diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 52b95b0391..5a28aa6e6b 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -148,7 +148,8 @@ class Detection(BaseModel, SecurityContentObject): if "ssa_" not in values["file_path"]: raise ValueError(f"The following is NOT an ssa_ detection, but has 'status: {values['status']} which may ONLY be used for ssa_ detections:' {values['file_path']}") else: - print(f"Got an ssa validation detection: {values['file_path']}") + #This is an ssa_ validation detection + pass return values diff --git a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml index adb586b2d9..e00b74c67e 100644 --- a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml +++ b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml @@ -1,7 +1,7 @@ name: Services lolbas Execution Process Spawn id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 version: 1 -status: production +status: validation description: The following analytic identifies services.exe spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned