Update sysmon_dllhost_net_connections.yml
Fix @
This commit is contained in:
@@ -4,7 +4,7 @@ status: experimental
|
||||
description: Detects Dllhost that communicates with public IP addresses
|
||||
references:
|
||||
- https://github.com/Neo23x0/sigma/blob/master/rules/windows/network_connection/sysmon_rundll32_net_connections.yml
|
||||
author: @bartblaze
|
||||
author: bartblaze
|
||||
date: 2020/07/13
|
||||
tags:
|
||||
- attack.defense_evasion
|
||||
@@ -40,4 +40,4 @@ detection:
|
||||
condition: selection and not filter
|
||||
falsepositives:
|
||||
- Communication to other corporate systems that use IP addresses from public address spaces
|
||||
level: medium
|
||||
level: medium
|
||||
|
||||
Reference in New Issue
Block a user