Merge pull request #3474 from SigmaHQ/aurora-false-positive-fixing

fix: schtasks in suspicious parents rule
2022-09-08 09:09:26 +02:00
parent 6813043323 de68bf5559
commit 358e8a567e
1 changed files with 2 additions and 2 deletions
@@ -7,7 +7,7 @@ references:
   - https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b
 author: Florian Roth
 date: 2022/03/21
-modified: 2022/07/08
+modified: 2022/09/08
 logsource:
   category: process_creation
   product: windows
@@ -21,7 +21,7 @@ detection:
      ParentImage|endswith:
         - '\csrss.exe'
         - '\certutil.exe'
-         - '\schtasks.exe'
+         # - '\schtasks.exe'
         - '\eventvwr.exe'
         - '\calc.exe'
         - '\notepad.exe'