diff --git a/rules/windows/process_creation/proc_creation_win_hack_sharpersist.yml b/rules/windows/process_creation/proc_creation_win_hack_sharpersist.yml index 06ed87af5..51ca980d6 100644 --- a/rules/windows/process_creation/proc_creation_win_hack_sharpersist.yml +++ b/rules/windows/process_creation/proc_creation_win_hack_sharpersist.yml @@ -13,8 +13,6 @@ logsource: tags: - attack.persistence - attack.t1053 - - attack.t1060 - - attack.t1050 detection: selection1: Image|endswith: '\SharPersist.exe'