Merge pull request #296 from Karneades/patch-1

Remove backslashes in CommandLine for sticky key rule
2024-11-07 17:58:52 +00:00 · 2019-04-03 19:44:02 +02:00 · 2019-04-03 19:44:02 +02:00 · 13f86e9333
commit 13f86e9333
parent b4b7d810fc 865d971704
1 changed files with 6 additions and 6 deletions
--- a/rules/windows/sysmon/sysmon_stickykey_like_backdoor.yml
+++ b/rules/windows/sysmon/sysmon_stickykey_like_backdoor.yml
@ -39,9 +39,9 @@ detection:
        ParentImage:
            - '*\winlogon.exe'
        CommandLine:
-            - '*\cmd.exe sethc.exe *'
-            - '*\cmd.exe utilman.exe *'
-            - '*\cmd.exe osk.exe *'
-            - '*\cmd.exe Magnify.exe *'
-            - '*\cmd.exe Narrator.exe *'
-            - '*\cmd.exe DisplaySwitch.exe *'
+            - '*cmd.exe sethc.exe *'
+            - '*cmd.exe utilman.exe *'
+            - '*cmd.exe osk.exe *'
+            - '*cmd.exe Magnify.exe *'
+            - '*cmd.exe Narrator.exe *'
+            - '*cmd.exe DisplaySwitch.exe *'