security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update proc_creation_win_change_evtx_location.yml

Browse Source
This commit is contained in:
Vadim
2023-01-03 12:11:13 +03:00
committed by GitHub
parent 2075962596
commit 052cd2e967
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_change_evtx_location.yml
+1 -1
View File
@@ -19,7 +19,7 @@ detection:
CommandLine|contains|all:
- wevtutil
- /lfn
- \.evtx
- .evtx
filter_cmd:
CommandLine|contains: \Windows\System32\winevt\Logs
condition: selection_cmd and not filter_cmd