valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: error in selector

Browse Source
This commit is contained in:
Florian Roth 2021-07-14 15:58:55 +02:00
parent 530e04faec
commit e516aecc74
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/process_creation/win_susp_script_exec_from_temp.yml
View File

@ -12,7 +12,7 @@ logsource:
category: process_creation category: process_creation
product: windows product: windows
detection: detection:
selection_image1: selection:
Image|endswith: Image|endswith:
- '\powershell.exe' - '\powershell.exe'
- '\mshta.exe' - '\mshta.exe'