security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update Index Pattern for Detection Engine Rules (#101)

Browse Source 
* [Rule Tuning] Update Index Pattern for Detection Engine Rules

* update indices
This commit is contained in:
Brent Murphy
2020-08-03 15:46:57 -04:00
committed by GitHub
parent 3c4a383947
commit 7efe33e01d
75 changed files with 150 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/execution_script_executing_powershell.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/02/18"
ecs_version = ["1.5.0"]
maturity = "production"
updated_date = "2020/06/24"
updated_date = "2020/08/03"
[rule]
author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes
executing a PowerShell script, may be indicative of malicious activity.
"""
index = ["winlogbeat-*"]
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License"
name = "Windows Script Executing PowerShell"