From 13b6bc0dfe393dd285daeaf91e4dfd1cf34af9a3 Mon Sep 17 00:00:00 2001 From: dhruvak001 Date: Mon, 3 Feb 2025 23:28:19 +0530 Subject: [PATCH] reverting changes --- .../windows-file-protection/bypass-windows-file-protection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml index e6ccaa07..65614828 100644 --- a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml +++ b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml @@ -6,7 +6,7 @@ rule: - michael.hunhoff@mandiant.com scopes: static: function - dynamic: thread + dynamic: span of calls mbc: - Defense Evasion::Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007] examples: