diff --git a/rules/windows/builtin/win_susp_logon_explicit_credentials.yml b/rules/windows/builtin/win_susp_logon_explicit_credentials.yml index e947b6ae9..595a57420 100644 --- a/rules/windows/builtin/win_susp_logon_explicit_credentials.yml +++ b/rules/windows/builtin/win_susp_logon_explicit_credentials.yml @@ -13,7 +13,6 @@ tags: logsource: product: windows service: security - definition: detection: selection: EventID: 4648 diff --git a/rules/windows/other/win_lateral_movement_condrv.yml b/rules/windows/other/win_lateral_movement_condrv.yml index 796b506fa..6bade50ac 100644 --- a/rules/windows/other/win_lateral_movement_condrv.yml +++ b/rules/windows/other/win_lateral_movement_condrv.yml @@ -15,7 +15,6 @@ tags: logsource: product: windows service: security - definition: detection: selection: EventID: 4674 diff --git a/tests/test_rules.py b/tests/test_rules.py index b715e20ec..370e944b4 100755 --- a/tests/test_rules.py +++ b/tests/test_rules.py @@ -613,6 +613,9 @@ class TestRules(unittest.TestCase): if key.lower() not in valid_logsource: print(Fore.RED + "Rule {} has a logsource with an invalid field ({})".format(file, key)) valid = False + elif not isinstance(logsource[key],str): + print(Fore.RED + "Rule {} has a logsource with an invalid field type ({})".format(file, key)) + valid = False if not valid: faulty_rules.append(file)