fix rule logic

2024-11-07 01:45:21 +00:00 · 2020-10-21 18:25:22 +03:00 · 2020-10-21 18:25:22 +03:00 · 7227ed0721
commit 7227ed0721
parent f75654a3f5
1 changed files with 7 additions and 5 deletions
--- a/rules/linux/macos_binary_padding.yml
+++ b/rules/linux/macos_binary_padding.yml
@ -13,15 +13,17 @@ logsource:
    category: process_creation
 detection:
    selection1:
-        CommandLine|contains|all:
-             - 'truncate'
+        ProcessName|endswith:
+             - '/truncate'
+        CommandLine|contains:
             - '-s'
    selection2:
-        CommandLine|contains|all:
-             - 'dd'
+        ProcessName|endswith:
+             - '/dd'
+        CommandLine|contains:
             - 'if='
    filter:
-        keywords|contains: 'of='
+        CommandLine|contains: 'of='
    condition: selection1 or (selection2 and not filter)
 falsepositives:
    - 'Legitimate script work'