security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Deprecate rule] Whitespace Padding in Process Command Line (#2218)

Browse Source 
very noisy and will require frequent tuning with very low TP rate.

(cherry picked from commit a046dc0d29)
This commit is contained in:
Samirbous
2022-08-02 18:30:57 +02:00
committed by github-actions[bot]
parent 08f2e9003f
commit 7585d6264d
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/defense_evasion_whitespace_padding_in_command_line.toml → rules/_deprecated/defense_evasion_whitespace_padding_in_command_line.toml
+3 -2
View File
@@ -1,9 +1,10 @@
[metadata]
creation_date = "2021/07/30"
maturity = "production"
deprecation_date = "2022/08/02"
maturity = "deprecated"
min_stack_comments = "EQL regex had a bug when dealing with wildcard fields that was fixed in 7.16 (elastic/elasticsearch/issues/78391)"
min_stack_version = "7.16.0"
updated_date = "2022/05/13"
updated_date = "2022/08/02"
[rule]
author = ["Elastic"]