fix CVE 2020-1048 rule

2020-05-15 07:25:05 -04:00
parent b672d7aeb4
commit 0575fa8d81
1 changed files with 5 additions and 2 deletions
@@ -1,5 +1,5 @@
 action: global
-title: Suspicious PrinterPorts Created
+title: Suspicious PrinterPorts Created (CVE-2020-1048)
 id: 7ec912f2-5175-4868-b811-ec13ad0f8567
 status: experimental
 description: Detects new registry printer port was created or powershell command add new printer port which point to suspicious file
@@ -26,7 +26,10 @@ detection:
            - 12
            - 13 
        TargetObject|startswith: 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports'
-        EventType: CreateKey
+        EventType:
+            - SetValue
+            - DeleteValue
+            - CreateValue
        TargetObject|contains:
            - '.dll'
            - '.exe'