Modified Rule

Removed :
unnecessary event ID

rules/windows/process_creation/Monitor_Office_Application_from_proxy executing_regsvr32_with_payload.yml

@@ -11,37 +11,33 @@ tags:
     - attack.execution
     - attack.defence_evasion
 status: experimental
-Date: 2021/23/8
+Date: 2021/08/23
 logsource:
   product: Windows
-  service: security
   category: process_creation
 detection:
   #useful_information: add more LOLBins to the rules logic of your choice.
   selection1:
-    EventLog: security
-    EventID: 4688
-  selection2:
     ProcessCommandLine:
       - '*regsvr32*'
       - '*rundll32*'
       - '*msiexec*'
       - '*mshta*'
       - '*verclsid*'
-  selection3:
-    - ProcessName: '*\wbem\WMIC.exe'
+  selection2:
+    - Image: '*\wbem\WMIC.exe'
     - ProcessCommandLine: '*wmic *'
-  selection4:
-    ParentProcessName|endswith:
+  selection3:
+    ParentImage|endswith:
     - winword.exe
     - excel.exe
     - powerpnt.exe
-  selection5:
+  selection4:
     processCommandLine|contains|all: 
       - 'process'
       - 'create'
       - 'call' 
-  condition: selection1 AND selection2 AND selection3 AND selection4 AND selection5
+  condition: selection1 AND selection2 AND selection3 AND selection4
 falsepositives:
 - Unknown
 level: high