Update sysmon_invoke_phantom.yml

2024-11-07 09:48:58 +00:00 · 2020-11-20 01:30:58 -03:00 · 2020-11-20 01:30:58 -03:00 · 2194744803
commit 2194744803
parent 4af7f00f4a
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/process_access/sysmon_invoke_phantom.yml
+++ b/rules/windows/process_access/sysmon_invoke_phantom.yml
@ -19,8 +19,8 @@ detection:
    selection:
        TargetImage|endswith: '\windows\system32\svchost.exe'
        GrantedAccess: '0x1f3fff'
-        CallTrace:
-         - '*unknown*'
+        CallTrace|contains:
+         - 'unknown'
    condition: selection
 falsepositives:
    - unknown