Update win_susp_ping_hex_ip.yml

2024-11-08 02:08:54 +00:00 · 2020-11-28 13:01:24 -03:00 · 2020-11-28 13:01:24 -03:00 · b24945999e
commit b24945999e
parent 1c56dc463a
1 changed files with 2 additions and 2 deletions
--- a/rules/windows/process_creation/win_susp_ping_hex_ip.yml
+++ b/rules/windows/process_creation/win_susp_ping_hex_ip.yml
@ -15,9 +15,9 @@ logsource:
    product: windows
 detection:
    selection:
+        Image|endswith: '\ping.exe'
        CommandLine|contains:
-            - '\ping.exe 0x'
-            - '\ping 0x'
+            - ' 0x'
    condition: selection
 fields:
    - ParentCommandLine