From 4366702b348380e00821be755b457ce72ff0abf2 Mon Sep 17 00:00:00 2001 From: Thomas Defise <36169753+tdefise@users.noreply.github.com> Date: Mon, 26 Sep 2022 15:23:54 +0200 Subject: [PATCH] [Rule Tuning] Removed potential typo within rule "persistence_gpo_schtask_service_creation" (#2301) * Changed potential typo * Revert "Changed potential typo" This reverts commit 28e6b7206e7626121c4a2699d1fa12ba2b59408f. * Changed potential typo * Change the "updated_date" Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: Jonhnathan --- rules/windows/persistence_gpo_schtask_service_creation.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/windows/persistence_gpo_schtask_service_creation.toml b/rules/windows/persistence_gpo_schtask_service_creation.toml index cb007feef..1d40d80dc 100644 --- a/rules/windows/persistence_gpo_schtask_service_creation.toml +++ b/rules/windows/persistence_gpo_schtask_service_creation.toml @@ -3,7 +3,7 @@ creation_date = "2020/08/13" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2022/08/24" +updated_date = "2022/09/26" [rule] author = ["Elastic"] @@ -31,7 +31,7 @@ type = "eql" query = ''' file where event.type != "deletion" and file.path : ("?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml", - "?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Preferences\\Services\\Services.xml") and + "?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Services\\Services.xml") and not process.name : "dfsrs.exe" '''