valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Small fix

Browse Source 
Added "\" at file path end
This commit is contained in:
stvetro 2020-10-23 12:50:27 +04:00
parent a6d99e4418
commit ca6a4beb65
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/process_creation/win_susp_runscripthelper.yml
View File

@ -11,7 +11,7 @@ logsource:
product: windows
detection:
image_path:
Image|endswith: 'Runscripthelper.exe'
Image|endswith: '\Runscripthelper.exe'
cmd:
CommandLine|contains: 'surfacecheck'
condition: image_path and cmd