Update lnx_system_info_discovery.yml

2020-11-08 11:09:27 +03:00
parent 5dc3472af0
commit 577165b7f7
1 changed files with 8 additions and 8 deletions
@@ -19,14 +19,14 @@ logsource:
    categories: process_creation
 detection:
    selection:
-        ProcessName|contains:
-          - 'uname'
-          - 'hostname'
-          - 'uptime'
-          - 'lspci'
-          - 'dmidecode'
-          - 'lscpu'
-          - 'lsmod'
+        ProcessName|endswith:
+          - '/uname'
+          - '/hostname'
+          - '/uptime'
+          - '/lspci'
+          - '/dmidecode'
+          - '/lscpu'
+          - '/lsmod'
    condition: selection
 ---
 logsource: