Update win_apt_bear_activity_gtr19.yml

rules/windows/process_creation/win_apt_bear_activity_gtr19.yml

@@ -18,10 +18,19 @@ logsource:
 detection:
     selection1:
         Image|endswith: '\xcopy.exe'
-        CommandLine|contains: '/S /E /C /Q /H \\'
+        CommandLine|contains|all: 
+            - '/S'
+            - '/E' 
+            - '/C' 
+            - '/Q' 
+            - '/H' 
+            - '\\'
     selection2:
         Image|endswith: '\adexplorer.exe'
-        CommandLine|contains: ' -snapshot "" c:\users\\'
+        CommandLine|contains|all: 
+            - '-snapshot' 
+            - '""' 
+            - 'c:\users\\'
     condition: selection1 or selection2
 falsepositives:
     - unknown