security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update impact_high_freq_file_renames_by_kernel.toml (#3707)

Browse Source 
(cherry picked from commit 603f3c313a)
This commit is contained in:
Samirbous
2024-05-23 17:59:58 +01:00
committed by github-actions[bot]
parent 18fcd83683
commit 8975b5de18
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/impact_high_freq_file_renames_by_kernel.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/05/03"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/05/23"
[rule]
author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
This rule identifies a high number (20) of file creation event by the System virtual process from the same host and with
same file name containing keywords similar to ransomware note files and all within a short time period.
"""
from = "now-1m"
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "kuery"
license = "Elastic License v2"