Update win_netsh_port_fwd.yml

2024-11-08 02:08:54 +00:00 · 2020-11-27 15:57:53 -03:00 · 2020-11-27 15:57:53 -03:00 · 5acd8d622b
commit 5acd8d622b
parent 9171d8913c
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/process_creation/win_netsh_port_fwd.yml
+++ b/rules/windows/process_creation/win_netsh_port_fwd.yml
@ -17,8 +17,8 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine:
-            - netsh interface portproxy add v4tov4 *
+        CommandLine|startswith:
+            - 'netsh interface portproxy add v4tov4'
    condition: selection
 falsepositives:
    - Legitimate administration