Update sysmon_cactustorch.yml

2024-11-08 02:08:54 +00:00 · 2020-10-15 20:12:54 -03:00 · 2020-10-15 20:12:54 -03:00 · df81f5180d
commit df81f5180d
parent 457217bfc0
1 changed files with 7 additions and 7 deletions
--- a/rules/windows/sysmon/sysmon_cactustorch.yml
+++ b/rules/windows/sysmon/sysmon_cactustorch.yml
@ -14,13 +14,13 @@ logsource:
 detection:
    selection:
        EventID: 8
-        SourceImage:
-            - '*\System32\cscript.exe'
-            - '*\System32\wscript.exe'
-            - '*\System32\mshta.exe'
-            - '*\winword.exe'
-            - '*\excel.exe'
-        TargetImage: '*\SysWOW64\\*'
+        SourceImage|endswith:
+            - '\System32\cscript.exe'
+            - '\System32\wscript.exe'
+            - '\System32\mshta.exe'
+            - '\winword.exe'
+            - '\excel.exe'
+        TargetImage|contains: '\SysWOW64\\'
        StartModule: null
    condition: selection
 tags: