From 334dd9a058eb3bd2031fecbc6821ee22d4875dc5 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Sat, 20 Mar 2021 08:34:02 +0100
Subject: [PATCH] Update win_set_oabvirtualdirectory_externalurl.yml

---
 .../win_set_oabvirtualdirectory_externalurl.yml  | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml b/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml
index 7285cc243..a00956dad 100644
--- a/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml
+++ b/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml
@@ -13,15 +13,13 @@ logsource:
     product: windows
     service: msexchange-management
 detection:
-    keywords:
-      Message:
-        - "*Set-OabVirtualDirectory*"
-        - "*ExternalUrl*"
-        - "*Page_Load*"
-        - "*script*"
     selection:
-        EventID: 1
-    condition: keywords and selection
+        Message|contains|all:
+            - 'Set-OabVirtualDirectory'
+            - 'ExternalUrl'
+            - 'Page_Load'
+            - 'script'
+    condition: selection
 falsepositives:
     - Unknown
-level: high
\ No newline at end of file
+level: high