Use endswith with processname

rules/linux/lnx_local_account.yml

@@ -11,22 +11,22 @@ logsource:
   product: linux
 detection:
   selection_1:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/lastlog'
   selection_2:
     CommandLine|contains:
       - "'x:0:'"
   selection_3:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/cat'
     CommandLine|contains:
       - '/etc/passwd'
       - '/etc/sudoers'
   selection_4:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/id'
   selection_5:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/lsof'
     CommandLine|contains:
       - '-u'

rules/linux/macos_local_account.yml

@@ -11,12 +11,12 @@ logsource:
   product: macos
 detection:
   selection_1:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/dscl'
     CommandLine|contains:
       - '. list /users'
   selection_2:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/dscacheutil'
     CommandLine|contains:
       - '-q user'
@@ -24,16 +24,16 @@ detection:
     CommandLine|contains:
       - "'x:0:'"
   selection_4:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/cat'
     CommandLine|contains:
       - '/etc/passwd'
       - '/etc/sudoers'
   selection_5:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/id'
   selection_6:
-    ProcessName|contains:
+    ProcessName|endswith:
       - '*/lsof'
     CommandLine|contains:
       - '-u'