Skip to content

Commit 97d694d

Browse files
committed
Update persistence_etc_file_creation.toml
1 parent 27a9016 commit 97d694d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/_deprecated/persistence_etc_file_creation.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ This rule monitors for the creation of the most common system-wide configuration
107107
108108
### False Positive Analysis
109109
110-
- If this activity is related to new benign software installation activity, consider adding exceptions preferably with a combination of user and command line conditions.
110+
- If this activity is related to new benign software installation activity, consider adding exceptions - preferably with a combination of user and command line conditions.
111111
- If this activity is related to a system administrator that performed these actions for administrative purposes, consider adding exceptions for this specific administrator user account.
112112
- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
113113

0 commit comments

Comments
 (0)