Merge pull request #2813 from phantinuss/master

Changes to falsepositives metadata

rules-unsupported/driver_load_invoke_obfuscation_via_compress_services.yml

@@ -24,7 +24,7 @@ detection:
         ImagePath|endswitch: 'readtoend'
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: medium
 tags:
     - attack.defense_evasion

rules-unsupported/sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml

@@ -30,7 +30,7 @@ fields:
     - ParentImage
     - ParentOfParentImage
 falsepositives:
-    - Penetration test
+    - Unknown
 level: high
 enrichment:
     - EN_0001_cache_sysmon_event_id_1_info                # http://bit.ly/314zc6x

rules-unsupported/sysmon_always_install_elevated_parent_child_correlated.yml

@@ -1,12 +1,12 @@
 title: Always Install Elevated Parent Child Correlated
 id: 078235c5-6ec5-48e7-94b2-f8b5474379ea
-description: This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe) that tries to install MSI packages with SYSTEM privilege 
+description: This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe) that tries to install MSI packages with SYSTEM privilege
 #look for MSI start by low privilege user, write the process guid to the suspicious_guid variable
 #look for child process from the suspicious_guid, alert if it's Windows Installer trying to install package with SYSTEM privilege
 status: unsupported
 author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
 date: 2020/10/13
-references: 
+references:
     - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg
 tags:
     - attack.privilege_escalation
@@ -20,14 +20,14 @@ detection:
     system_user:
         User: 'NT AUTHORITY\SYSTEM'
     image_1:
-        Image|contains|all: 
+        Image|contains|all:
             - '\Windows\Installer\'
             - 'msi'
-        Image|endswith: 
+        Image|endswith:
             - 'tmp'
     image_2:
         Image|endswith: '\msiexec.exe'
-    child_of_suspicious_guid:  
+    child_of_suspicious_guid:
         ParentProcessGuid: '%suspicious_guid%'
     condition: write ProcessGuid from (event_id and image_2 and not system_user) to %suspicious_guid%; then if (child_of_suspicious_guid and event_id and image_1 and system_user) or (suspicious_guid and event_id and image_2 and system_user and integrity_level) -> alert
 fields:
@@ -38,5 +38,4 @@ fields:
     - ParentProcessGuid
 falsepositives:
     - System administrator usage
-    - Penetration test 
 level: high

rules-unsupported/sysmon_process_reimaging.yml

@@ -22,7 +22,7 @@ modified: 2021/12/02
 detection:
     condition: all of selection*
 falsepositives:
-    - unknown
+    - Unknown
 level: high
 ---
 logsource:

rules-unsupported/win_mal_service_installs.yml

@@ -33,6 +33,6 @@ detection:
         ServiceName: 'Java(TM) Virtual Machine Support Service'
     condition: selection and 1 of malsvc_*
 falsepositives:
-    - Penetration testing
+    - Unknown
 level: critical
 status: unsupported

rules/application/django/appframework_django_exceptions.yml

@@ -30,7 +30,6 @@ detection:
     condition: keywords
 falsepositives:
     - Application bugs
-    - Penetration testing
 level: medium
 tags:
     - attack.initial_access

rules/application/python/app_python_sql_exceptions.yml

@@ -19,7 +19,6 @@ detection:
     condition: exceptions
 falsepositives:
     - Application bugs
-    - Penetration testing
 level: medium
 tags:
     - attack.initial_access

rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml

@@ -30,5 +30,5 @@ detection:
           - 1
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml

@@ -27,5 +27,5 @@ detection:
         - 1
     condition: selection and not filter
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/application/rpc_firewall/rpc_firewall_eventlog_recon.yml

@@ -23,5 +23,5 @@ detection:
           - f6beaff7-1e19-4fbb-9f8f-b89e2018337c
     condition: selection
 falsepositives:
-    - remote administrative tasks on Windows Events
+    - Remote administrative tasks on Windows Events
 level: high

rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml

@@ -38,5 +38,5 @@ detection:
           - 15
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml

@@ -33,5 +33,5 @@ detection:
         - 15
     condition: selection and not filter
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml

