Update silenttrinity_stager_msbuild_activity.yml

2024-11-07 17:58:52 +00:00 · 2020-10-26 17:00:50 +05:30 · 2020-10-26 17:00:50 +05:30 · b5e07f0a37
commit b5e07f0a37
parent 708fe7f8fa
1 changed files with 3 additions and 3 deletions
--- a/rules/windows/sysmon/silenttrinity_stager_msbuild_activity.yml
+++ b/rules/windows/sysmon/silenttrinity_stager_msbuild_activity.yml
@ -14,13 +14,13 @@ logsource:
    product: windows
 detection:
    selection:
+        ParentImage|endswith: '\msbuild.exe'
+    filter:
        DestinationPort:
            - '80'
            - '443'
        Initiated: 'true'
-    filter:
-        ParentImage|endswith: '\msbuild.exe'
-    condition: selection and  filter 
+    condition: selection and filter 
 falsepositives:
    - unknown
 level: high