From 1e7f00009e87e6bb58ccdcc8cd34e73cef71f78d Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Wed, 18 Dec 2024 16:03:41 +0000 Subject: [PATCH] Update rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- .../endpoint/execution_elastic_malicious_file_detected.toml | 1 - 1 file changed, 1 deletion(-) diff --git a/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml b/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml index 54b7a26f389..4cf4b8d8cb9 100644 --- a/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml +++ b/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml @@ -49,7 +49,6 @@ Files are scanned on write or deletion, process executables are scanned on execu - Other endpoint security vendors especially with their quarantine folders. - Dynamically generated or compiled executables such as from csc.exe or other compilers. Due to the dynamic nature, each instance will likely have a unique hash and no signer - ### Response and Remediation - Initiate the incident response process based on the outcome of the triage.