Remove some more extra fields from new ymls

splunk · Jul 30, 2024 · 96572cd · 96572cd
1 parent b2d4fd3
commit 96572cd
Show file tree

Hide file tree

Showing 7 changed files with 1 addition and 8 deletions.
diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml
@@ -58,7 +58,6 @@ tags:
   - displayName
   - gPCFileSysPath
   - dcName
-  risk_score: 50
   security_domain: endpoint
 tests:
 - name: True Positive Test

diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml
@@ -56,7 +56,6 @@ tags:
   - displayName
   - gPCFileSysPath
   - dcName
-  risk_score: 50
   security_domain: endpoint
 tests:
 - name: True Positive Test

diff --git a/detections/endpoint/windows_esx_admins_group_creation_security_event.yml b/detections/endpoint/windows_esx_admins_group_creation_security_event.yml
@@ -59,7 +59,6 @@ tags:
   - SubjectUserName
   - SubjectDomainName
   - Computer
-  risk_score: 25
   security_domain: endpoint
   cve:
   - CVE-2024-37085

diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml
@@ -59,7 +59,6 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.original_file_name
-  risk_score: 56
   security_domain: endpoint
   cve:
   - CVE-2024-37085

diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml
@@ -52,7 +52,6 @@ tags:
   - ScriptBlockText
   - Computer
   - UserID
-  risk_score: 56
   security_domain: endpoint
 tests:
 - name: True Positive Test

diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml
@@ -54,7 +54,6 @@ tags:
   - Registry.registry_path
   - Registry.registry_value_name
   - Registry.registry_value_data
-  risk_score: 100
   security_domain: endpoint
   cve: []
 tests:

diff --git a/detections/endpoint/windows_privileged_group_modification.yml b/detections/endpoint/windows_privileged_group_modification.yml
@@ -3,7 +3,7 @@ id: b8cbef2c-2cc3-4550-b0fc-9715b7852df9
 version: 1
 date: '2024-07-30'
 author: Brandon Sternfield, Optiv + ClearShark
-data_sources:
+data_source:
 - Windows Event Log Security 4727
 - Windows Event Log Security 4731
 - Windows Event Log Security 4744
@@ -79,7 +79,6 @@ tags:
   - result
   - status
   - _time
-  risk_score: 80
   security_domain: endpoint
   cve:
   - CVE-2024-37085