From 1a3162a22cc283a95f3e23ea0c57ac064e989c8e Mon Sep 17 00:00:00 2001
From: nasbench <8741929+nasbench@users.noreply.github.com>
Date: Tue, 28 Jul 2026 20:35:19 +0200
Subject: [PATCH] small fixes

---
 detections/endpoint/common_ransomware_extensions.yml            | 2 +-
 .../windows_file_without_extension_in_critical_folder.yml       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml
index 495dfc0599..8f922873d4 100644
--- a/detections/endpoint/common_ransomware_extensions.yml
+++ b/detections/endpoint/common_ransomware_extensions.yml
@@ -45,7 +45,7 @@ search: |
         "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx",
         "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb",
         "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps",
-        "*.yaml", "*.yml", "*.zip"
+        "*.yaml", "*.yml"
     )
     BY Filesystem.action Filesystem.dest
         Filesystem.file_access_time Filesystem.file_create_time
diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
index d6efe846e6..0283a3a04e 100644
--- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
+++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
@@ -7,7 +7,7 @@ author: Teoderick Contreras, Bhavin Patel, Splunk
 status: production
 type: Anomaly
 description: |-
-    This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths.
+    This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, and other known Windows driver storage and loading paths.
     The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis.
     File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware.
     This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads.