admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove duplicate obs

Browse Source
This commit is contained in:
Bhavin Patel
2024-08-21 00:11:42 +05:30
parent 9f85603faa
commit e127f1bfc6
2 changed files with 4 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/excessive_usage_of_taskkill.yml
+2 -7
View File
@@ -1,7 +1,7 @@
name: Excessive Usage Of Taskkill
id: fe5bca48-accb-11eb-a67c-acde48001122
version: 2
date: '2024-05-23'
version: 3
date: '2024-08-21'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -53,10 +53,6 @@ tags:
- T1562.001
- T1562
observable:
- name: dest
type: Endpoint
role:
- Victim
- name: dest
type: Endpoint
role:
@@ -64,7 +60,6 @@ tags:
- name: parent_process_name
type: Process Name
role:
- Parent Process
- Attacker
product:
- Splunk Enterprise
detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml
+2 -7
View File
@@ -1,7 +1,7 @@
name: Windows Disable or Modify Tools Via Taskkill
id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0
version: 2
date: '2024-05-28'
version: 3
date: '2024-08-21'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -48,10 +48,6 @@ tags:
- T1562
- T1562.001
observable:
- name: dest
type: Endpoint
role:
- Victim
- name: dest
type: Endpoint
role:
@@ -59,7 +55,6 @@ tags:
- name: parent_process_name
type: Process Name
role:
- Parent Process
- Attacker
product:
- Splunk Enterprise