Update win_set_oabvirtualdirectory_externalurl.yml

2021-03-20 08:34:02 +01:00
parent f138a27426
commit 334dd9a058
1 changed files with 7 additions and 9 deletions
@@ -13,15 +13,13 @@ logsource:
    product: windows
    service: msexchange-management
 detection:
-    keywords:
-      Message:
-        - "*Set-OabVirtualDirectory*"
-        - "*ExternalUrl*"
-        - "*Page_Load*"
-        - "*script*"
    selection:
-        EventID: 1
-    condition: keywords and selection
+        Message|contains|all:
+            - 'Set-OabVirtualDirectory'
+            - 'ExternalUrl'
+            - 'Page_Load'
+            - 'script'
+    condition: selection
 falsepositives:
    - Unknown
-level: high
+level: high