Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PRs aims to fix a couple of the reported issues. Details are below
Updated Analytics [36]
Executables Or Script Creation In Suspicious Path- Removedtemppath from this detection as it does not fit. Instead moved it toExecutables Or Script Creation In Temp Path, I have also increased the risk score to30and enhanced a bit of the metadata.Executables Or Script Creation In Temp Path- Added a generic filter for__PSScriptPolicyTest_to reduce FP. And reduced the score to5. Since this will produce a lot of FPs, because of the.exe,.dllextensions from some installers.Linux Ingress Tool Transfer with Curl- Added an optimization where we add a filter condition for the flag in the tstats to reduce the search scope later on with the regex.Process Creating LNK file in Suspicious Location- Changed this to anAnomalyand added multiple default filters to reduce noise. Since the rule is looking for any shortcut creation in the users folders, this could be super noisy. Especially for files located in\Users\Public,\Desktop,\Downloads, etc. I have also reduced the risk score to reflect this and added missing TO.Suspicious Curl Network Connection- Fixed a bug where the commandline was missing wildcards.Windows Registry Delete Task SD- Fixed a bug where the logic was looking for modifications, which is outside the scope of the detection (according to the metadata/title). Also the previousactionandvaluefilters were incorrect.Cisco Secure Firewalldetections.PaperCut NG Remote Web Access Attempt- Removed the/appendpoint from the logic due to high FP report from community.Breaking Change [1]
Process Creating LNK file in Suspicious Location- Changing this to anAnomalymeans it will not produce a finding anymore but only a IF.