Update win_susp_local_anon_logon_created.yml

2024-11-08 02:08:54 +00:00 · 2020-10-27 22:00:42 -03:00 · 2020-10-27 22:00:42 -03:00 · 61ccdc598d
commit 61ccdc598d
parent 3eea825898
1 changed files with 3 additions and 1 deletions
--- a/rules/windows/builtin/win_susp_local_anon_logon_created.yml
+++ b/rules/windows/builtin/win_susp_local_anon_logon_created.yml
@ -18,7 +18,9 @@ logsource:
 detection:
    selection:
        EventID: 4720
-        SAMAccountName|contains: 'ANONYMOUS*LOGON'
+        SAMAccountName|contains|all: 
+            - 'ANONYMOUS'
+            - 'LOGON'
    condition: selection
 falsepositives:
    - Unknown