Issue 3552

2022-10-06 06:50:54 +02:00
parent 85d33e4af9
commit 32406c1915
1 changed files with 2 additions and 1 deletions
@@ -6,6 +6,7 @@ references:
    - https://www.cobaltstrike.com/help-opsec
 author: Florian Roth
 date: 2021/05/27
+modified: 2022/10/06
 logsource:
    category: process_creation
    product: windows
@@ -18,7 +19,7 @@ detection:
        ParentImage|contains: 
            - '\AppData\Local\'
            - '\Microsoft\Edge\'
-    condition: selection and not filter1 and not filter2
+    condition: selection and not 1 of filter*
 fields:
    - ParentImage
    - ParentCommandLine