From dde4d25b6bc9133515a0fe4e688e380ebcfb9fb6 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Fri, 31 Dec 2021 15:48:15 +0100 Subject: [PATCH] Update powershell_ps_directoryservices_accountmanagement.yml --- .../powershell_ps_directoryservices_accountmanagement.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/windows/powershell/powershell_script/powershell_ps_directoryservices_accountmanagement.yml b/rules/windows/powershell/powershell_script/powershell_ps_directoryservices_accountmanagement.yml index 8e9a65b61..6d4f23a3b 100644 --- a/rules/windows/powershell/powershell_script/powershell_ps_directoryservices_accountmanagement.yml +++ b/rules/windows/powershell/powershell_script/powershell_ps_directoryservices_accountmanagement.yml @@ -18,7 +18,7 @@ detection: condition: selection falsepositives: - legitimate administrative script -level: high +level: medium tags: - attack.persistence - - attack.t1136.002 \ No newline at end of file + - attack.t1136.002