fix: fixed duplicate element in new double extension rule

2024-11-08 02:08:54 +00:00 · 2019-06-26 16:00:58 +02:00 · 2019-06-26 16:00:58 +02:00 · 708f3ef002
commit 708f3ef002
parent 41dc076959
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/process_creation/win_susp_double_extension.yml
+++ b/rules/windows/process_creation/win_susp_double_extension.yml
@ -22,9 +22,9 @@ detection:
            - '*.pptx.*'
            - '*.rtf.*'
            - '*.pdf.*'
+            - '*.txt.*'
            - '*      .*'
            - '*______.*'
-            - '*.pdf.*'
    selection_exe:
        Image:
            - '*.exe'