fix: missing condition

2024-11-07 17:58:52 +00:00 · 2021-05-27 15:04:13 +02:00 · 2021-05-27 15:04:13 +02:00 · d5e8d1153f
commit d5e8d1153f
parent 7ce7095c2c
1 changed files with 1 additions and 0 deletions
--- a/rules/windows/builtin/win_susp_proceshacker.yml
+++ b/rules/windows/builtin/win_susp_proceshacker.yml
@ -18,6 +18,7 @@ detection:
        EventID: 7045
        ServiceName|startswith: 'ProcessHacker'
        AccountName: 'LocalSystem'
+    condition: selection
 falsepositives:
    - Unlikely
 level: high