@@ -30,5 +30,5 @@ detection:
           - ae33069b-a2a8-46ee-a235-ddfd339be281
     condition: selection
 falsepositives:
-    - actual printing
+    - Actual printing
 level: high

rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml

@@ -30,5 +30,5 @@ detection:
           - 1
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/application/rpc_firewall/rpc_firewall_sasec_recon.yml

@@ -26,5 +26,5 @@ detection:
         - 1
     condition: selection and not filter
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/application/ruby/appframework_ruby_on_rails_exceptions.yml

@@ -23,7 +23,6 @@ detection:
     condition: keywords
 falsepositives:
     - Application bugs
-    - Penetration testing
 level: medium
 tags:
     - attack.initial_access

rules/application/spring/appframework_spring_exceptions.yml

@@ -22,7 +22,6 @@ detection:
     condition: keywords
 falsepositives:
     - Application bugs
-    - Penetration testing
 level: medium
 tags:
     - attack.initial_access

rules/cloud/aws/aws_efs_fileshare_modified_or_deleted.yml

@@ -15,7 +15,7 @@ detection:
         eventName: DeleteFileSystem
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: medium
 tags:
     - attack.impact

rules/cloud/aws/aws_efs_fileshare_mount_modified_or_deleted.yml

@@ -15,7 +15,7 @@ detection:
         eventName: DeleteMountTarget
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: medium
 tags:
     - attack.impact

rules/cloud/aws/aws_rds_public_db_restore.yml

@@ -17,7 +17,7 @@ detection:
         eventName: RestoreDBInstanceFromDBSnapshot
     condition: selection_source
 falsepositives:
-    - unknown
+    - Unknown
 level: high
 tags:
     - attack.exfiltration

rules/cloud/azure/azure_aadhybridhealth_adfs_new_server.yml

@@ -23,5 +23,5 @@ detection:
     OperationNameValue: 'Microsoft.ADHybridHealthService/services/servicemembers/action'
   condition: selection
 falsepositives:
-  - legitimate AD FS servers added to an AAD Health AD FS service instance
+  - Legitimate AD FS servers added to an AAD Health AD FS service instance
 level: medium

rules/cloud/azure/azure_aadhybridhealth_adfs_service_delete.yml

@@ -23,5 +23,5 @@ detection:
     OperationNameValue: 'Microsoft.ADHybridHealthService/services/delete'
   condition: selection
 falsepositives:
-  - legitimate AAD Health AD FS service instances being deleted in a tenant
+  - Legitimate AAD Health AD FS service instances being deleted in a tenant
 level: medium

rules/cloud/m365/microsoft365_data_exfiltration_to_unsanctioned_app.yml

@@ -17,7 +17,7 @@ detection:
         status: success
     condition: selection
 falsepositives:
-    - 
+    - Unknown
 level: medium
 tags:
     - attack.exfiltration

rules/cloud/m365/microsoft365_unusual_volume_of_file_deletion.yml

@@ -17,7 +17,7 @@ detection:
         status: success
     condition: selection
 falsepositives:
-    - 
+    - Unknown
 level: medium
 tags:
     - attack.impact

rules/cloud/m365/microsoft365_user_restricted_from_sending_email.yml

@@ -17,7 +17,7 @@ detection:
         status: success
     condition: selection
 falsepositives:
-    - 
+    - Unknown
 level: medium
 tags:
     - attack.initial_access

rules/cloud/okta/okta_security_threat_detected.yml

@@ -18,4 +18,4 @@ detection:
     condition: selection
 level: medium
 falsepositives:
- - None
+ - Unknown

rules/compliance/default_credentials_usage.yml

@@ -79,7 +79,7 @@ detection:
             - 87106
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: medium
 # tags:
     # - CSC4

rules/compliance/firewall_cleartext_protocols.yml

@@ -38,7 +38,7 @@ detection:
             - 2
     condition: selection1 and selection2
 falsepositives:
-    - unknown
+    - Unknown
 level: low
 # tags:
     # - CSC4

rules/compliance/group_modification_logging.yml

@@ -31,7 +31,7 @@ detection:
             - 634
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: low
 # tags:
     # - CSC4

rules/compliance/netflow_cleartext_protocols.yml

@@ -75,5 +75,5 @@ detection:
             - 5904
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: low

