Remove too loose filter in mshta rule

2024-11-08 02:08:54 +00:00 · 2019-04-04 22:16:24 +02:00 · 2019-04-04 22:16:24 +02:00 · eb690d8902
commit eb690d8902
parent 81693d81b6
1 changed files with 0 additions and 4 deletions
--- a/rules/windows/process_creation/win_mshta_spawn_shell.yml
+++ b/rules/windows/process_creation/win_mshta_spawn_shell.yml
@ -20,10 +20,6 @@ detection:
            - '*\reg.exe'
            - '*\regsvr32.exe'
            - '*\BITSADMIN*'
-    filter:
-        CommandLine:
-            - '*/HP/HP*'
-            - '*\HP\HP*'
    condition: selection and not filter
 fields:
    - CommandLine