security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Switch "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet" to use KQL (#1651)

Browse Source 
* Update command_and_control_download_rar_powershell_from_internet.toml

* bump updated_date

(cherry picked from commit 7b0383ffe2)
This commit is contained in:
Jonhnathan
2021-12-07 09:09:03 -03:00
committed by github-actions[bot]
parent 6a91e9f91b
commit 6bc87199f0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/network/command_and_control_download_rar_powershell_from_internet.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/07/02"
maturity = "production"
updated_date = "2021/05/27"
updated_date = "2021/12/06"
[rule]
author = ["Elastic"]
@@ -19,7 +19,7 @@ false_positives = [
]
from = "now-9m"
index = ["auditbeat-*", "filebeat-*", "packetbeat-*", "logs-endpoint.events.*"]
language = "lucene"
language = "kuery"
license = "Elastic License v2"
name = "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet"
note = """## Threat intel