rules/compliance/workstation_was_locked.yml

@@ -19,7 +19,7 @@ detection:
             - 4800
     condition: selection
 falsepositives:
-    - unknown
+    - Unknown
 level: low
 # tags:
     # - CSC16

rules/generic/generic_brute_force.yml

@@ -18,7 +18,6 @@ fields:
   - user
 falsepositives:
   - Inventarization
-  - Penetration testing
   - Vulnerability scanner
   - Legitimate application
 level: medium

rules/linux/auditd/lnx_auditd_audio_capture.yml

@@ -26,5 +26,5 @@ tags:
    - attack.collection
    - attack.t1123
 falsepositives:
-   - None
+   - Unknown
 level: low

rules/linux/auditd/lnx_auditd_binary_padding.yml

@@ -23,7 +23,7 @@ detection:
     - 'of='
   condition: execve and (all of truncate or (all of dd and not filter))
 falsepositives:
-  - 'Legitimate script work'
+  - Legitimate script work
 level: high
 tags:
   - attack.defense_evasion

rules/linux/auditd/lnx_auditd_capabilities_discovery.yml

@@ -25,5 +25,5 @@ tags:
    - attack.t1123
    - attack.t1548
 falsepositives:
-   - None
+   - Unknown
 level: low

rules/linux/auditd/lnx_auditd_change_file_time_attr.yml

@@ -22,7 +22,7 @@ detection:
     - '-r'
   condition: execve and touch and selection2
 falsepositives:
-  - 'Unknown'
+  - Unknown
 level: medium
 tags:
   - attack.defense_evasion

rules/linux/auditd/lnx_auditd_cve_2021_4034.yml

@@ -24,5 +24,5 @@ tags:
    - attack.privilege_escalation
    - attack.t1068
 falsepositives:
-   - unknown
+   - Unknown
 level: high

rules/linux/auditd/lnx_auditd_data_exfil_wget.yml

@@ -21,5 +21,5 @@ tags:
    - attack.exfiltration
    - attack.t1048.003
 falsepositives:
-   - legitimate usage of wget utility to post a file
+   - Legitimate usage of wget utility to post a file
 level: medium

rules/linux/auditd/lnx_auditd_find_cred_in_files.yml

@@ -18,7 +18,7 @@ detection:
     - 'password'
   condition: execve and all of passwordgrep
 falsepositives:
-  - 'Unknown'
+  - Unknown
 level: high
 tags:
   - attack.credential_access

rules/linux/auditd/lnx_auditd_hidden_files_directories.yml

@@ -29,5 +29,5 @@ tags:
    - attack.defense_evasion
    - attack.t1564.001
 falsepositives:
-   - None
+   - Unknown
 level: low

rules/linux/auditd/lnx_auditd_hidden_zip_files_steganography.yml

@@ -11,7 +11,7 @@ tags:
    - attack.defense_evasion
    - attack.t1027.003
 falsepositives:
-   - None
+   - Unknown
 level: low
 logsource:
    product: linux

rules/linux/auditd/lnx_auditd_split_file_into_pieces.yml

@@ -16,7 +16,7 @@ detection:
     comm: 'split'
   condition: selection
 falsepositives:
-  - 'Legitimate administrative activity'
+  - Legitimate administrative activity
 level: low
 tags:
   - attack.exfiltration

rules/linux/auditd/lnx_auditd_steghide_embed_steganography.yml

@@ -11,7 +11,7 @@ tags:
    - attack.defense_evasion
    - attack.t1027.003
 falsepositives:
-   - None
+   - Unknown
 level: low
 logsource:
    product: linux

rules/linux/auditd/lnx_auditd_steghide_extract_steganography.yml

@@ -11,7 +11,7 @@ tags:
    - attack.defense_evasion
    - attack.t1027.003
 falsepositives:
-   - None
+   - Unknown
 level: low
 logsource:
    product: linux

rules/linux/auditd/lnx_auditd_susp_histfile_operations.yml

@@ -28,8 +28,8 @@ fields:
   - a3
   - key
 falsepositives:
-  - 'Legitimate administrative activity'
-  - 'Ligitimate software, cleaning hist file'
+  - Legitimate administrative activity
+  - Ligitimate software, cleaning hist file
 level: medium
 tags:
   - attack.credential_access

