security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update rules/windows/builtin/security/win_security_successful_external_remote_smb_login.yml

Browse Source 
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
This commit is contained in:
Yamato Security
2023-03-18 04:31:25 +09:00
committed by GitHub
parent ae8199b9fa
commit fa472be0fd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/builtin/security/win_security_successful_external_remote_smb_login.yml
+2 -2
View File
@@ -34,8 +34,8 @@ detection:
- IpAddress: '::1' # IPv6 loopback
- IpAddress|startswith:
- 'fe80:' # link-local address
- 'fc00:' # private address range fc00::/7
- 'fd00:' # private address range fd00::/8
- 'fc' # private address range fc00::/7
- 'fd' # private address range fc00::/7
filter_empty:
IpAddress: '-'
condition: selection and not 1 of filter_*