Update sysmon_susp_office_kerberos_dll_load.yml

2024-11-07 17:58:52 +00:00 · 2020-02-25 09:23:52 -05:00 · 2020-02-25 09:23:52 -05:00 · 4c5d489428
commit 4c5d489428
parent f92e2f2b18
1 changed files with 5 additions and 5 deletions
--- a/rules/windows/sysmon/sysmon_susp_office_kerberos_dll_load.yml
+++ b/rules/windows/sysmon/sysmon_susp_office_kerberos_dll_load.yml
@ -16,12 +16,12 @@ detection:
    selection:
        EventID: 7
        Image:
-            - '*\winword.exe'
-            - '*\powerpnt.exe'
-            - '*\excel.exe'
-            - '*\outlook.exe'
+            - '*\winword.exe*'
+            - '*\powerpnt.exe*'
+            - '*\excel.exe*'
+            - '*\outlook.exe*'
        ImageLoaded:
-            - '*kerberos.dll*'
+            - '*\kerberos.dll*'
    condition: selection
 falsepositives:
    - Alerts on legitimate macro usage as well, will need to filter as appropriate