admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-07-23 10:12:49 -07:00
committed by GitHub
parent 2e3c2c9a0d de0f890fa2
commit 6e1bde1fd8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+1 -1
View File
@@ -23,7 +23,7 @@ search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.e
how_to_implement: To successfully implement this search, you must ingest Windows Security
Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: other browser not listed related to firefox may catch by this
known_false_positives: other browser not listed related to chrome may catch by this
rule.
references: []
tags: