Merge pull request #3020 from Sims24/typo-non_chrome_process_accessin…

…g_chrome_default_dir Minor typo in non_chrome_process_accessing_chrome_default_dir.yml - s/firefox/chrome
splunk · Jul 23, 2024 · de0f890 · de0f890
2 parents eac3b61 + 007c471
commit de0f890
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -23,7 +23,7 @@ search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.e
 how_to_implement: To successfully implement this search, you must ingest Windows Security
   Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
   Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: other browser not listed related to firefox may catch by this
+known_false_positives: other browser not listed related to chrome may catch by this
   rule.
 references: []
 tags: