Clean rule rules/windows/malware/win_mal_octopus_scanner.yml to use category

2024-11-07 01:45:21 +00:00 · 2021-04-15 02:30:41 +02:00 · 2021-04-15 02:30:41 +02:00 · cce8d945a0
commit cce8d945a0
parent a9f2a80b8c
1 changed files with 1 additions and 2 deletions
--- a/rules/windows/malware/win_mal_octopus_scanner.yml
+++ b/rules/windows/malware/win_mal_octopus_scanner.yml
@ -13,12 +13,11 @@ logsource:
  product: windows
  category: file_event
 detection:
-  filecreate:
  selection:
    TargetFilename|endswith:
      - '\AppData\Local\Microsoft\Cache134.dat'
      - '\AppData\Local\Microsoft\ExplorerSync.db'
-  condition: filecreate and selection
+  condition: selection
 falsepositives:
  - Unknown
 level: high