rule: SID to AD object rule level adjusted

2024-11-08 02:08:54 +00:00 · 2019-11-09 12:49:54 +01:00 · 2019-11-09 12:49:54 +01:00 · 9835950f04
commit 9835950f04
parent be62fad5cc
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/builtin/win_susp_add_sid_history.yml
+++ b/rules/windows/builtin/win_susp_add_sid_history.yml
@ -25,4 +25,4 @@ detection:
    condition: selection1 or (selection2 and not selection3)
 falsepositives:
    - Migration of an account into a new domain
-level: medium
+level: low