Update win_mal_ryuk.yml

2024-11-07 09:48:58 +00:00 · 2020-10-27 22:47:41 -03:00 · 2020-10-27 22:47:41 -03:00 · 266109f3d8
commit 266109f3d8
parent 514f9ccd28
1 changed files with 3 additions and 2 deletions
--- a/rules/windows/malware/win_mal_ryuk.yml
+++ b/rules/windows/malware/win_mal_ryuk.yml
@ -11,8 +11,9 @@ logsource:
    product: windows
 detection:
    selection:
-        ProcessName|contains:
-            - 'net.exe'
+        ProcessName|endswith:
+            - '\net.exe'
+            - '\net1.exe'
        CommandLine|contains|all:
            - 'stop'
        CommandLine|contains: