Closed gnordli closed 1 year ago
In Wazuh 4.4 92204 is for powershell creating executables, but 92213 is for any process to create an executable. Maybe it could be 92204,92213 to cover off both scenarios. Even level 8 may be high for this type of activity.
In Wazuh 4.4 92204 is for powershell creating executables, but 92213 is for any process to create an executable. Maybe it could be92204,92213 to cover off both scenarios. Even level 8 may be high for this type of activity.