security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: typos and title

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2023-02-27 11:37:52 +01:00
committed by GitHub
parent d29474079d
commit c533f8fcf2
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml
+4 -2
View File
@@ -1,10 +1,10 @@
title: New Firewall Rule Added For Suspicius Folder
title: New Firewall Exception Rule Added For A Suspicious Folder
id: 9e2575e7-2cb9-4da1-adc8-ed94221dca5e
related:
- id: cde0a575-7d3d-4a49-9817-b8004a7bf105
type: derived
status: experimental
description: Detects when a rule has been added to the Windows Firewall exception list for a suspicius folder
description: Detects the addition of a rule to the Windows Firewall exception list where the application resides in a suspicious folder
references:
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
- https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#
@@ -22,4 +22,6 @@ detection:
filter_block:
Action: 2
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: high