From be0fc0b66a17df31eb4f0be2d5fbf5f3b58ca006 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Wed, 18 Dec 2019 10:29:40 +0100 Subject: [PATCH] Worked on the feedback --- detections/creation_of_shadow_copy.yml | 2 +- ...on_of_shadow_copy.yml => creation_of_shadow_copy_filter.yml} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename macros/{creation_of_shadow_copy.yml => creation_of_shadow_copy_filter.yml} (100%) diff --git a/detections/creation_of_shadow_copy.yml b/detections/creation_of_shadow_copy.yml index daead29ba8..902ec2e256 100644 --- a/detections/creation_of_shadow_copy.yml +++ b/detections/creation_of_shadow_copy.yml @@ -32,7 +32,7 @@ detect: OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `creation_of_shadow_copy`' + | `creation_of_shadow_copy_filter`' suppress: suppress_fields: process_name, dest suppress_period: 86400s diff --git a/macros/creation_of_shadow_copy.yml b/macros/creation_of_shadow_copy_filter.yml similarity index 100% rename from macros/creation_of_shadow_copy.yml rename to macros/creation_of_shadow_copy_filter.yml