From e127f1bfc6f6cef6a09d84db2074e253c4e5c0cb Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 21 Aug 2024 00:11:42 +0530 Subject: [PATCH] remove duplicate obs --- detections/endpoint/excessive_usage_of_taskkill.yml | 9 ++------- .../windows_disable_or_modify_tools_via_taskkill.yml | 9 ++------- 2 files changed, 4 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 448d2a796a..6c8978c0ef 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -1,7 +1,7 @@ name: Excessive Usage Of Taskkill id: fe5bca48-accb-11eb-a67c-acde48001122 -version: 2 -date: '2024-05-23' +version: 3 +date: '2024-08-21' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,10 +53,6 @@ tags: - T1562.001 - T1562 observable: - - name: dest - type: Endpoint - role: - - Victim - name: dest type: Endpoint role: @@ -64,7 +60,6 @@ tags: - name: parent_process_name type: Process Name role: - - Parent Process - Attacker product: - Splunk Enterprise diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index e35d798836..23a2d6c338 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -1,7 +1,7 @@ name: Windows Disable or Modify Tools Via Taskkill id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 -version: 2 -date: '2024-05-28' +version: 3 +date: '2024-08-21' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -48,10 +48,6 @@ tags: - T1562 - T1562.001 observable: - - name: dest - type: Endpoint - role: - - Victim - name: dest type: Endpoint role: @@ -59,7 +55,6 @@ tags: - name: parent_process_name type: Process Name role: - - Parent Process - Attacker product: - Splunk Enterprise