WMI persistence modified

wilsonleeee · Aug 24, 2017 · f46e86f · f46e86f
1 parent 783722e
commit f46e86f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/windows/other/win_wmi_persistence.yml b/rules/windows/other/win_wmi_persistence.yml
@@ -1,6 +1,6 @@
 title: WMI Persistence
 status: experimental
-description: Detects suspicious WMI event filter and command line event consumer based on event id 5861 (Windows 10)
+description: Detects suspicious WMI event filter and command line event consumer based on event id 5861 (Windows 10, 2012 and higher)
 author: Florian Roth
 reference: https://twitter.com/mattifestation/status/899646620148539397
 logsource:
@@ -17,3 +17,4 @@ detection:
 falsepositives:
     - Unknown (data set is too small; further testing needed)
 level: high
+