Skip to content

Commit 3bcacdb

Browse files
theusername-sudoSamirbousw0rk3r
authored
Update lateral_movement_scheduled_task_target.toml to fix null values (#5228)
Co-authored-by: Samirbous <[email protected]> Co-authored-by: Jonhnathan <[email protected]>
1 parent e79629f commit 3bcacdb

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

rules/windows/lateral_movement_scheduled_task_target.toml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/20"
33
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/08/28"
5+
updated_date = "2025/12/08"
66

77
[rule]
88
author = ["Elastic"]
@@ -68,7 +68,7 @@ query = '''
6868
sequence by host.id, process.entity_id with maxspan = 1m
6969
[network where host.os.type == "windows" and process.name : "svchost.exe" and
7070
network.direction : ("incoming", "ingress") and source.port >= 49152 and destination.port >= 49152 and
71-
source.ip != "127.0.0.1" and source.ip != "::1"
71+
source.ip != "127.0.0.1" and source.ip != "::1" and source.ip != null
7272
]
7373
[registry where host.os.type == "windows" and event.type == "change" and registry.value : "Actions" and
7474
registry.path : "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]

0 commit comments

Comments
 (0)