fix: FP with visio.exe

phantinuss · Aug 28, 2023 · c560d45 · c560d45
1 parent 188236a
commit c560d45
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml b/rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml
@@ -7,7 +7,7 @@ references:
     - https://vanmieghem.io/stealth-outlook-persistence/
 author: Bhabesh Raj
 date: 2021/01/10
-modified: 2023/08/17
+modified: 2023/08/28
 tags:
     - attack.t1137.006
     - attack.persistence
@@ -33,6 +33,7 @@ detection:
             - '\integrator.exe'
             - '\OfficeClickToRun.exe'
             - '\winword.exe'
+            - '\visio.exe'
     filter_teams:
         Image|endswith: '\Teams.exe'
     filter_avg: