Specified source to prevent EventID collisions

Issue #263
2024-11-06 17:35:19 +00:00 · 2019-04-01 23:45:55 +02:00 · 2019-04-01 23:45:55 +02:00 · 8e854b06f6
commit 8e854b06f6
parent 0419ff215a
1 changed files with 1 additions and 0 deletions
--- a/rules/windows/builtin/win_susp_eventlog_cleared.yml
+++ b/rules/windows/builtin/win_susp_eventlog_cleared.yml
@ -13,6 +13,7 @@ logsource:
 detection:
    selection:
        EventID: 104
+        Source: Microsoft-Windows-Eventlog
    condition: selection
 falsepositives:
    - Unknown