Rule: Changed msiexec web install rule

2018-02-10 15:25:08 +01:00
parent 443afcba0a
commit 0a1c600d7d
1 changed files with 1 additions and 1 deletions
@@ -10,7 +10,7 @@ date: 2018/02/09
 detection:
    selection:
        CommandLine: 
-            - '* msiexec* /q *http*'
+            - '* msiexec*:\/\/*'
    condition: selection
 falsepositives: 
    - False positives depend on scripts and administrative tools used in the monitored environment