Update av_webshell.yml

2024-11-07 09:48:58 +00:00 · 2020-10-27 22:35:45 -03:00 · 2020-10-27 22:35:45 -03:00 · dbad6c637f
commit dbad6c637f
parent 0afe48a0a0
1 changed files with 3 additions and 2 deletions
--- a/rules/windows/malware/av_webshell.yml
+++ b/rules/windows/malware/av_webshell.yml
@ -14,14 +14,15 @@ logsource:
    product: antivirus
 detection:
    selection:
-        Signature|startswith:
+        - Signature|startswith:
            - "PHP/Backdoor"
            - "JSP/Backdoor"
            - "ASP/Backdoor"
            - "Backdoor.PHP"
            - "Backdoor.JSP"
            - "Backdoor.ASP"
-            - "*Webshell"
+        - Signature|contains:
+            - "Webshell"
    condition: selection
 fields:
    - FileName