We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent ba55fb4 commit 718b64fCopy full SHA for 718b64f
rules/windows/execution_downloaded_url_file.toml
@@ -2,7 +2,7 @@
2
creation_date = "2020/09/02"
3
integration = ["endpoint"]
4
maturity = "production"
5
-updated_date = "2025/01/15"
+updated_date = "2025/06/11"
6
7
[rule]
8
author = ["Elastic"]
@@ -31,7 +31,7 @@ type = "eql"
31
32
query = '''
33
file where host.os.type == "windows" and event.type == "creation" and file.extension == "url"
34
- and file.Ext.windows.zone_identifier > 1 and not process.name : "explorer.exe"
+ and file.Ext.windows.zone_identifier == 3
35
'''
36
note = """## Triage and analysis
37
0 commit comments