Update proc_creation_win_lolbin_customshellhost.yml

2022-08-20 10:27:40 +02:00
parent 65cdc9d04d
commit 1443adc730
1 changed files with 2 additions and 6 deletions
@@ -14,13 +14,9 @@ logsource:
    product: windows
 detection:
    selection:
-        - Image|endswith: '\CustomShellHost.exe'
-        - OriginalFileName: 'CustomShellHost.exe'
+        ParentImage|endswith: '\CustomShellHost.exe'
    filter:
-        - Image: 
-            - 'C:\Windows\explorer.exe'
-            - 'C:\Windows\System32\explorer.exe'
-        - CurrentDirectory|startswith: C:\Windows\System32\
+        Image: 'C:\Windows\explorer.exe'
    condition: selection and not filter
 falsepositives:
    - Unknown