diff --git a/rules/windows/registry_event/sysmon_wab_dllpath_reg_change.yml b/rules/windows/registry_event/sysmon_wab_dllpath_reg_change.yml index 63a654317..351020fc0 100644 --- a/rules/windows/registry_event/sysmon_wab_dllpath_reg_change.yml +++ b/rules/windows/registry_event/sysmon_wab_dllpath_reg_change.yml @@ -10,6 +10,7 @@ tags: - attack.defense_evasion - attack.t1218 date: 2020/10/13 +modified: 2021/05/21 author: oscd.community, Natalia Shornikova logsource: category: registry_event @@ -20,5 +21,6 @@ detection: filter: Details: '%CommonProgramFiles%\System\wab32.dll' condition: selection and not filter -falsepositives: Unknown +falsepositives: + - Unknown level: high