Update win_apt_apt29_thinktanks.yml

2024-11-08 02:08:54 +00:00 · 2020-10-27 23:24:04 -03:00 · 2020-10-27 23:24:04 -03:00 · e24e6da3b5
commit e24e6da3b5
parent 467af2ebb5
1 changed files with 5 additions and 1 deletions
--- a/rules/windows/process_creation/win_apt_apt29_thinktanks.yml
+++ b/rules/windows/process_creation/win_apt_apt29_thinktanks.yml
@ -17,7 +17,11 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine|contains: '-noni -ep bypass $'
+        CommandLine|contains|all: 
+            - '-noni' 
+            - '-ep'
+            - 'bypass'
+            - '$'
    condition: selection
 falsepositives:
    - unknown