From 4ded5e498f560e15c8dd5f87cb326c0f0e98ecd4 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Mon, 4 Apr 2022 12:22:09 +0200 Subject: [PATCH] Update registry_set_disable_system_restore.yml --- .../registry_set/registry_set_disable_system_restore.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rules/windows/registry_set/registry_set_disable_system_restore.yml b/rules/windows/registry_set/registry_set_disable_system_restore.yml index d5ab48b01..ba9829770 100644 --- a/rules/windows/registry_set/registry_set_disable_system_restore.yml +++ b/rules/windows/registry_set/registry_set_disable_system_restore.yml @@ -1,6 +1,6 @@ -title: Disable System Restore Through Registry +title: Registry Disable System Restore id: 5de03871-5d46-4539-a82d-3aa992a69a83 -description: Modify the registry to disable system restore on the computer +description: Detects the modification of the registry to disable a system restore on the computer author: frack113 date: 2022/04/04 status: experimental @@ -21,7 +21,7 @@ detection: condition: selection falsepositives: - Unknown -level: medium +level: high tags: - attack.impact - attack.t1490