valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update win_nltest_recon.yml

Browse Source 
change "startswith" to "contains"
This commit is contained in:
gs3cl 2021-08-19 14:12:00 +02:00 committed by GitHub
parent df829f0d45
commit bf9ac21ebc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/process_creation/win_nltest_recon.yml
View File

@ -26,7 +26,7 @@ detection:
- '/server'
- '/query'
selection_recon2:
CommandLine|startswith:
CommandLine|contains:
- '/dclist:'
- '/parentdomain'
- '/domain_trusts'