diff --git a/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml b/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml index 76f00405a..b9bc0a90f 100644 --- a/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml +++ b/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml @@ -31,7 +31,7 @@ detection: - 'C:\Windows\System32\TSMSISrv.dll' - 'C:\Windows\System32\TSVIPSrv.dll' - 'C:\Windows\System32\wow64log.dll' - - TargetFileName|endswith: '\SprintCSP.dll' + - TargetFilename|endswith: '\SprintCSP.dll' filter: Image|startswith: 'C:\Windows\System32\' condition: selection and not filter