security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update credential_access_suspicious_web_browser_sensitive_file_access.toml (#3691)

Browse Source
This commit is contained in:
Samirbous
2024-05-18 05:30:16 +01:00
committed by GitHub
parent 707ca32ab1
commit ec27bf8545
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: file_access_events, process.Ext.effective_parent"
min_stack_version = "8.11.0"
updated_date = "2024/02/06"
updated_date = "2024/05/17"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the access or file open of web browser sensitive files by an untruste
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
"""
from = "now-9m"
index = ["logs-endpoint.events.file.*"]
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Web Browser Sensitive File Access"