Update win_susp_msmpeng_crash.yml

2024-11-08 02:08:54 +00:00 · 2020-10-15 15:50:01 -03:00 · 2020-10-15 15:50:01 -03:00 · 9b8817f489
commit 9b8817f489
parent c310d72e2b
1 changed files with 3 additions and 3 deletions
--- a/rules/windows/builtin/win_susp_msmpeng_crash.yml
+++ b/rules/windows/builtin/win_susp_msmpeng_crash.yml
@ -23,9 +23,9 @@ detection:
        Source: 'Windows Error Reporting'
        EventID: 1001
    keywords:
-        Message:
-            - '*MsMpEng.exe*'
-            - '*mpengine.dll*'
+        Message|contains:
+            - 'MsMpEng.exe'
+            - 'mpengine.dll'
    condition: 1 of selection* and all of keywords
 falsepositives:
    - MsMpEng.exe can crash when C:\ is full