Update win_office_spawn_exe_from_users_directory.yml

2024-11-07 17:58:52 +00:00 · 2020-10-15 18:13:29 -03:00 · 2020-10-15 18:13:29 -03:00 · aa728e91da
commit aa728e91da
parent 58f6fd4e4f
1 changed files with 7 additions and 7 deletions
--- a/rules/windows/process_creation/win_office_spawn_exe_from_users_directory.yml
+++ b/rules/windows/process_creation/win_office_spawn_exe_from_users_directory.yml
@ -19,13 +19,13 @@ logsource:
    product: windows
 detection:
    selection:
-        ParentImage:
-            - '*\WINWORD.EXE'
-            - '*\EXCEL.EXE'
-            - '*\POWERPNT.exe'
-            - '*\MSPUB.exe'
-            - '*\VISIO.exe'
-            - '*\OUTLOOK.EXE'
+        ParentImage|endswith:
+            - '\WINWORD.EXE'
+            - '\EXCEL.EXE'
+            - '\POWERPNT.exe'
+            - '\MSPUB.exe'
+            - '\VISIO.exe'
+            - '\OUTLOOK.EXE'
        Image:
            - 'C:\users\\*.exe'
    condition: selection