chore: update casing

swachchhanda000 · Jan 26, 2024 · 7e39481 · 7e39481
1 parent 0476f18
commit 7e39481
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml b/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml
@@ -24,8 +24,8 @@ detection:
     selection_parent:
         - GrandParentImage|endswith: '\rundll32.exe'
         - ParentImage|endswith:
-              - '\SearchProtocolHost.exe'
               - '\SearchFilterHost.exe'
+              - '\SearchProtocolHost.exe'
     selection_child:
         CommandLine:
             # Note: Only add strings as seen used by Pikabot to avoid collision with other strains of malware

diff --git a/...ing-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml b/...ing-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml
@@ -23,8 +23,8 @@ detection:
         ParentImage|endswith: '\rundll32.exe'
         Image|endswith:
             # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
-            - '\searchfilterhost.exe'
-            - '\searchprotocolhost.exe'
+            - '\SearchFilterHost.exe'
+            - '\SearchProtocolHost.exe'
             - '\sndvol.exe'
             - '\wermgr.exe'
             - '\wwahost.exe'