[SIEM] Detection Fix typo in Adobe Hijack Persistence rule (#58804) (#…

…58993) Fixes #58803 Co-authored-by: Nic <nicpenning@hotmail.com>
elastic · Mar 2, 2020 · 1cf8078 · 1cf8078
1 parent ebd3f65
commit 1cf8078
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/...iem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json b/...iem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json
@@ -6,7 +6,7 @@
   "language": "kuery",
   "max_signals": 100,
   "name": "Adobe Hijack Persistence",
-  "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexeec.exe",
+  "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexec.exe",
   "risk_score": 21,
   "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86",
   "severity": "low",
@@ -32,5 +32,5 @@
     }
   ],
   "type": "query",
-  "version": 1
+  "version": 2
 }