Update sysmon_susp_mic_cam_access.yml

2020-11-20 02:02:26 -03:00
parent 9e3a612953
commit 493fa3d5ee
1 changed files with 4 additions and 3 deletions
@@ -14,8 +14,9 @@ logsource:
    product: windows
 detection:
    selection_1:
-        TargetObject|contains:
-            - \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\\*\NonPackaged
+        TargetObject|contains|all:
+            - '\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\'
+            - '\NonPackaged'
    selection_2:
        TargetObject|contains:
            - microphone
@@ -31,4 +32,4 @@ detection:
    condition: all of selection_*
 falsepositives:
    - Unlikely, there could be conferencing software running from a Temp folder accessing the devices
-level: high
+level: high