From 779ecc584750447476cea492b5dccdaa1b8bdf8a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Jun 2022 12:37:43 -0700 Subject: [PATCH] typo --- detections/endpoint/unload_sysmon_filter_driver.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index a606ddb0c0..54d0e13711 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -22,7 +22,7 @@ how_to_implement: You must be ingesting data that records process activity from The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. -known_false_positives: 'Unkown at the moment' +known_false_positives: 'Unknown at the moment' references: - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver tags: