Removed redundant attribute from rule

EventID 4657 already implies the modification.
2024-11-07 09:48:58 +00:00 · 2018-06-02 22:37:26 +02:00 · 2018-06-02 22:37:26 +02:00 · df6ad82770
commit df6ad82770
parent e72c0d5de4
1 changed files with 0 additions and 1 deletions
--- a/rules/windows/builtin/win_net_ntlm_downgrade.yml
+++ b/rules/windows/builtin/win_net_ntlm_downgrade.yml
@ -32,7 +32,6 @@ logsource:
 detection:
    selection2:
        EventID: 4657
-        OperationType: 'Existing registry value modified'
        ObjectName: '\REGISTRY\MACHINE\SYSTEM\*ControlSet*\Control\Lsa'
        ObjectValueName: 
            - 'LmCompatibilityLevel'