rules/linux/auditd/lnx_auditd_system_shutdown_reboot.yml

@@ -26,7 +26,7 @@ detection:
     - '6'
   condition: execve and (shutdowncmd or (init and initselection))
 falsepositives:
-  - 'Legitimate administrative activity'
+  - Legitimate administrative activity
 level: informational
 tags:
   - attack.impact

rules/linux/auditd/lnx_auditd_unzip_hidden_zip_files_steganography.yml

@@ -11,7 +11,7 @@ tags:
    - attack.defense_evasion
    - attack.t1027.003
 falsepositives:
-   - None
+   - Unknown
 level: low
 logsource:
    product: linux

rules/linux/builtin/lnx_ldso_preload_injection.yml

@@ -9,11 +9,11 @@ references:
 logsource:
     product: linux
 detection:
-    keyword: 
+    keyword:
         - '/etc/ld.so.preload'
     condition: keyword
 falsepositives:
-    - rare temporary workaround for library misconfiguration
+    - Rare temporary workaround for library misconfiguration
 level: high
 tags:
     - attack.persistence

rules/linux/macos/process_creation/proc_creation_macos_binary_padding.yml

@@ -25,7 +25,7 @@ detection:
     CommandLine|contains: 'of='
   condition: selection1 or (selection2 and not filter)
 falsepositives:
-  - 'Legitimate script work'
+  - Legitimate script work
 level: high
 tags:
   - attack.defense_evasion

rules/linux/macos/process_creation/proc_creation_macos_change_file_time_attr.yml

@@ -21,7 +21,7 @@ detection:
       - '-r'
   condition: selection1 and selection2
 falsepositives:
-  - 'Unknown'
+  - Unknown
 level: medium
 tags:
   - attack.defense_evasion

rules/linux/macos/process_creation/proc_creation_macos_find_cred_in_files.yml

@@ -20,7 +20,7 @@ detection:
     CommandLine|contains: 'laZagne'
   condition: selection1 or selection2
 falsepositives:
-  - 'Unknown'
+  - Unknown
 level: high
 tags:
   - attack.credential_access

rules/linux/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml

@@ -15,7 +15,7 @@ detection:
     Image|endswith: '/split'
   condition: selection
 falsepositives:
-  - 'Legitimate administrative activity'
+  - Legitimate administrative activity
 level: low
 tags:
   - attack.exfiltration

rules/linux/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml

@@ -21,8 +21,8 @@ detection:
       - 'fish_history'
   condition: selection
 falsepositives:
-  - 'Legitimate administrative activity'
-  - 'Ligitimate software, cleaning hist file'
+  - Legitimate administrative activity
+  - Ligitimate software, cleaning hist file
 level: medium
 tags:
   - attack.credential_access

rules/linux/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml

@@ -18,7 +18,7 @@ detection:
       - '/halt'
   condition: selection
 falsepositives:
-  - 'Legitimate administrative activity'
+  - Legitimate administrative activity
 level: informational
 tags:
   - attack.impact

rules/network/net_susp_network_scan_by_ip.yml

@@ -19,7 +19,6 @@ fields:
 falsepositives:
   - Inventarization systems
   - Vulnerability scans
-  - Penetration testing activity
 level: medium
 tags:
   - attack.discovery

rules/network/net_susp_network_scan_by_port.yml

@@ -18,7 +18,6 @@ detection:
 falsepositives:
     - Inventarization systems
     - Vulnerability scans
-    - Penetration testing activity
 level: medium
 fields:
     - src_ip

rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml

@@ -43,8 +43,8 @@ detection:
     operation: 'StartServiceW'
   condition: 1 of op*
 falsepositives:
-  - 'Windows administrator tasks or troubleshooting'
-  - 'Windows management scripts or software'
+  - Windows administrator tasks or troubleshooting
+  - Windows management scripts or software
 level: medium
 tags:
   - attack.execution

rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml

@@ -31,8 +31,8 @@ detection:
     operation: 'SeclCreateProcessWithLogonExW'
   condition: 1 of op*
 falsepositives:
-  - 'Windows administrator tasks or troubleshooting'
-  - 'Windows management scripts or software'
+  - Windows administrator tasks or troubleshooting
+  - Windows management scripts or software
 level: medium
 tags:
   - attack.persistence

