Update discovery_remote_system_discovery_commands_windows.toml (#2033)
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
[metadata]
|
||||
creation_date = "2020/12/04"
|
||||
maturity = "production"
|
||||
updated_date = "2022/04/21"
|
||||
updated_date = "2022/06/14"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -62,8 +62,8 @@ type = "eql"
|
||||
|
||||
query = '''
|
||||
process where event.type in ("start", "process_started") and
|
||||
(process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
|
||||
(process.name : "arp.exe" and process.args : "-a")
|
||||
((process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
|
||||
(process.name : "arp.exe" and process.args : "-a"))
|
||||
'''
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user