Update rules/windows/process_creation/proc_creation_win_iis_service_account_password_dumped.yml

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
2022-11-19 15:06:10 +11:00
parent 0de44fcf5b
commit 09d6d3e407
1 changed files with 1 additions and 1 deletions
@@ -32,7 +32,7 @@ detection:
            - ' /text '
            - ' /config '
            - ' /@c'
-    condition: 1 of selection_cmd* and selection_list
+    condition: all of selection_*
 falsepositives:
    - Unknown
 level: high