fix: fixed rule warning

2024-11-07 09:48:58 +00:00 · 2019-09-30 19:38:40 +02:00 · 2019-09-30 19:38:40 +02:00 · 9a7ef0e3c2
commit 9a7ef0e3c2
parent 2fbd35053e
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/process_creation/win_malware_emotet.yml
+++ b/rules/windows/process_creation/win_malware_emotet.yml
@ -10,12 +10,12 @@ logsource:
    category: process_creation
    product: windows
 detection:
-    selection1:
+    selection:
        CommandLine:
            - '* -enc PAA*'
            - '* -enco PAA*'
            - '* -encod PAA*'
-    condition: 1 of them
+    condition: selection
 fields:
    - CommandLine
    - ParentCommandLine