rules/network/zeek/zeek_default_cobalt_strike_certificate.yml

@@ -22,5 +22,5 @@ fields:
     - certificate.subject
     - certificate.issuer
 falsepositives:
-    - none
+    - Unknown
 level: high

rules/network/zeek/zeek_http_executable_download_from_webdav.yml

@@ -20,7 +20,7 @@ detection:
     - c-uri|endswith: '.exe'
   condition: selection_webdav and selection_executable
 falsepositives:
-  - unknown
+  - Unknown
 level: medium
 tags:
   - attack.command_and_control

rules/network/zeek/zeek_http_webdav_put_request.yml

@@ -21,7 +21,7 @@ detection:
       - 10.0.0.0/8
   condition: selection and not filter
 falsepositives:
-  - unknown
+  - Unknown
 level: low
 tags:
   - attack.exfiltration

rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml

@@ -17,7 +17,7 @@ detection:
         #Accesses: '*WriteData*'
   condition: selection
 falsepositives:
-  - unknown
+  - Unknown
 level: medium
 tags:
   - attack.lateral_movement

rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml

@@ -19,7 +19,7 @@ detection:
     name|endswith: '.tmp'
   condition: selection
 falsepositives:
-  - 'unknown'
+  - Unknown
 level: high
 tags:
   - attack.credential_access

rules/network/zeek/zeek_smb_converted_win_susp_psexec.yml

@@ -26,7 +26,7 @@ detection:
     path|startswith: 'PSEXESVC'
   condition: selection1 and not selection2
 falsepositives:
-  - nothing observed so far
+  - Unknown
 level: high
 tags:
   - attack.lateral_movement

rules/web/web_cve_2010_5278_exploitation_attempt.yml

@@ -18,7 +18,6 @@ detection:
   condition: selection
 falsepositives:
   - Scanning from Nuclei
-  - Penetration Testing Activity
   - Unknown
 tags:
   - attack.initial_access

rules/web/web_cve_2021_21978_vmware_view_planner_exploit.yml

@@ -22,7 +22,7 @@ fields:
   - c-ip
   - c-dns
 falsepositives:
-  - None
+  - Unknown
 level: high
 tags:
   - attack.initial_access

rules/web/web_cve_2021_22005_vmware_file_upload.yml

@@ -18,5 +18,5 @@ detection:
         c-uri|contains: '/analytics/telemetry/ph/api/hyper/send?'
     condition: selection
 falsepositives:
-    - Vulnerability Scanning/Pentesting
+    - Vulnerability Scanning
 level: high

rules/web/web_cve_2021_22893_pulse_secure_rce_exploit.yml

@@ -30,5 +30,5 @@ detection:
             - 'metric'
     condition: selection1 and selection2
 falsepositives:
-    - Vulnerability Scanning/Pentesting
+    - Vulnerability Scanning
 level: high

rules/web/web_cve_2021_26814_wzuh_rce.yml

@@ -16,7 +16,7 @@ fields:
     - c-ip
     - c-dns
 falsepositives:
-    - None
+    - Unknown
 level: high
 tags:
     - attack.initial_access

rules/web/web_cve_2021_40539_manageengine_adselfservice_exploit.yml

@@ -29,5 +29,5 @@ fields:
     - c-ip
     - c-uri
 falsepositives:
-    - External Pentesting
+    - Unknown
 level: critical

rules/web/web_cve_2021_42237_sitecore_report_ashx.yml

@@ -19,5 +19,5 @@ detection:
         sc-status: 200
     condition: selection
 falsepositives:
-    - Vulnerability Scanning/Pentesting
+    - Vulnerability Scanning
 level: high

rules/web/web_path_traversal_exploitation_attempt.yml

@@ -17,7 +17,6 @@ detection:
   condition: selection
 falsepositives:
   - Happens all the time on systems exposed to the Internet
-  - Penetration testing activity on internal systems
   - Internal vulnerability scanners
 tags:
   - attack.initial_access

rules/web/web_source_code_enumeration.yml

@@ -20,7 +20,7 @@ fields:
   - url
   - response
 falsepositives:
-  - unknown
+  - Unknown
 level: medium
 tags:
   - attack.discovery

rules/windows/builtin/dns_server/win_apt_gallium.yml

@@ -31,5 +31,5 @@ detection:
             - 'cvdfhjh1231.ddns.net'
     condition: c2_selection
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml

