Edited win_susp_pcwutl

2024-11-07 17:58:52 +00:00 · 2020-10-05 14:00:21 +03:00 · 2020-10-05 14:00:21 +03:00 · 815aa3c719
commit 815aa3c719
parent 39f955d24d
1 changed files with 1 additions and 3 deletions
--- a/rules/windows/process_creation/win_susp_pcwutl.yml
+++ b/rules/windows/process_creation/win_susp_pcwutl.yml
@ -18,9 +18,7 @@ logsource:
 detection:
    selection:
        Image|endswith: '\rundll32.exe'
-        CommandLine|contains|all:
-            - 'pcwutl'
-            - 'LaunchApplication'
+        CommandLine|contains: 'pcwutl*LaunchApplication'
    condition: selection
 level: medium
 falsepositives: