From 2dab2d420c8f901de48ff1ee82f8537f75df73e5 Mon Sep 17 00:00:00 2001 From: Semanur Guneysu Date: Mon, 26 Oct 2020 15:24:00 +0300 Subject: [PATCH] Update sysmon_abusing_debug_privilege.yml --- .../windows/process_creation/sysmon_abusing_debug_privilege.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml index 6cb6b4dfd..6288cf717 100644 --- a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml +++ b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml @@ -32,7 +32,6 @@ detection: filter: CommandLine|contains|all: - ' route ADD ' - condition: selection1 and selection2 and selection3 and not filter fields: - ParentImage