fix: duplicate 'tag' key in rule

2024-11-07 01:45:21 +00:00 · 2018-09-04 16:05:21 +02:00 · 2018-09-04 16:05:21 +02:00 · 9c878bef79
commit 9c878bef79
parent d94c1d2046
1 changed files with 0 additions and 3 deletions
--- a/rules/windows/builtin/win_susp_net_recon_activity.yml
+++ b/rules/windows/builtin/win_susp_net_recon_activity.yml
@ -1,9 +1,6 @@
 title: Reconnaissance Activity
 status: experimental
 description: 'Detects activity as "net user administrator /domain" and "net group domain admins /domain"'
-tags:
-    - attack.discovery
-    - attack.t1087
 references:
    - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
 author: Florian Roth (rule), Jack Croock (method)