Delete win_cmd_rar.yml

redundant with ./rules/windows/process_creation/win_data_compressed_with_rar.yml authorship was updated
2024-11-08 02:08:54 +00:00 · 2019-11-11 01:58:22 +03:00 · 2019-11-11 01:58:22 +03:00 · 521d9311c7
commit 521d9311c7
parent afb17d0e0e
1 changed files with 0 additions and 21 deletions
--- a/rules/windows/process_creation/win_cmd_rar.yml
+++ b/rules/windows/process_creation/win_cmd_rar.yml
@ -1,21 +0,0 @@
-title: Command-Line Creation of a RAR file
-description: Detect compression of data into a RAR file using the rar.exe utility.
-status: experimental
-author: E.M. Anhaus (orignally from Atomic Blue Detections, Endgame)
-date: 2019/10/24
-tags:
-    - attack.exfiltration
-    - attack.t1002
-detection:
-    selection:
-        Image:
-            - '*rar.exe'
-        CommandLine:
-            - '* a *'
-    condition: selection
-falsepositives:
-    - legit creation of a rar file using cmd
-level: high
-logsource:
-    category: process_creation
-    product: windows