rule: made it more specific - command line must contain URL

2024-11-08 02:08:54 +00:00 · 2019-11-20 09:23:04 +01:00 · 2019-11-20 09:23:04 +01:00 · f9e6a929ba
commit f9e6a929ba
parent 55e66b1843
1 changed files with 1 additions and 0 deletions
--- a/rules/windows/process_creation/win_exploit_cve_2019_1388.yml
+++ b/rules/windows/process_creation/win_exploit_cve_2019_1388.yml
@ -16,6 +16,7 @@ detection:
    selection:
        ParentImage: '*\consent.exe'
        Image: '*\iexplore.exe'
+        CommandLine: '* http*'
    rights1:
        IntegrityLevel: 'System'  # for Sysmon users
    rights2: