[Rule Tuning] Potential Microsoft Office Sandbox Evasion (#2123)

* filter run by macOS os type
2022-07-27 11:58:30 -04:00
parent fcc9cc9d8e
commit df670fac56
1 changed files with 1 additions and 1 deletions
@@ -28,7 +28,7 @@ timestamp_override = "event.ingested"
 type = "query"

 query = '''
-event.category:file and not event.type:deletion and file.name:~$*.zip
+event.category:file and not event.type:deletion and file.name:~$*.zip and host.os.type:macos
 '''

 [[rule.threat]]