Worked on the feedback

2026-06-08 17:32:49 +00:00 · 2019-12-18 10:29:40 +01:00
parent fc12a232a1
commit be0fc0b66a
2 changed files with 1 additions and 1 deletions
@@ -32,7 +32,7 @@ detect:
        OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*)
        by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.process_id Processes.parent_process_id
        | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-        | `creation_of_shadow_copy`'
+        | `creation_of_shadow_copy_filter`'
      suppress:
        suppress_fields: process_name, dest
        suppress_period: 86400s