valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: keyword expression in rule

Browse Source
This commit is contained in:
Florian Roth 2020-02-29 16:03:31 +01:00
parent 15a400ac51
commit 19d383989c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/windows/builtin/win_vul_cve_2020_0688.yml
View File

@ -17,8 +17,8 @@ detection:
EventID: 4 EventID: 4
Source: MSExchange Control Panel Source: MSExchange Control Panel
Level: Error Level: Error
selection2|contains: selection2:
- '&__VIEWSTATE=' - '*&__VIEWSTATE=*'
condition: selection1 and selection2 condition: selection1 and selection2
falsepositives: falsepositives:
- Unknown - Unknown