rule logic fix

2024-11-07 01:45:21 +00:00 · 2020-10-21 18:32:02 +03:00 · 2020-10-21 18:32:02 +03:00 · 13d84ac27b
commit 13d84ac27b
parent e0e81b5c25
1 changed files with 3 additions and 2 deletions
--- a/rules/linux/macos_find_cred_in_files.yml
+++ b/rules/linux/macos_find_cred_in_files.yml
@ -13,8 +13,9 @@ logsource:
    category: process_creation
 detection:
    selection1:
-        CommandLine|contains|all:
-          - 'grep'
+        ProcessName|endswith:
+          - '/grep'
+        CommandLine|contains:
          - 'password'
    selection2:
        CommandLine|contains: 'laZagne'