mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Remove context from detections.tags for a number of detections
This commit is contained in:
@@ -42,9 +42,6 @@ tags:
|
||||
- Suspicious Command-Line Executions
|
||||
asset_type: Endpoint
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
impact: 50
|
||||
message: The process $process$ is running from an unusual place by $user$ on $dest$
|
||||
with a processname that appears to be randomly generated.
|
||||
|
||||
@@ -49,9 +49,6 @@ tags:
|
||||
- Active Directory Discovery
|
||||
asset_type: Endpoint
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
impact: 60
|
||||
message: Invoke-ShareFinder commandlet was executed on $Computer$
|
||||
mitre_attack_id:
|
||||
|
||||
@@ -45,9 +45,6 @@ tags:
|
||||
- Winter Vivern
|
||||
asset_type: Endpoint
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Collection
|
||||
impact: 70
|
||||
message: A PowerShell script was identified possibly performing screen captures
|
||||
on $Computer$.
|
||||
|
||||
Reference in New Issue
Block a user