valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 10:13:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

added backslash for image search

Browse Source
This commit is contained in:
Ivan Dyachkov 2020-10-15 14:01:30 +03:00
parent f79342cc59
commit 787c87e032
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/process_creation/win_susp_diskshadow.yml
View File

@ -15,7 +15,7 @@ logsource:
definition: 'Requirements: Sysmon ProcessCreation logging must be activated and Windows audit msut Include command line in process creation events' definition: 'Requirements: Sysmon ProcessCreation logging must be activated and Windows audit msut Include command line in process creation events'
detection: detection:
selection: selection:
Image|endswith: 'diskshadow.exe' Image|endswith: '\diskshadow.exe'
CommandLine|contains: CommandLine|contains:
- '/s' - '/s'
condition: selection condition: selection