Merge pull request #316 from megan201296/patch-19

Update win_mal_ursnif.yml
2024-11-08 10:13:57 +00:00 · 2019-04-14 23:10:16 +02:00 · 2019-04-14 23:10:16 +02:00 · cb0a87e21e
commit cb0a87e21e
parent 08ec8597a5 eb8a0636c5
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/malware/win_mal_ursnif.yml
+++ b/rules/windows/malware/win_mal_ursnif.yml
@ -15,7 +15,7 @@ logsource:
 detection:
    selection:
        EventID: 13
-        TargetObject: 'HKU\Software\AppDataLow\Software\Microsoft\\*'
+        TargetObject: '*\Software\AppDataLow\Software\Microsoft\\*'
    condition: selection
 falsepositives:
    - Unknown