From 8cad086a2dd002fb44fc69c0accd4cdff3ea63eb Mon Sep 17 00:00:00 2001 From: Jonhnathan Date: Fri, 11 Feb 2022 14:15:49 -0300 Subject: [PATCH] Update impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml (#1757) (cherry picked from commit aa9fedd18d547a980e1ed1329a4164cf93479370) --- ...t_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml b/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml index 33568d16f..fd5efb7da 100644 --- a/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml +++ b/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/02/18" maturity = "production" -updated_date = "2021/10/04" +updated_date = "2022/02/04" [rule] author = ["Elastic"] @@ -22,7 +22,7 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -process where event.type in ("start", "process_started") and event.action == "start" +process where event.type in ("start", "process_started") and (process.name : "vssadmin.exe" or process.pe.original_file_name == "VSSADMIN.EXE") and process.args in ("delete", "resize") and process.args : "shadows*" '''