fix: keyword expression in rule

2024-11-07 17:58:52 +00:00 · 2020-02-29 16:03:31 +01:00 · 2020-02-29 16:03:31 +01:00 · 19d383989c
commit 19d383989c
parent 15a400ac51
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/builtin/win_vul_cve_2020_0688.yml
+++ b/rules/windows/builtin/win_vul_cve_2020_0688.yml
@ -17,8 +17,8 @@ detection:
        EventID: 4
        Source: MSExchange Control Panel
        Level: Error
-    selection2|contains:
-      - '&__VIEWSTATE='
+    selection2:
+        - '*&__VIEWSTATE=*'
    condition: selection1 and selection2
 falsepositives:
    - Unknown