Skip to content

Conversation

@nasbench
Copy link
Contributor

@nasbench nasbench commented Jan 20, 2026

This PRs aims to fix a couple of the reported issues. Details are below

Updated Analytics [36]

  • Executables Or Script Creation In Suspicious Path - Removed temp path from this detection as it does not fit. Instead moved it to Executables Or Script Creation In Temp Path, I have also increased the risk score to 30 and enhanced a bit of the metadata.
  • Executables Or Script Creation In Temp Path - Added a generic filter for __PSScriptPolicyTest_ to reduce FP. And reduced the score to 5. Since this will produce a lot of FPs, because of the .exe, .dll extensions from some installers.
  • Linux Ingress Tool Transfer with Curl - Added an optimization where we add a filter condition for the flag in the tstats to reduce the search scope later on with the regex.
  • Process Creating LNK file in Suspicious Location - Changed this to an Anomaly and added multiple default filters to reduce noise. Since the rule is looking for any shortcut creation in the users folders, this could be super noisy. Especially for files located in \Users\Public, \Desktop, \Downloads, etc. I have also reduced the risk score to reflect this and added missing TO.
  • Suspicious Curl Network Connection - Fixed a bug where the commandline was missing wildcards.
  • Windows Registry Delete Task SD - Fixed a bug where the logic was looking for modifications, which is outside the scope of the detection (according to the metadata/title). Also the previous action and value filters were incorrect.
  • Fix the data for all the Cisco Secure Firewall detections.
  • PaperCut NG Remote Web Access Attempt - Removed the /app endpoint from the logic due to high FP report from community.

Breaking Change [1]

  • Process Creating LNK file in Suspicious Location - Changing this to an Anomaly means it will not produce a finding anymore but only a IF.

@nasbench nasbench added this to the v5.21.0 milestone Jan 20, 2026
@nasbench nasbench linked an issue Jan 20, 2026 that may be closed by this pull request
@nasbench nasbench linked an issue Jan 23, 2026 that may be closed by this pull request
@nasbench nasbench marked this pull request as ready for review January 23, 2026 18:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

1 participant