Update win_susp_sdelete.yml

2020-10-15 15:53:51 -03:00
parent 600c7057b1
commit 496cfcb26a
1 changed files with 3 additions and 3 deletions
@@ -28,9 +28,9 @@ detection:
            - 4656
            - 4663
            - 4658
-        ObjectName:
-            - '*.AAA'
-            - '*.ZZZ'
+        ObjectName|endswith:
+            - '.AAA'
+            - '.ZZZ'
    condition: selection
 falsepositives:
    - Legitime usage of SDelete