Add 'contains' for the ps encoded chars rule

2024-11-07 09:48:58 +00:00 · 2020-07-22 10:49:22 -04:00 · 2020-07-22 10:49:22 -04:00 · 13cf0488ae
commit 13cf0488ae
parent 9682d37ead
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/process_creation/win_susp_powershell_encoded_param.yml
+++ b/rules/windows/process_creation/win_susp_powershell_encoded_param.yml
@ -17,7 +17,7 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine: '(WCHAR)0x'
+        CommandLine|contains: '(WCHAR)0x'
    condition: selection
 falsepositives:
    - Unknown