security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Removed potential typo within rule "persistence_gpo_schtask_service_creation" (#2301)

Browse Source 
* Changed potential typo

* Revert "Changed potential typo"

This reverts commit 28e6b7206e7626121c4a2699d1fa12ba2b59408f.

* Changed potential typo

* Change the "updated_date"

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
This commit is contained in:
Thomas Defise
2022-09-26 15:23:54 +02:00
committed by GitHub
parent f02ffbbe13
commit 4366702b34
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/persistence_gpo_schtask_service_creation.toml
+2 -2
View File
@@ -3,7 +3,7 @@ creation_date = "2020/08/13"
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
updated_date = "2022/09/26"
[rule]
author = ["Elastic"]
@@ -31,7 +31,7 @@ type = "eql"
query = '''
file where event.type != "deletion" and
file.path : ("?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml",
"?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Preferences\\Services\\Services.xml") and
"?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Services\\Services.xml") and
not process.name : "dfsrs.exe"
'''