Update win_malware_notpetya.yml

2024-11-07 17:58:52 +00:00 · 2020-11-27 15:29:29 -03:00 · 2020-11-27 15:29:29 -03:00 · 217dd53c62
commit 217dd53c62
parent 3410a1eece
1 changed files with 4 additions and 1 deletions
--- a/rules/windows/process_creation/win_malware_notpetya.yml
+++ b/rules/windows/process_creation/win_malware_notpetya.yml
@ -24,7 +24,9 @@ logsource:
    product: windows
 detection:
    pipe_com:
-        CommandLine|contains: '\AppData\Local\Temp\\* \\.\pipe\\'
+        CommandLine|contains|all: 
+            - '\AppData\Local\Temp\'
+            - '\\.\pipe\\'
    rundll32_dash1:
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith: '.dat,#1'
@ -37,3 +39,4 @@ fields:
 falsepositives:
    - Admin activity
 level: critical
+