fix: rule

2024-11-07 09:48:58 +00:00 · 2021-02-24 13:44:13 +01:00 · 2021-02-24 13:44:13 +01:00 · 0489d4bfa4
commit 0489d4bfa4
parent 9eb55016bf
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/builtin/win_net_ntlm_downgrade.yml
+++ b/rules/windows/builtin/win_net_ntlm_downgrade.yml
@ -18,14 +18,14 @@ logsource:
    service: security
    definition: 'Requirements: Audit Policy : Object Access > Audit Registry (Success)'
 detection:
-    selection2:
+    selection:
        EventID: 4657
        ObjectName: '\REGISTRY\MACHINE\SYSTEM\\*ControlSet*\Control\Lsa*'
        ObjectValueName: 
            - 'LmCompatibilityLevel'
            - 'NtlmMinClientSec'
            - 'RestrictSendingNTLMTraffic'
-    condition: 1 of them
+    condition: selection
 falsepositives:
    - Unknown
 level: critical