Update crowdstrike.py

SigmaHQ · Sep 14, 2024 · b306ed6 · b306ed6
1 parent 1fdd29d
commit b306ed6
Showing 1 changed file with 0 additions and 13 deletions.
diff --git a/sigma/pipelines/crowdstrike/crowdstrike.py b/sigma/pipelines/crowdstrike/crowdstrike.py
@@ -448,19 +448,6 @@ def common_processing_items():
             ],
             field_name_condition_linking=any,
         ),
-        # ImageFileName full path handling with contains
-        # ProcessingItem(
-        #     identifier="cql_imagefilename_replace_disk_name_contains",
-        #     transformation=ReplaceStringTransformation(
-        #         regex="^\\*[C-Z]:", replacement="*\\\\Device\\\\HarddiskVolume?\\\\"
-        #     ),
-        #     field_name_conditions=[
-        #         IncludeFieldCondition(fields=["ImageFileName"]),
-        #         IncludeFieldCondition(fields=["TargetImageFileName"]),
-        #     ],
-        #     field_name_condition_linking=any,
-        # ),
-        # ImageFileName starting with colon handling
         ProcessingItem(
             identifier="cql_imagefilename_replace_disk_name",
             transformation=ReplaceStringTransformation(regex=":", replacement=""),