Skip to content

Commit 6ac278d

Browse files
Samirbousw0rk3r
andauthored
[tuning] Connection to Commonly Abused Web Services (#3901)
* Update command_and_control_common_webservices.toml * Update command_and_control_common_webservices.toml --------- Co-authored-by: Jonhnathan <[email protected]>
1 parent 1384742 commit 6ac278d

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

rules/windows/command_and_control_common_webservices.toml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/04"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2024/05/21"
5+
updated_date = "2024/07/16"
66

77
[transform]
88
[[transform.osquery]]
@@ -217,7 +217,9 @@ network where host.os.type == "windows" and network.protocol == "dns" and
217217
"*.zulipchat.com",
218218
"webhook.site",
219219
"run.mocky.io",
220-
"mockbin.org") and
220+
"mockbin.org",
221+
"www.googleapis.com",
222+
"googleapis.com") and
221223
222224
/* Insert noisy false positives here */
223225
not (

0 commit comments

Comments
 (0)