# 2610490 FP's

**URL:** <https://community.emergingthreats.net/t/2610490-fps/1320>\
**Category:** Rule Signatures\
**Created:** [January 25, 2024, 3:30pm UTC](https://community.emergingthreats.net/t/2610490-fps/1320 "2024-01-25T15:30:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/james_inthe_box/32/830_2.png) [@James\_inthe\_box](https://community.emergingthreats.net/u/James_inthe_box)\
**Post date:** [January 25, 2024, 3:30pm UTC](https://community.emergingthreats.net/t/2610490-fps/1320/1 "2024-01-25T15:30:57Z")

</div>

This rule needs some tuning…falsing fairly often.  
[1:2610490:2] TGI HUNT PowerShell Execution String Base64 Encoded New-Object (ctT2J) [\*\*] [Classification: Attempted Administrator Privilege Gain] [Priority: 1]

---

<div class="post-metadata">

**Author:** ![tgreen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/tgreen/32/22_2.png) [@tgreen](https://community.emergingthreats.net/u/tgreen)\
**Post date:** [January 25, 2024, 5:09pm UTC](https://community.emergingthreats.net/t/2610490-fps/1320/2 "2024-01-25T17:09:59Z")

</div>

Hi James, that one is from my (non ET) rules, fixed [here](https://github.com/travisbgreen/hunting-rules/commit/343d8f4debaa22ece28adf881f1b02812bb04390)

Thanks for the feedback!

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/james_inthe_box/32/830_2.png) [@James\_inthe\_box](https://community.emergingthreats.net/u/James_inthe_box)\
**Post date:** [January 25, 2024, 5:22pm UTC](https://community.emergingthreats.net/t/2610490-fps/1320/3 "2024-01-25T17:22:38Z")

</div>

Well hey there Travis, long time no chat 🙂 Thanks for the fix!