Skip to content

Commit 8a076e7

Browse files
w0rk3rgithub-actions[bot]
authored andcommitted
Update discovery_remote_system_discovery_commands_windows.toml (#2033)
(cherry picked from commit c8ff1dc)
1 parent 71fed9a commit 8a076e7

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

rules/windows/discovery_remote_system_discovery_commands_windows.toml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[metadata]
22
creation_date = "2020/12/04"
33
maturity = "production"
4-
updated_date = "2022/04/21"
4+
updated_date = "2022/06/14"
55

66
[rule]
77
author = ["Elastic"]
@@ -62,8 +62,8 @@ type = "eql"
6262

6363
query = '''
6464
process where event.type in ("start", "process_started") and
65-
(process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
66-
(process.name : "arp.exe" and process.args : "-a")
65+
((process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
66+
(process.name : "arp.exe" and process.args : "-a"))
6767
'''
6868

6969

0 commit comments

Comments
 (0)