Skip to content

Commit 718b64f

Browse files
authored
Update execution_downloaded_url_file.toml (#4794)
1 parent ba55fb4 commit 718b64f

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

rules/windows/execution_downloaded_url_file.toml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/09/02"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/06/11"
66

77
[rule]
88
author = ["Elastic"]
@@ -31,7 +31,7 @@ type = "eql"
3131

3232
query = '''
3333
file where host.os.type == "windows" and event.type == "creation" and file.extension == "url"
34-
and file.Ext.windows.zone_identifier > 1 and not process.name : "explorer.exe"
34+
and file.Ext.windows.zone_identifier == 3
3535
'''
3636
note = """## Triage and analysis
3737

0 commit comments

Comments
 (0)