@@ -22,7 +22,7 @@ detection:
         - '.aspx'
     condition: all of export_command and export_params
 falsepositives:
-    - unlikely
+    - Unlikely
 level: critical
 tags:
     - attack.persistence

rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml

@@ -24,7 +24,7 @@ detection:
         - ' -User '
     condition: (all of export_command and export_params) or all of role_assignment
 falsepositives:
-    - unlikely
+    - Unlikely
 level: critical
 tags:
     - attack.persistence  

rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml

@@ -16,7 +16,7 @@ detection:
         - ' -Confirm "False"'
     condition: all of command
 falsepositives:
-    - unknown
+    - Unknown
 level: high
 tags:
     - attack.defense_evasion

rules/windows/builtin/msexchange/win_exchange_transportagent.yml

@@ -23,5 +23,5 @@ detection:
 fields:
     - AssemblyPath
 falsepositives:
-    - legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
+    - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
 level: medium

rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml

@@ -21,5 +21,5 @@ detection:
 fields:
     - AssemblyPath
 falsepositives:
-    - legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
+    - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
 level: high

rules/windows/builtin/security/win_adcs_certificate_template_configuration_vulnerability.yml

@@ -23,7 +23,6 @@ detection:
     condition: selection1 or selection2 
 falsepositives:
     - Administrator activity
-    - Penetration tests
     - Proxy SSL certificate with subject modification
     - Smart card enrollement
 level: low

rules/windows/builtin/security/win_adcs_certificate_template_configuration_vulnerability_eku.yml

@@ -37,7 +37,6 @@ detection:
     condition: (selection10 and selection11) or (selection20 and selection21)
 falsepositives:
     - Administrator activity
-    - Penetration tests
     - Proxy SSL certificate with subject modification
     - Smart card enrollement
 level: high

rules/windows/builtin/security/win_arbitrary_shell_execution_via_settingcontent.yml

@@ -22,7 +22,7 @@ detection:
         FilePath|contains: 'immersivecontrolpanel'
     condition: selection and not filter
 falsepositives: 
-    - unknown
+    - Unknown
 fields: 
     - ParentProcess
     - CommandLine

rules/windows/builtin/security/win_asr_bypass_via_appvlp_re.yml

@@ -37,7 +37,7 @@ detection:
             - '.inf'
     condition: all of selection_*
 falsepositives: 
-    - unknown
+    - Unknown
 fields: 
     - ParentProcess
     - CommandLine

rules/windows/builtin/security/win_atsvc_task.yml

@@ -19,7 +19,7 @@ detection:
     Accesses|contains: 'WriteData'
   condition: selection
 falsepositives:
-  - pentesting
+  - Unknown
 level: medium
 tags:
   - attack.lateral_movement

rules/windows/builtin/security/win_etw_modification.yml

@@ -26,7 +26,7 @@ detection:
     NewValue: '0'
   condition: selection
 falsepositives:
-  - unknown
+  - Unknown
 level: critical
 tags:
   - attack.defense_evasion

rules/windows/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml

@@ -9,7 +9,7 @@ references:
 date: 2021/07/02
 tags:
     - attack.execution
-    - attack.t1569    
+    - attack.t1569
     - cve.2021.1675
     - cve.2021.34527
 logsource:
@@ -24,4 +24,4 @@ detection:
         ObjectType: 'File'
     condition: selection
 falsepositives:
-    - nothing observed so far
+    - Unknown

rules/windows/builtin/security/win_hidden_user_creation.yml

@@ -21,5 +21,5 @@ fields:
     - EventCode
     - AccountName
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/windows/builtin/security/win_impacket_psexec.yml

