valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update sysmon_disabled_pua_protection_on_microsoft_defender.yml

Browse Source
This commit is contained in:
Austin Songer 2021-08-04 13:11:31 -05:00 committed by GitHub
parent bae075713c
commit 8d195bf5d5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/registry_event/sysmon_disabled_pua_protection_on_microsoft_defender.yml
View File

@ -14,7 +14,7 @@ logsource:
detection:
selection:
EventType: SetValue
TargetObject|contains: 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\PUAProtection'
TargetObject|contains: 'HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\PUAProtection'
Details: 'DWORD (0x00000000)'
condition: selection
falsepositives: