Updated at command rule to use Image field

2021-10-15 15:46:59 -04:00
parent aa0a5b8204
commit 04ff9ae692
1 changed files with 1 additions and 1 deletions
@@ -11,7 +11,7 @@ logsource:
    category: process_creation
 detection:
    selection:
-        ProcessName|endswith:
+        Image|endswith:
          - '/at'
          - '/atd'
    condition: selection