rule: reduced level of rule to medium due to FPs

stboissdev · Nov 9, 2019 · fbe138e · fbe138e
1 parent faeccf0
commit fbe138e
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/windows/sysmon/sysmon_susp_file_characteristics.yml b/rules/windows/sysmon/sysmon_susp_file_characteristics.yml
@@ -6,6 +6,7 @@ references:
     - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
 author: Markus Neis
 date: 2018/11/22
+modified: 2019/11/09
 tags:
     - attack.defense_evasion
     - attack.execution
@@ -29,4 +30,4 @@ fields:
     - ParentCommandLine
 falsepositives:
     - Unknown
-level: high
+level: medium