From 8d0b0caa910501ac12e37b583698ee1390527b89 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 21 Jun 2021 16:45:52 -0400 Subject: [PATCH] Update suspicious_event_log_service_behavior.yml updating filter name --- detections/endpoint/suspicious_event_log_service_behavior.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 2070d99edc..0f9561bfcb 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -8,7 +8,7 @@ datamodel: [] description: This search looks for Windows events that indicate the event logging service has been shut down. search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_event_log_cleared_filter` + | `suspicious_event_log_service_behavior` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks.