From 37dae6fe7bf7098ea1010afcf2fefeaca846ee9b Mon Sep 17 00:00:00 2001 From: pyth0n1c Date: Thu, 15 Aug 2024 16:13:56 -0700 Subject: [PATCH] Fix one more csv file reference --- .../endpoint/detect_remote_access_software_usage_fileinfo.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 61e05f0745..357e069ef9 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -27,7 +27,7 @@ how_to_implement: This analytic relies on Sysmon to be properly installed and ut lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: Known or approved applications used by the organization or - usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv + usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/