From 07b501035ede47480697d552b847f0941d516ca0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Mar 2022 13:54:37 +0100 Subject: [PATCH] detections/endpoint/disabling_systemrestore_in_registry.yml --- detections/endpoint/disabling_systemrestore_in_registry.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 7c0d4a8bef..6b53a267c5 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -51,8 +51,7 @@ tags: message: The Windows registry was modified to disable system restore on $dest$ by $user$. mitre_attack_id: - - T1562.001 - - T1562 + - T1490 observable: - name: user type: User