Improved shell spawning rule

2018-04-11 20:09:28 +02:00
parent ef7fb4cff1
commit 52d405bb1b
1 changed files with 1 additions and 0 deletions
@@ -24,6 +24,7 @@ detection:
            - '*\nslookup.exe'
            - '*\certutil.exe'
            - '*\bitsadmin.exe'
+            - '*\mshta.exe'
    condition: selection
 fields:
    - CommandLine