Update win_apt_zxshell.yml

2024-11-07 09:48:58 +00:00 · 2020-07-16 08:47:24 +02:00 · 2020-07-16 08:47:24 +02:00 · b1de627e94
commit b1de627e94
parent 0489a50bd0
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/process_creation/win_apt_zxshell.yml
+++ b/rules/windows/process_creation/win_apt_zxshell.yml
@ -17,7 +17,7 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine:
+        CommandLine|contains:
            - 'rundll32.exe *,zxFunction*'
            - 'rundll32.exe *,RemoteDiskXXXXX'
    condition: selection