From d1f1bd59da2afe3a153e6453edcd7ea73acce9c6 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Sat, 17 Jun 2017 08:50:16 +0200 Subject: [PATCH] Changed level of PsExec events to 'low' --- rules/windows/other/win_tool_psexec.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/other/win_tool_psexec.yml b/rules/windows/other/win_tool_psexec.yml index b32185913..52aed3992 100644 --- a/rules/windows/other/win_tool_psexec.yml +++ b/rules/windows/other/win_tool_psexec.yml @@ -20,4 +20,4 @@ detection: condition: service_installation or service_execution or sysmon_processcreation falsepositives: - unknown -level: high +level: low