You are working on the SigmaHQ/pySigma repository. The source code is checked out at /testbed at commit…
You are working on the SigmaHQ/pySigma repository. The source code is checked out at /testbed at commit…: a task in SWE-Lego-RL-2699 (Harbor dataset). Use this rule: yaml title: indicator rule id: fad282fb-0499-4d3f-9670-55cfc950e2dc status: stable level: critical description: indicator rule…
The task
Use this rule: ```yaml title: indicator rule id: fad282fb-0499-4d3f-9670-55cfc950e2dc status: stable level: critical description: indicator rule logsource: product: Crowdstrike_raw detection: selection: QID: 'ProcessRollup2' Hostname: 'bitsadmin.exe' selection2: Hostname: 'bitss.exe' condition: selection or…
Part of Lego-X/Lego-RL-2699.