diff --git a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml index 6cb6b4dfd..6288cf717 100644 --- a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml +++ b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml @@ -32,7 +32,6 @@ detection: filter: CommandLine|contains|all: - ' route ADD ' - condition: selection1 and selection2 and selection3 and not filter fields: - ParentImage