Update win_webshell_recon_detection.yml

2020-10-15 19:59:36 -03:00
parent e402356e82
commit 138b8fed06
1 changed files with 11 additions and 11 deletions
@@ -17,19 +17,19 @@ logsource:
 detection:
    selection:
        ParentImage|contains:
-            - '*\apache*'
-            - '*\tomcat*'
-            - '*\w3wp.exe'
-            - '*\php-cgi.exe'
-            - '*\nginx.exe'
-            - '*\httpd.exe'
+            - '\apache'
+            - '\tomcat'
+            - '\w3wp.exe'
+            - '\php-cgi.exe'
+            - '\nginx.exe'
+            - '\httpd.exe'
        Image|endswith:
-            - '*\cmd.exe'
+            - '\cmd.exe'
        CommandLine|contains:
-            - '*perl --help*'
-            - '*python --help*'
-            - '*wget --help*'
-            - '*perl -h*'
+            - 'perl --help'
+            - 'python --help'
+            - 'wget --help'
+            - 'perl -h'
    condition: selection
 fields:
    - Image