Added DFIR Report references

SigmaHQ · Jan 27, 2025 · aecd8f3 · aecd8f3
1 parent ff5d48b
commit aecd8f3
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/rules/windows/file/file_event/file_event_win_public_folder_payloads.yml b/rules/windows/file/file_event/file_event_win_public_folder_payloads.yml
@@ -3,9 +3,9 @@ id: b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e
 status: experimental
 description: Detects payloads dropped in public folders, which could indicate malicious activity.
 references:
-  - https://intel.thedfirreport.com/events/view/30032
-  - https://intel.thedfirreport.com/eventReports/view/70
-  - https://thedfirreport.com/2025/...TBD
+  - https://intel.thedfirreport.com/events/view/30032 (Private Report)
+  - https://intel.thedfirreport.com/eventReports/view/70 (Private Report)
+  - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
 author: 'The DFIR Report'
 date: 2025-01-23
 tags: