security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix: condition section

Browse Source
This commit is contained in:
Florian Roth
2022-02-23 23:28:53 +01:00
parent 22fbf5bb0a
commit 1682bdb8a8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_schtasks_pattern.yml
+1 -1
View File
@@ -39,7 +39,7 @@ detection:
- CommandLine|contains|all:
- 'wscript.exe'
- '\AppData\'
condition: selection_schtasks and ( selection_rare and selection_pattern or 1 of selection_anomaly )
condition: selection_schtasks and ( selection_rare and selection_pattern or selection_anomaly )
falsepositives:
- Software installers that run from temporary folders and also install scheduled tasks
level: high