Update proc_creation_win_susp_clsid_foldername.yml

2022-09-02 17:36:10 +02:00
parent da6ca9ece7
commit 168df94b73
1 changed files with 1 additions and 1 deletions
@@ -30,7 +30,7 @@ detection:
    condition: all of selection_* and not filter
 falsepositives:
    - Some FP is expected with some installers
-level: high
+level: medium
 tags:
    - attack.defense_evasion
    - attack.t1027