security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update defense_evasion_agent_spoofing_mismatched_id.toml (#5312)

Browse Source
This commit is contained in:
Samirbous
2025-11-13 17:26:29 +00:00
committed by GitHub
parent 29d4aeb37a
commit 7b6f4864f0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cross-platform/defense_evasion_agent_spoofing_mismatched_id.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/07/14"
maturity = "production"
updated_date = "2025/11/10"
updated_date = "2025/11/13"
[rule]
author = ["Elastic"]
@@ -29,7 +29,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.agent_id_status:(agent_id_mismatch or mismatch) and not host.name:agentless-*
event.agent_id_status:agent_id_mismatch and not host.name:agentless-*
'''
note = """## Triage and analysis