[Rule Tuning] Unusual File Modification by dns.exe (#472)

2020-11-30 18:22:27 +01:00
parent 310f480027
commit d0ba03230a
1 changed files with 2 additions and 1 deletions
@@ -29,7 +29,8 @@ tags = ["Elastic", "Host", "Windows", "Threat Detection", "Execution"]
 type = "query"

 query = '''
-event.category:file and process.name:dns.exe and
+event.category:file and process.name:dns.exe and 
+  event.type:(creation or deletion or change) and
  not file.name:dns.log
 '''