Skip to content

Commit 07d552a

Browse files
Update lateral_movement_scheduled_task_target.toml to fix null values
Update lateral_movement_scheduled_task_target.toml to fix null values
1 parent c724631 commit 07d552a

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/windows/lateral_movement_scheduled_task_target.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ query = '''
6868
sequence by host.id, process.entity_id with maxspan = 1m
6969
[network where host.os.type == "windows" and process.name : "svchost.exe" and
7070
network.direction : ("incoming", "ingress") and source.port >= 49152 and destination.port >= 49152 and
71-
source.ip != "127.0.0.1" and source.ip != "::1"
71+
source.ip != "127.0.0.1" and source.ip != "::1" and source.ip != null
7272
]
7373
[registry where host.os.type == "windows" and event.type == "change" and registry.value : "Actions" and
7474
registry.path : "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]

0 commit comments

Comments
 (0)