fix: Remove powershell_alternate_hosts from PR

Remove a rule using Host Application (which may or may not exist,
based on the log parser) from the PR. A future PR will clean up
rules using Host Application.
This commit is contained in:
Max Altgelt
2021-08-16 08:42:17 +02:00
parent ce326cb903
commit d2a35edae9
@@ -19,7 +19,10 @@ falsepositives:
level: medium
detection:
filter:
ContextInfo: 'powershell.exe'
- ContextInfo: 'powershell.exe'
- Message: 'powershell.exe'
# Both fields contain key=value pairs where the key HostApplication is relevant but
# can't be referred directly as event field.
condition: selection and not filter
---