From 51eefbae0cd81f3ebf46b762b19474de86ba82f3 Mon Sep 17 00:00:00 2001
From: Jonhnathan <jonhnathancesar@gmail.com>
Date: Thu, 15 Oct 2020 20:04:05 -0300
Subject: [PATCH] Update sysmon_logon_scripts_userinitmprlogonscript_reg.yml

---
 .../sysmon_logon_scripts_userinitmprlogonscript_reg.yml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/windows/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml b/rules/windows/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml
index 069aaa501..e9ee2839a 100644
--- a/rules/windows/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml
+++ b/rules/windows/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml
@@ -17,9 +17,9 @@ logsource:
     product: windows
 detection:
     create_keywords_reg:
-        TargetObject: '*UserInitMprLogonScript*'
+        TargetObject|contains: 'UserInitMprLogonScript'
     condition: create_keywords_reg
 falsepositives:
     - exclude legitimate logon scripts
     - penetration tests, red teaming
-level: high
\ No newline at end of file
+level: high