Fix 'source' value for win_susp_backup_delete

2020-05-11 18:31:59 +02:00
parent 37c33cb6d9
commit d510e1aad4
1 changed files with 1 additions and 1 deletions
@@ -16,7 +16,7 @@ logsource:
 detection:
    selection:
        EventID: 524
-        Source: Backup
+        Source: Microsoft-Windows-Backup
    condition: selection
 falsepositives:
    - Unknown