Update sysmon_susp_powershell_rundll32.yml

2024-11-08 02:08:54 +00:00 · 2020-10-15 20:14:23 -03:00 · 2020-10-15 20:14:23 -03:00 · 92aaeca075
commit 92aaeca075
parent 26b36086c7
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/sysmon/sysmon_susp_powershell_rundll32.yml
+++ b/rules/windows/sysmon/sysmon_susp_powershell_rundll32.yml
@ -12,8 +12,8 @@ logsource:
 detection:
    selection:
        EventID: 8
-        SourceImage: '*\powershell.exe'
-        TargetImage: '*\rundll32.exe'
+        SourceImage|endswith: '\powershell.exe'
+        TargetImage|endswith: '\rundll32.exe'
    condition: selection
 tags:
    - attack.defense_evasion