t1020 | LoFP

t1020

Title	Tags
benign changes to a db instance	t1020 aws sigma
false positives should be limited as this analytic identifies renamed instances of `rclone.exe`. filter as needed if there is a legitimate business use case.	t1020 endpoint splunk
false positives should be limited as this is restricted to the rclone process name. filter or tune the analytic as needed.	t1020 endpoint splunk
the same functionality can be implemented by admin scripts, correlate with name and creator	t1020 windows sigma
this search will return false positives for any legitimate traffic captures by network administrators.	t1020 T1020.001 t1200 t1498 infrastructure splunk
traffic mirroring may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. traffic mirroring from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1020 t1074 aws elastic