"NOBELIUM - suspicious rundll32.exe execution of vbscript (Normalized Process Events)"

[DGOV-Bryce]

• The KQL should have "search" not "Search".
• The recommendations that involve steps to take should be suggestions, not directives (Otherwise if our directions are exhaustive, we may have missed something, which they then may not think is needed), such as: "Follow Standard Operating Procedures for dealing with X, these may include steps such as:
• Blah
• Blah
• Blah"

[DininduSWick]

Updated tasks 2 and 3.