valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 10:13:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1611 from SigmaHQ/rule-devel

Browse Source 
fix: escape character that would be interpreted as wildcard
This commit is contained in:
Florian Roth 2021-07-02 23:51:49 +02:00 committed by GitHub
commit 691cf066b9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/builtin/win_exploit_cve_2021_1675_printspooler_Security.yml
View File

@ -17,7 +17,7 @@ logsource:
detection: detection:
selection: selection:
EventID: '5145' EventID: '5145'
ShareName: '\\*\IPC$' ShareName: '\\\*\IPC$'
RelativeTargetName: 'spoolss' RelativeTargetName: 'spoolss'
AccessMask: '0x3' AccessMask: '0x3'
ObjectType: 'File' ObjectType: 'File'