Update mal_azorult_reg.yml

2024-11-07 09:48:58 +00:00 · 2020-10-27 22:18:41 -03:00 · 2020-10-27 22:18:41 -03:00 · 8f4d6f802b
commit 8f4d6f802b
parent bfb50a3d42
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/malware/mal_azorult_reg.yml
+++ b/rules/windows/malware/mal_azorult_reg.yml
@ -17,8 +17,8 @@ detection:
    EventID:
      - 12
      - 13
-    TargetObject|endswith:
-      - 'SYSTEM\\*\services\localNETService'
+    TargetObject|endswith: 'SYSTEM\
+    TargetObject|endswith: '\services\localNETService'
  condition: selection
 fields:
  - Image