Update sysmon_stickykey_like_backdoor.yml

rules/windows/registry_event/sysmon_stickykey_like_backdoor.yml

@@ -12,9 +12,9 @@ tags:
     - attack.t1546.008
     - car.2014-11-003
     - car.2014-11-008
-author: Florian Roth, @twjackomo, Jonhnathan Ribeiro
+author: Florian Roth, @twjackomo, Jonhnathan Ribeiro, oscd.community
 date: 2018/03/15
-modified: 2020/09/06    
+modified: 2020/11/28
 falsepositives:
     - Unlikely
 level: critical
@@ -39,10 +39,8 @@ logsource:
     product: windows
 detection:
     selection_process:
-        ParentImage|endswith:
-            - '\winlogon.exe'
-        Image|contains|all:
-            - 'cmd.exe'
+        ParentImage|endswith: '\winlogon.exe'
+        Image|endswith: '\cmd.exe'
         CommandLine|contains:
             - 'sethc.exe'
             - 'utilman.exe'