Update win_admin_rdp_login.yml

Getting rid of '*' use
2024-11-08 02:08:54 +00:00 · 2020-10-15 15:02:40 -03:00 · 2020-10-15 15:02:40 -03:00 · 085dc21d25
commit 085dc21d25
parent 9c7a23e432
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/builtin/win_admin_rdp_login.yml
+++ b/rules/windows/builtin/win_admin_rdp_login.yml
@ -23,7 +23,7 @@ detection:
        EventID: 4624
        LogonType: 10
        AuthenticationPackageName: Negotiate
-        AccountName: 'Admin-*'
+        AccountName|startswith: 'Admin-'
    condition: selection
 falsepositives:
    - Legitimate administrative activity