security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update credential_access_suspicious_web_browser_sensitive_file_access.toml (#3691)

Browse Source 
(cherry picked from commit ec27bf8545)
This commit is contained in:
Samirbous
2024-05-18 05:30:16 +01:00
committed by github-actions[bot]
parent 6e25eabf71
commit 98e0777b34
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: file_access_events, process.Ext.effective_parent"
min_stack_version = "8.11.0"
updated_date = "2024/02/06"
updated_date = "2024/05/17"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the access or file open of web browser sensitive files by an untruste
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
"""
from = "now-9m"
index = ["logs-endpoint.events.file.*"]
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Web Browser Sensitive File Access"