Skip to content

Commit 54eba76

Browse files
committed
Update defense_evasion_process_termination_followed_by_deletion.toml
1 parent 922915c commit 54eba76

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

rules/windows/defense_evasion_process_termination_followed_by_deletion.toml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/04"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/02/03"
5+
updated_date = "2025/12/11"
66

77
[transform]
88
[[transform.osquery]]
@@ -42,10 +42,10 @@ from = "now-9m"
4242
index = ["logs-endpoint.events.process-*", "logs-endpoint.events.file-*"]
4343
language = "eql"
4444
license = "Elastic License v2"
45-
name = "Process Termination followed by Deletion"
45+
name = "Deprecated - Process Termination followed by Deletion"
4646
note = """## Triage and analysis
4747
48-
### Investigating Process Termination followed by Deletion
48+
### Investigating Deprecated - Process Termination followed by Deletion
4949
5050
This rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.
5151

0 commit comments

Comments
 (0)