Remove context from detections.tags for a number of detections

This commit is contained in:
pyth0n1c
2024-11-18 11:50:13 -08:00
parent 410548dabf
commit 904df009bc
3 changed files with 0 additions and 9 deletions
@@ -42,9 +42,6 @@ tags:
- Suspicious Command-Line Executions
asset_type: Endpoint
confidence: 90
context:
- Source:Endpoint
- Stage:Execution
impact: 50
message: The process $process$ is running from an unusual place by $user$ on $dest$
with a processname that appears to be randomly generated.
@@ -49,9 +49,6 @@ tags:
- Active Directory Discovery
asset_type: Endpoint
confidence: 80
context:
- Source:Endpoint
- Stage:Privilege Escalation
impact: 60
message: Invoke-ShareFinder commandlet was executed on $Computer$
mitre_attack_id:
@@ -45,9 +45,6 @@ tags:
- Winter Vivern
asset_type: Endpoint
confidence: 70
context:
- Source:Endpoint
- Stage:Collection
impact: 70
message: A PowerShell script was identified possibly performing screen captures
on $Computer$.