Fix

2024-11-07 09:48:58 +00:00 · 2020-10-15 20:24:31 -03:00 · 2020-10-15 20:24:31 -03:00 · 345c3c6451
commit 345c3c6451
parent 86ade194a4
1 changed files with 3 additions and 3 deletions
--- a/rules/windows/malware/av_relevant_files.yml
+++ b/rules/windows/malware/av_relevant_files.yml
@ -16,8 +16,8 @@ detection:
            - 'C:\PerfLogs\\'
            - 'C:\Users\Public\\'
            - 'C:\Users\Default\\'
-        Filename|contains:
-            - '\\Client\\'
+            - '*\\Client\\'
+    selection2:
        Filename|endswith:
            - '.ps1'
            - '.vbs'
@ -38,7 +38,7 @@ detection:
            - '.vbe'
            - '.wsf'
            - '.wsh'
-    condition: selection
+    condition: selection or selection2
 fields:
    - Signature
    - User