Update sysmon_quarkspw_filedump.yml

2024-11-08 02:08:54 +00:00 · 2020-10-27 22:02:47 -03:00 · 2020-10-27 22:02:47 -03:00 · 182b12614b
commit 182b12614b
parent dde5b46726
1 changed files with 3 additions and 1 deletions
--- a/rules/windows/file_event/sysmon_quarkspw_filedump.yml
+++ b/rules/windows/file_event/sysmon_quarkspw_filedump.yml
@ -18,7 +18,9 @@ logsource:
 detection:
    selection:
        # Sysmon: File Creation (ID 11)
-        TargetFilename|contains: '\AppData\Local\Temp\SAM-*.dmp'
+        TargetFilename|contains|all: 
+            - '\AppData\Local\Temp\SAM-'
+            - '.dmp'
    condition: selection
 falsepositives:
    - Unknown