From 1cd56f5daefac3f3dca0a7e0c39d786142fbaadf Mon Sep 17 00:00:00 2001
From: Jonhnathan <jonhnathancesar@gmail.com>
Date: Thu, 15 Oct 2020 15:56:36 -0300
Subject: [PATCH] Update win_vul_cve_2020_0688.yml

---
 rules/windows/builtin/win_vul_cve_2020_0688.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/windows/builtin/win_vul_cve_2020_0688.yml b/rules/windows/builtin/win_vul_cve_2020_0688.yml
index 38b8e95e6..f89fdb6a0 100644
--- a/rules/windows/builtin/win_vul_cve_2020_0688.yml
+++ b/rules/windows/builtin/win_vul_cve_2020_0688.yml
@@ -17,8 +17,8 @@ detection:
         EventID: 4
         Source: MSExchange Control Panel
         Level: Error
-    selection2:
-        - '*&__VIEWSTATE=*'
+    selection2|contains:
+        - '&__VIEWSTATE='
     condition: selection1 and selection2
 falsepositives:
     - Unknown