fix: keyword expression in rule

2020-02-29 16:03:31 +01:00
parent 15a400ac51
commit 19d383989c
1 changed files with 2 additions and 2 deletions
@@ -17,8 +17,8 @@ detection:
        EventID: 4
        Source: MSExchange Control Panel
        Level: Error
-    selection2|contains:
-      - '&__VIEWSTATE='
+    selection2:
+        - '*&__VIEWSTATE=*'
    condition: selection1 and selection2
 falsepositives:
    - Unknown