Update sysmon_lsass_memory_dump_file_creation.yml

rules/windows/sysmon/sysmon_lsass_memory_dump_file_creation.yml

@@ -4,6 +4,7 @@ author: Teymur Kheirkhabarov, oscd.community
 references:
     - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
 date: 2019/10/22
+modified: 2019/11/13
 tags:
     - attack.credential_access
     - attack.t1003
@@ -13,9 +14,8 @@ logsource:
 detection:
     selection:
         EventID: 11
-        TargetFilename|all:
-            - "*lsass*"
-            - "*dmp"
+        TargetFilename|contains: 'lsass'
+        TargetFilename|endswith: 'dmp'
     condition: selection
 falsepositives:
     - Dumping lsass memory for forensic investigation purposes by legitimate incident responder or forensic invetigator