Bugfix: Minor fix cause Sysmon uses SID as Software key

2017-03-21 10:44:53 +01:00
parent b1da8c5b32
commit 3bfa9ed121
1 changed files with 2 additions and 1 deletions
@@ -9,8 +9,9 @@ logsource:
 detection:
    selection:
        EventID: 13 
-        TargetObject: 'HKEY_USERS\Software\Classes\exefile\shell\runas\command\isolatedCommand'
+        TargetObject: 'HKEY_USERS\*\Classes\exefile\shell\runas\command\isolatedCommand'
    condition: selection
 falsepositives:
    - unknown
 level: high
+