diff --git a/yara/gen_susp_office_dropper.yar b/yara/gen_susp_office_dropper.yar index 778b6a7..904f3f7 100644 --- a/yara/gen_susp_office_dropper.yar +++ b/yara/gen_susp_office_dropper.yar @@ -77,7 +77,7 @@ rule SUSP_OfficeDoc_VBA_Base64Decode { rule SUSP_VBA_FileSystem_Access { meta: - description = "Detects suspciius VBA that writes to disk and is activated on document open" + description = "Detects suspicious VBA that writes to disk and is activated on document open" author = "Florian Roth" reference = "Internal Research" date = "2019-06-21" diff --git a/yara/gen_suspicious_strings.yar b/yara/gen_suspicious_strings.yar index 6fc2dcc..23dc3dc 100644 --- a/yara/gen_suspicious_strings.yar +++ b/yara/gen_suspicious_strings.yar @@ -321,7 +321,7 @@ rule SUSP_XMRIG_Reference { rule SUSP_Just_EICAR { meta: - description = "Just an EICAR test file - this is boring stuff" + description = "Just an EICAR test file - this is boring but users asked for it" author = "Florian Roth" reference = "http://2016.eicar.org/85-0-Download.html" date = "2019-03-24"