[Rule Tuning] Potential Microsoft Office Sandbox Evasion (#2123)

* filter run by macOS os type (cherry picked from commit df670fac56)
2022-07-27 11:58:30 -04:00
parent 4534f04c0c
commit 6a7b78f14c
1 changed files with 1 additions and 1 deletions
@@ -28,7 +28,7 @@ timestamp_override = "event.ingested"
 type = "query"

 query = '''
-event.category:file and not event.type:deletion and file.name:~$*.zip
+event.category:file and not event.type:deletion and file.name:~$*.zip and host.os.type:macos
 '''

 [[rule.threat]]