From 6f7aecbe069fa8dbe7eb65a27d6cc570a2cbf1d1 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Mon, 3 Aug 2020 13:49:52 +0200
Subject: [PATCH] fix: preventive change to avoid FPs

---
 rules/web/win_webshell_regeorg.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rules/web/win_webshell_regeorg.yml b/rules/web/win_webshell_regeorg.yml
index a5ab1af05..c823666cb 100644
--- a/rules/web/win_webshell_regeorg.yml
+++ b/rules/web/win_webshell_regeorg.yml
@@ -21,7 +21,6 @@ detection:
             - '*connect&target*'
             - '*cmd=connect*'
             - '*cmd=disconnect*'
-            - '*&port*'
             - '*cmd=forward*'
     filter:
         referer: null