Update win_account_discovery.yml

Getting rid of '*' use
2024-11-08 02:08:54 +00:00 · 2020-10-15 15:01:31 -03:00 · 2020-10-15 15:01:31 -03:00 · 9c7a23e432
commit 9c7a23e432
parent fdd9234acc
1 changed files with 12 additions and 11 deletions
--- a/rules/windows/builtin/win_account_discovery.yml
+++ b/rules/windows/builtin/win_account_discovery.yml
@ -21,17 +21,18 @@ detection:
        ObjectType:
        - 'SAM_USER'
        - 'SAM_GROUP'
-        ObjectName:
-         - '*-512'
-         - '*-502'
-         - '*-500'
-         - '*-505'
-         - '*-519'
-         - '*-520'
-         - '*-544'
-         - '*-551'
-         - '*-555'
-         - '*admin*'
+        ObjectName|endswith:
+         - '-512'
+         - '-502'
+         - '-500'
+         - '-505'
+         - '-519'
+         - '-520'
+         - '-544'
+         - '-551'
+         - '-555'
+        ObjectName|contains:
+         - 'admin'
    condition: selection
 falsepositives:
    - if source account name is not an admin then its super suspicious