admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update winevent_windows_task_scheduler_event_action_started.test.yml

Browse Source
This commit is contained in:
mhaag-spl
2021-11-09 13:47:05 -07:00
parent babbd47d81
commit 24779bc8ef
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
+1 -1
View File
@@ -3,7 +3,7 @@ tests:
- name: WinEvent Windows Task Scheduler Event Action Started
file: endpoint/winevent_windows_task_scheduler_event_action_started.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-10d'
earliest_time: '-45d'
latest_time: 'now'
attack_data:
- file_name: windows-taskschedule.log