fix: Remove powershell_alternate_hosts from PR
Remove a rule using Host Application (which may or may not exist, based on the log parser) from the PR. A future PR will clean up rules using Host Application.
This commit is contained in:
@@ -19,7 +19,10 @@ falsepositives:
|
||||
level: medium
|
||||
detection:
|
||||
filter:
|
||||
ContextInfo: 'powershell.exe'
|
||||
- ContextInfo: 'powershell.exe'
|
||||
- Message: 'powershell.exe'
|
||||
# Both fields contain key=value pairs where the key HostApplication is relevant but
|
||||
# can't be referred directly as event field.
|
||||
condition: selection and not filter
|
||||
|
||||
---
|
||||
|
||||
Reference in New Issue
Block a user