Update win_susp_execution_path.yml

2024-11-07 17:58:52 +00:00 · 2020-10-15 19:29:05 -03:00 · 2020-10-15 19:29:05 -03:00 · fedc5b88e0
commit fedc5b88e0
parent 9ef41cbc77
1 changed files with 10 additions and 10 deletions
--- a/rules/windows/process_creation/win_susp_execution_path.yml
+++ b/rules/windows/process_creation/win_susp_execution_path.yml
@ -12,16 +12,16 @@ logsource:
    product: windows
 detection:
    selection:
-        Image:
-            - '*\$Recycle.bin'
-            - '*\Users\All Users\\*'
-            - '*\Users\Default\\*'
-            - '*\Users\Public\\*'
-            - 'C:\Perflogs\\*'
-            - '*\config\systemprofile\\*'
-            - '*\Windows\Fonts\\*'
-            - '*\Windows\IME\\*'
-            - '*\Windows\addins\\*'
+        Image|contains:
+            - '\$Recycle.bin'
+            - '\Users\All Users\\'
+            - '\Users\Default\\'
+            - '\Users\Public\\'
+            - 'C:\Perflogs\\'
+            - '\config\systemprofile\\'
+            - '\Windows\Fonts\\'
+            - '\Windows\IME\\'
+            - '\Windows\addins\\'
    condition: selection
 fields:
    - CommandLine