security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update win_susp_multiple_files_renamed_or_deleted.yml

Browse Source
This commit is contained in:
Vasiliy Burov
2020-10-29 23:38:22 +03:00
committed by GitHub
parent 683824ee46
commit ab60fdcef4
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/file_event/win_susp_multiple_files_renamed_or_deleted.yml
+2 -2
View File
@@ -22,6 +22,6 @@ detection:
timeframe: 30s
condition: selection | count() by SubjectLogonId > 10
falsepositives:
- software uninstallation
- files restore activities
- Software uninstallation
- Files restore activities
level: high