Skip to content

Commit

Permalink
Update and rename 91550-win_autoruns_rules.xml to 100050-win_autoruns…
Browse files Browse the repository at this point in the history
…_rules.xml
  • Loading branch information
taylorwalton authored Mar 7, 2023
1 parent becee4e commit e65777a
Showing 1 changed file with 5 additions and 5 deletions.
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<group name="windows,">
<rule id="91550" level="10">
<rule id="100050" level="10">
<decoded_as>json</decoded_as>
<field name="Entry">\.+</field>
<field name="EntryLocation">\.+</field>
Expand All @@ -10,8 +10,8 @@
<options>no_full_log</options>
<group>windows_autoruns,</group>
</rule>
<rule id="91551" level="10">
<if_sid>91550</if_sid>
<rule id="100051" level="10">
<if_sid>100050</if_sid>
<field name="VTdetection">Unknown</field>
<description>Windows Autoruns - VirusTotal Unknown Signature</description>
<mitre>
Expand All @@ -20,8 +20,8 @@
<options>no_full_log</options>
<group>windows_autoruns,</group>
</rule>
<rule id="91552" level="12">
<if_sid>91550</if_sid>
<rule id="100052" level="12">
<if_sid>100050</if_sid>
<field name="VTdetection">^\d\d\|</field>
<description>Windows Autoruns - VirusTotal Hit Above 10 Matches</description>
<mitre>
Expand Down

0 comments on commit e65777a

Please sign in to comment.