valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

rule: reduced level of rule to medium due to FPs

Browse Source
This commit is contained in:
Florian Roth 2019-11-09 23:24:31 +01:00
parent faeccf0c3d
commit fbe138ed90
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rules/windows/sysmon/sysmon_susp_file_characteristics.yml
View File

@ -6,6 +6,7 @@ references:
- https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
author: Markus Neis
date: 2018/11/22
modified: 2019/11/09
tags:
- attack.defense_evasion
- attack.execution
@ -29,4 +30,4 @@ fields:
- ParentCommandLine
falsepositives:
- Unknown
level: high
level: medium