security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #747 from zaphodef/fix/win_susp_backup_delete_source

Browse Source 
Fix 'source' value for win_susp_backup_delete
This commit is contained in:
Florian Roth
2020-05-25 10:48:36 +02:00
committed by GitHub
parent 0afe0623af d510e1aad4
commit a962bd1bc1
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/builtin/win_susp_backup_delete.yml
+1 -1
View File
@@ -16,7 +16,7 @@ logsource:
detection:
selection:
EventID: 524
Source: Backup
Source: Microsoft-Windows-Backup
condition: selection
falsepositives:
- Unknown