Update win_susp_wmi_login.yml

2024-11-08 02:08:54 +00:00 · 2020-10-15 15:54:21 -03:00 · 2020-10-15 15:54:21 -03:00 · d96bd0d9f3
commit d96bd0d9f3
parent 496cfcb26a
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/builtin/win_susp_wmi_login.yml
+++ b/rules/windows/builtin/win_susp_wmi_login.yml
@ -13,7 +13,7 @@ logsource:
 detection:
    selection:
        EventID: 4624
-        ProcessName: "*\\WmiPrvSE.exe"
+        ProcessName|endswith: "\\WmiPrvSE.exe"
    condition: selection
 falsepositives:
    - Monitoring tools