| false positives are not expected, as the detection is based on the presence of web requests to the setupwizard.aspx page, which is not a common page to be accessed by legitimate users. note that the analytic is limited to http post and a status of 200 to reduce false positives. modify the query as needed to reduce false positives or hunt for additional indicators of compromise. | |
LoFP
/
web proxy