Remove asterisk from condition

2024-11-07 17:58:52 +00:00 · 2020-10-13 22:37:51 +03:00 · 2020-10-13 22:37:51 +03:00 · a998c9b74c
commit a998c9b74c
parent 49119e162f
1 changed files with 3 additions and 2 deletions
--- a/rules/windows/process_creation/win_susp_vboxdrvInst.yml
+++ b/rules/windows/process_creation/win_susp_vboxdrvInst.yml
@ -17,8 +17,9 @@ logsource:
 detection:
    selection:
        Image|endswith: '\VBoxDrvInst.exe'
-        CommandLine:
-            - 'driver*executeinf'
+        CommandLine|contains|all:
+            - 'driver'
+            - 'executeinf'
    condition: selection
 fields:
    - ComputerName