From 4205bb22277bfe95320a1a2d3ae21174bd4c968d Mon Sep 17 00:00:00 2001
From: Nikita Nazarov <61659062+NikitaStormwind@users.noreply.github.com>
Date: Fri, 9 Oct 2020 16:30:18 +0300
Subject: [PATCH] Update win_invoke_obfuscation_via_use_mhsta.yml

---
 .../process_creation/win_invoke_obfuscation_via_use_mhsta.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/win_invoke_obfuscation_via_use_mhsta.yml b/rules/windows/process_creation/win_invoke_obfuscation_via_use_mhsta.yml
index dc991411..cec51806 100644
--- a/rules/windows/process_creation/win_invoke_obfuscation_via_use_mhsta.yml
+++ b/rules/windows/process_creation/win_invoke_obfuscation_via_use_mhsta.yml
@@ -16,7 +16,7 @@ logsource:
     product: windows
 detection:
     selection:
-        - CommandLine|re: '(?i).*downloadstring&&.*mshta.*powershell.*\(window.close\).*"'
+        - CommandLine|re: '(?i).*(set).*(&&).*(mshta).*(vbscript:createobject).*(\.run).*\(window\.close\).*"'
     condition: selection
 falsepositives:
     - Unknown