refactor: exclude case in which upper ticks are used

2024-11-06 17:35:19 +00:00 · 2021-09-09 12:55:10 +02:00 · 2021-09-09 12:55:10 +02:00 · f00aaf8461
commit f00aaf8461
parent 6d86c7df6c
1 changed files with 3 additions and 1 deletions
--- a/rules/windows/process_creation/win_susp_control_cve_2021_40444.yml
+++ b/rules/windows/process_creation/win_susp_control_cve_2021_40444.yml
@ -20,7 +20,9 @@ detection:
            - '\powerpnt.exe'
            - '\excel.exe'
    filter:
-        CommandLine|endswith: '\control.exe input.dll'
+        CommandLine|endswith: 
+            - '\control.exe input.dll'
+            - '\control.exe" input.dll'
    condition: selection and not filter
 falsepositives:
    - Unknown