Update windows_service_created_with_suspicious_service_name.yml

patel-bhavin · web-flow · commit 74c102b8a094 · 2025-02-20T10:02:51.000-08:00
diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml
@@ -44,9 +44,6 @@ rba:
   - field: dest
     type: system
     score: 75
-  - field: user_id
-    type: user
-    score: 75
   threat_objects: 
   - field: process
     type: process
