headless_bee

tccontre · tccontre · commit 07df5675dded · 2025-02-13T11:49:27.000+01:00
diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml
@@ -43,6 +43,7 @@ rba:
     score: 30
   - field: user
     type: user
+    score: 30
   threat_objects:
   - field: process_name
     type: process_name
diff --git a/detections/endpoint/windows_create_test_registry.yml b/detections/endpoint/windows_create_test_registry.yml
@@ -45,7 +45,7 @@ rba:
   - field: user
     type: user
     score: 60
-    threat_objects: []
+  threat_objects: []
 tags:
   analytic_story:
   - SnappyBee
