Update powershell_prompt_credentials.yml

2024-11-07 17:58:52 +00:00 · 2020-10-15 17:13:16 -03:00 · 2020-10-15 17:13:16 -03:00 · 013533fceb
commit 013533fceb
parent 8cf2596068
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/powershell/powershell_prompt_credentials.yml
+++ b/rules/windows/powershell/powershell_prompt_credentials.yml
@ -20,8 +20,8 @@ detection:
    selection:
        EventID: 4104
    keyword:
-        Message:
-            - '*PromptForCredential*'
+        Message|contains:
+            - 'PromptForCredential'
    condition: all of them
 falsepositives:
    - Unknown