Update web_cve_2021_22893_pulse_secure_rce_exploit.yml

2024-11-07 01:45:21 +00:00 · 2021-06-29 14:17:27 +07:00 · 2021-06-29 14:17:27 +07:00 · 67f483e6a9
commit 67f483e6a9
parent c446c519cf
1 changed files with 1 additions and 2 deletions
--- a/rules/web/web_cve_2021_22893_pulse_secure_rce_exploit.yml
+++ b/rules/web/web_cve_2021_22893_pulse_secure_rce_exploit.yml
@ -30,8 +30,7 @@ detection:
            - 'metric'
        sc-status:
            - '200'
-    condition: selection1 and selection2 | count(sc-status) by src_ip > 3
-    timeframe: 30m
+    condition: selection1 and selection2
 ---
 logsource:
    product: PulseSecure