Update win_susp_wmi_login.yml

2020-11-19 22:47:20 -03:00
parent ea385767b9
commit 4f4fcbc576
1 changed files with 1 additions and 1 deletions
@@ -13,7 +13,7 @@ logsource:
 detection:
    selection:
        EventID: 4624
-        ProcessName|endswith: "\\WmiPrvSE.exe"
+        ProcessName|endswith: '\WmiPrvSE.exe'
    condition: selection
 falsepositives:
    - Monitoring tools