Update win_mal_ryuk.yml

2024-11-07 09:48:58 +00:00 · 2020-10-15 16:18:14 -03:00 · 2020-10-15 16:18:14 -03:00 · 983e9cb9ae
commit 983e9cb9ae
parent 8d44548a2c
1 changed files with 7 additions and 4 deletions
--- a/rules/windows/malware/win_mal_ryuk.yml
+++ b/rules/windows/malware/win_mal_ryuk.yml
@ -11,10 +11,13 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine:
-            - '*\net.exe stop "samss" *'
-            - '*\net.exe stop "audioendpointbuilder" *'
-            - '*\net.exe stop "unistoresvc_?????" *'
+        CommandLine|contains|all:
+            - 'net.exe'
+            - 'stop'
+        CommandLine|contains:
+            - 'samss'
+            - 'audioendpointbuilder'
+            - 'unistoresvc_?????'
    condition: selection
 falsepositives:
    - Unlikely