Update win_hack_koadic.yml

2024-11-07 17:58:52 +00:00 · 2020-10-15 17:53:44 -03:00 · 2020-10-15 17:53:44 -03:00 · 0b52f14639
commit 0b52f14639
parent f44eb6345c
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/process_creation/win_hack_koadic.yml
+++ b/rules/windows/process_creation/win_hack_koadic.yml
@ -21,8 +21,8 @@ logsource:
    product: windows
 detection:
    selection1:
-        CommandLine:
-            - '*cmd.exe* /q /c chcp *'
+        CommandLine|contains:
+            - 'cmd.exe* /q /c chcp '
    condition: selection1
 fields:
    - CommandLine