Update win_apt_chafer_mar18.yml

2020-10-27 23:28:04 -03:00
parent 0860978412
commit 28febe5dd2
1 changed files with 2 additions and 1 deletions
@@ -74,7 +74,8 @@ detection:
        CommandLine|startswith:
            - 'C:\wsc.exe'
    selection_process2:
-        Image|endswith: '\Windows\Temp\DB\\*.exe'
+        Image|contains: '\Windows\Temp\DB\'
+        Image|endswith: '.exe'
    selection_process3:
        CommandLine|contains: '\nslookup.exe -q=TXT'
        ParentImage|contains: '\Autoit'