fixed image search

2024-11-08 10:13:57 +00:00 · 2020-10-15 13:21:06 +03:00 · 2020-10-15 13:21:06 +03:00 · f79342cc59
commit f79342cc59
parent cf399927e1
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/process_creation/win_susp_diskshadow.yml
+++ b/rules/windows/process_creation/win_susp_diskshadow.yml
@ -15,7 +15,7 @@ logsource:
    definition: 'Requirements: Sysmon ProcessCreation logging must be activated and Windows audit msut Include command line in process creation events'
 detection:
    selection:
-            Image: 'c:\windows\system32\diskshadow.exe'
+            Image|endswith: 'diskshadow.exe'
            CommandLine|contains:
                - '/s'
    condition: selection