Update proxy_ursnif_malware.yml

2020-11-28 19:09:07 +01:00
parent e932eda645
commit 02ea91ec8b
1 changed files with 5 additions and 2 deletions
@@ -4,12 +4,15 @@ status: stable
 description: Detects download of Ursnif malware done by dropper documents.
 author: Thomas Patzke
 date: 2019/12/19
-modified: 2020/09/03
+modified: 2020/11/28
 logsource:
  category: proxy
 detection:
  selection:
-    c-uri|endswith: '/*.php?l=*.cab'
+    c-uri|contains|all: 
+      - '/'
+      - '.php?l='
+    c-uri|endswith: '.cab'
    sc-status: 200
  condition: selection
 fields: