Fix CommandLine

Forget to copy the correct from Test VM
2022-01-16 11:15:50 +01:00
parent c4f4b55920
commit 262cb31143
1 changed files with 3 additions and 3 deletions
@@ -14,10 +14,10 @@ logsource:
    product: windows
 detection:
    selection:
-        - Image|contains|all:
+        - CommandLine|contains|all:
            - 'del '
            - /f
-        - Image|contains|all:    
+        - CommandLine|contains|all:    
            - rmdir
            - /s
            - /q 
@@ -27,4 +27,4 @@ falsepositives:
 level: low
 tags:
    - attack.defense_evasion
-    - attack.t1070.004
+    - attack.t1070.004