Update splunk_alert.md

2024-12-04 17:17:42 -05:00
parent faf0fae6b2
commit 865b58dd3e
1 changed files with 3 additions and 3 deletions
--- a/splunk_alert.md
+++ b/splunk_alert.md
@ -1,5 +1,5 @@
 ```
-`indextime` `sysmon` RuleName="technique_id=T1027,technique_name=Obfuscated Files or Information"
+`indextime` `sysmon` <SEARCH>
 | eval hash_sha256= lower(hash_sha256),
 hunting_trigger="",
 mitre_category="Defense_Evasion",
@ -10,8 +10,8 @@ mitre_subtechnique_id="",
 apt="",
 mitre_link="https://attack.mitre.org/techniques/T1027/",
 creator="Cpl Iverson",
-upload_date="2024/12/03",
-last_modify_date="2024/12/03",
+upload_date="FIRSTDATE",
+last_modify_date="CURRENTDATE",
 mitre_version="v16",
 priority=""
 | `process_create_whitelist`