikabot_rundll32_activity.yml
@@ -24,8 +24,8 @@ detection:
         ParentImage|endswith: '\rundll32.exe'
         Image|endswith:
             # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
-            - '\searchfilterhost.exe'
-            - '\searchprotocolhost.exe'
+            - '\SearchFilterHost.exe'
+            - '\SearchProtocolHost.exe'
             - '\sndvol.exe'
             - '\wermgr.exe'
             - '\wwahost.exe'