Update sysmon_susp_download_run_key.yml

2024-11-07 17:58:52 +00:00 · 2020-10-15 20:07:53 -03:00 · 2020-10-15 20:07:53 -03:00 · 17ade8e5f5
commit 17ade8e5f5
parent 6fc6409c7f
1 changed files with 5 additions and 5 deletions
--- a/rules/windows/registry_event/sysmon_susp_download_run_key.yml
+++ b/rules/windows/registry_event/sysmon_susp_download_run_key.yml
@ -16,11 +16,11 @@ logsource:
    product: windows
 detection:
    selection:
-        Image: 
-            - '*\Downloads\\*'
-            - '*\Temporary Internet Files\Content.Outlook\\*'
-            - '*\Local Settings\Temporary Internet Files\\*'
-        TargetObject: '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*'
+        Image|contains: 
+            - '\Downloads\\'
+            - '\Temporary Internet Files\Content.Outlook\\'
+            - '\Local Settings\Temporary Internet Files\\'
+        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\'
    condition: selection
 falsepositives:
    - Software installers downloaded and used by users