security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix cast

Browse Source
This commit is contained in:
frack113
2021-10-21 09:58:32 +02:00
parent 6c7d5124f5
commit 1775db7fe8
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_access/sysmon_in_memory_assembly_execution.yml
+2 -2
View File
@@ -23,8 +23,8 @@ logsource:
detection:
selection1:
CallTrace|contains|all:
- 'C:\Windows\SYSTEM32\ntdll.dll+'
- '|C:\Windows\System32\KERNELBASE.dll+'
- 'C:\WINDOWS\SYSTEM32\ntdll.dll+'
- '|C:\WINDOWS\System32\KERNELBASE.dll+'
- '|UNKNOWN('
- ')'
selection2: