From e65777a6055ed0dde47f588dd78a4cf3567d07fa Mon Sep 17 00:00:00 2001
From: taylor_socfortress <111797488+taylorwalton@users.noreply.github.com>
Date: Tue, 7 Mar 2023 07:58:47 -0600
Subject: [PATCH] Update and rename 91550-win_autoruns_rules.xml to
 100050-win_autoruns_rules.xml

---
 ...utoruns_rules.xml => 100050-win_autoruns_rules.xml} | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 rename Windows Autoruns/{91550-win_autoruns_rules.xml => 100050-win_autoruns_rules.xml} (84%)

diff --git a/Windows Autoruns/91550-win_autoruns_rules.xml b/Windows Autoruns/100050-win_autoruns_rules.xml
similarity index 84%
rename from Windows Autoruns/91550-win_autoruns_rules.xml
rename to Windows Autoruns/100050-win_autoruns_rules.xml
index 7a33fa2..98a6b03 100644
--- a/Windows Autoruns/91550-win_autoruns_rules.xml	
+++ b/Windows Autoruns/100050-win_autoruns_rules.xml	
@@ -1,5 +1,5 @@
 <group name="windows,">
-<rule id="91550" level="10">
+<rule id="100050" level="10">
   <decoded_as>json</decoded_as>
   <field name="Entry">\.+</field>
   <field name="EntryLocation">\.+</field>
@@ -10,8 +10,8 @@
   <options>no_full_log</options>
   <group>windows_autoruns,</group>
 </rule>
-<rule id="91551" level="10">
-  <if_sid>91550</if_sid>
+<rule id="100051" level="10">
+  <if_sid>100050</if_sid>
   <field name="VTdetection">Unknown</field>
   <description>Windows Autoruns - VirusTotal Unknown Signature</description>
   <mitre>
@@ -20,8 +20,8 @@
   <options>no_full_log</options>
   <group>windows_autoruns,</group>
 </rule>
-<rule id="91552" level="12">
-  <if_sid>91550</if_sid>
+<rule id="100052" level="12">
+  <if_sid>100050</if_sid>
   <field name="VTdetection">^\d\d\|</field>
   <description>Windows Autoruns - VirusTotal Hit Above 10 Matches</description>
   <mitre>