refactor: adjusted Sigma rule to Raccine 1.4

gabrielbasetti · Nov 14, 2020 · 40e0ee1 · 40e0ee1
1 parent 20ccfc6
commit 40e0ee1
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/sigma/win_raccine_block.yml b/sigma/win_raccine_block.yml
@@ -2,6 +2,7 @@ title: Raccine Blocked Malicious Activity
 id: ce1ae413-3a83-4424-a61d-25827480c173
 description: Detects Raccine blocking the execution of an executable that has been invoked with parameters that are on the blocklist
 date: 2020/10/17
+modified: 2020/11/14
 author: Florian Roth, John Lambert
 references:
     - https://github.com/Neo23x0/Raccine
@@ -16,6 +17,7 @@ detection:
     selection:
         Source: Raccine
         EventID: 2
+        Level: Warning
     condition: selection
 falsepositives:
     - Backup software triggering the blocks by accessing the volume shadow copies