fix: wording

SigmaHQ · Sep 29, 2023 · 71fe6a6 · 71fe6a6
1 parent 91cbbce
commit 71fe6a6
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/rules/windows/file/file_event/file_event_win_scheduled_task_creation.yml b/rules/windows/file/file_event/file_event_win_scheduled_task_creation.yml
@@ -1,7 +1,7 @@
 title: Scheduled Task Created - FileCreation
 id: a762e74f-4dce-477c-b023-4ed81df600f9
 status: experimental
-description: Detects the creation of scheduled task.
+description: Detects the creation of a scheduled task via file creation.
 references:
     - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/
     - https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
@@ -25,5 +25,5 @@ detection:
             - ':\Windows\Tasks\'
     condition: selection
 falsepositives:
-    - Likely
+    - Normal behaviour on Windows
 level: low
diff --git a/rules/windows/registry/registry_event/registry_event_scheduled_task_creation.yml b/rules/windows/registry/registry_event/registry_event_scheduled_task_creation.yml
@@ -1,7 +1,7 @@
 title: Scheduled Task Created - Registry
 id: 93ff0ceb-e0ef-4586-8cd8-a6c277d738e3
 status: experimental
-description: Detects the creation of a scheduled task.
+description: Detects the creation of a scheduled task via Registry keys.
 references:
     - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/
     - https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
@@ -24,5 +24,5 @@ detection:
             - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
     condition: selection
 falsepositives:
-    - Likely
+    - Normal behaviour on Windows
 level: low