fix: update detection logic

2022-12-16 17:09:34 +01:00
parent f0ff97be9b
commit 2b9048b6c8
1 changed files with 1 additions and 3 deletions
@@ -18,9 +18,7 @@ detection:
        Image|endswith: '\rundll32.exe'
        ParentImage|endswith: '\explorer.exe'
    filter:
-        - CommandLine|contains: '\shell32.dll,OpenAs_RunDLL'
-        - CommandLine|contains: 'rundll32.exe" C:\Windows\System32\'
-        - CommandLine|contains: 'rundll32.exe C:\Windows\System32\'
+        CommandLine|contains: ' C:\Windows\System32\' # The space at the start is required
    condition: selection and not filter
 fields:
    - Image