Update win_susp_msiexec_web_install.yml

2024-11-08 02:08:54 +00:00 · 2020-10-15 19:31:44 -03:00 · 2020-10-15 19:31:44 -03:00 · 6cd49220ad
commit 6cd49220ad
parent e8477c8afa
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/process_creation/win_susp_msiexec_web_install.yml
+++ b/rules/windows/process_creation/win_susp_msiexec_web_install.yml
@ -17,8 +17,8 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine:
-            - '* msiexec*://*'
+        CommandLine|contains:
+            - ' msiexec*://'
    condition: selection
 falsepositives:
    - False positives depend on scripts and administrative tools used in the monitored environment