Update PulseConnectSecureVPN-PasswordSpray.yaml

Renaming the detection query for better quality to indicate that the detection is based of PulseConnectSecure  logs.
This commit is contained in:
aprakash13 2020-09-17 11:14:19 -07:00 коммит произвёл GitHub
Родитель 44257b18f4
Коммит da7ad0bfdf
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -1,5 +1,5 @@
id: 1fa1528e-f746-4794-8a41-14827f4cb798
name: Potential Password Spray Attempts
name: PulseConnectSecure - Potential Password Spray Attempts
description: |
'This query identifies evidence of potential password spray activity against the Pulse Secure VPN server,
by looking for failures from multiple accounts, originating from the same host within a time window'