fix: typos

phantinuss · Jan 23, 2024 · f6cb5a5 · f6cb5a5
1 parent 2ed3c3c
commit f6cb5a5
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml b/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml
@@ -63,5 +63,5 @@ detection:
             - '\wscript.exe'
     condition: selection
 falsepositives:
-    - This rule is best put in testing first in order to crate a baseline that reflect the data in your environment.
+    - This rule is best put in testing first in order to create a baseline that reflects the data in your environment.
 level: high
diff --git a/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml b/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml
@@ -78,5 +78,5 @@ detection:
         TargetImage|endswith: ':\Windows\System32\csrss.exe'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
-    - This rule is best put in testing first in order to crate a baseline that reflect the data in your environment.
+    - This rule is best put in testing first in order to create a baseline that reflects the data in your environment.
 level: medium
diff --git a/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml b/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml
@@ -7,7 +7,7 @@ related:
       type: obsoletes
 status: experimental
 description: |
-    Detects loading of essential DLLs used by PowerShell by non powershell process.
+    Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
     Detects behavior similar to meterpreter's "load powershell" extension.
 references:
     - https://adsecurity.org/?p=2921