@@ -21,7 +21,7 @@ detection:
       - 'RemCom_stderrt'
   condition: selection1
 falsepositives:
-  - nothing observed so far
+  - Unknown
 level: high
 tags:
   - attack.lateral_movement

rules/windows/builtin/security/win_impacket_secretdump.yml

@@ -20,10 +20,10 @@ detection:
     selection:
         EventID: 5145
         ShareName: \\\*\ADMIN$
-        RelativeTargetName|contains|all: 
+        RelativeTargetName|contains|all:
             - 'SYSTEM32\'
             - '.tmp'
     condition: selection
 falsepositives:
-    - pentesting
+    - Unknown
 level: high

rules/windows/builtin/security/win_invoke_obfuscation_via_compress_services_security.yml

@@ -31,5 +31,5 @@ detection:
             - 'system.io.streamreader'
     condition: all of selection*
 falsepositives:
-    - unknown
+    - Unknown
 level: medium

rules/windows/builtin/security/win_lateral_movement_condrv.yml

@@ -11,7 +11,7 @@ references:
 tags:
     - attack.lateral_movement
     - attack.execution
-    - attack.t1021  
+    - attack.t1021
     - attack.t1059
 logsource:
     product: windows
@@ -25,5 +25,4 @@ detection:
     condition: selection
 falsepositives:
     - legal admin action
-    - Penetration tests where lateral movement has occurred. This event will be created on the target host.
 level: low

rules/windows/builtin/security/win_lolbas_execution_of_nltest.yml

@@ -7,7 +7,7 @@ description: The attacker might use LOLBAS nltest.exe for discovery of domain co
 references:
   - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm
   - https://attack.mitre.org/software/S0359/
-tags: 
+tags:
   - attack.discovery
   - attack.t1482 # enumerate trusted domains by using commands such as nltest /domain_trusts
   - attack.t1018 # enumerate remote domain controllers using options such as /dclist and /dsgetdc
@@ -26,5 +26,5 @@ fields:
   - 'SubjectDomainName'
 falsepositives:
   - Red team activity
-  - rare legitimate use by an administrator
+  - Rare legitimate use by an administrator
 level: high

rules/windows/builtin/security/win_mal_wceaux_dll.yml

@@ -21,7 +21,7 @@ detection:
     ObjectName|endswith: '\wceaux.dll'
   condition: selection
 falsepositives:
-  - Penetration testing
+  - Unknown
 level: critical
 tags:
   - attack.credential_access

rules/windows/builtin/security/win_pass_the_hash.yml

@@ -25,7 +25,6 @@ detection:
   condition: selection and not filter
 falsepositives:
   - Administrator activity
-  - Penetration tests
 level: medium
 tags:
   - attack.lateral_movement

rules/windows/builtin/security/win_pass_the_hash_2.yml

@@ -30,5 +30,4 @@ detection:
     condition: selection and not filter
 falsepositives:
     - Administrator activity
-    - Penetration tests
 level: medium

rules/windows/builtin/security/win_privesc_cve_2020_1472.yml

@@ -24,5 +24,5 @@ detection:
     condition: selection and not filter
 falsepositives:
     - automatic DC computer account password change
-    - legitimate DC computer account password change
+    - Legitimate DC computer account password change
 level: high

rules/windows/builtin/security/win_rdp_reverse_tunnel.yml

@@ -34,5 +34,5 @@ detection:
             - '::1'
     condition: selection and ( sourceRDP or destinationRDP )
 falsepositives:
-    - unknown
+    - Unknown
 level: high

rules/windows/builtin/security/win_security_mal_service_installs.yml

@@ -29,5 +29,5 @@ detection:
         ServiceName: 'javamtsup'
     condition: selection and 1 of malsvc_*
 falsepositives:
-    - Penetration testing
+    - Unknown
 level: critical

rules/windows/builtin/security/win_susp_net_recon_activity.yml

@@ -26,7 +26,6 @@ detection:
   condition: selection and selection2
 falsepositives:
   - Administrator activity
-  - Penetration tests
 level: high
 tags:
   - attack.discovery

rules/windows/builtin/security/win_susp_psexec.yml

@@ -23,7 +23,7 @@ detection:
     RelativeTargetName|startswith: 'PSEXESVC'
   condition: selection1 and not filter
 falsepositives:
-  - nothing observed so far
+  - Unknown
 level: high
 tags:
   - attack.lateral_movement