Update action.py

huoji120 · Aug 9, 2022 · 8d2b7e7 · 8d2b7e7
1 parent db01aea
commit 8d2b7e7
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/Server/rules/py/action.py b/Server/rules/py/action.py
@@ -17,7 +17,7 @@
         'rules': [
             'action == "processaccess" and calltrace =~ ".*unknown.*" and not calltrace =~ ".*java\.dll.*" and not calltrace =~ ".*appvisvsubsystems64\.dll.*" and not calltrace =~ ".*twinui\.dll.*" and not calltrace =~ ".*nativeimages.*"',
         ],
-        'score': 100,
+        'score': 60,
         'name': '异常进程访问'
     },
     {
@@ -35,7 +35,7 @@
             'action == "processaccess" and calltrace =~ ".*kernelbase\.dll\+de67e.*"',
             'action == "processaccess" and calltrace =~ ".*framedynos\.dll.*"',
         ],
-        'score': 100,
+        'score': 40,
         'name': '不正常的进程访问'
     },
     {