Update sysmon_win_binary_github_com.yml

2020-10-15 16:26:28 -03:00
parent 554adb8562
commit 5dc02f3a87
1 changed files with 4 additions and 4 deletions
@@ -21,10 +21,10 @@ logsource:
 detection:
    selection:
        Initiated: 'true'
-        DestinationHostname:
-            - '*.github.com'
-            - '*.githubusercontent.com'
-        Image: 'C:\Windows\\*'
+        DestinationHostname|endswith:
+            - '.github.com'
+            - '.githubusercontent.com'
+        Image|startswith: 'C:\Windows\\'
    condition: selection
 falsepositives:
    - 'Unknown'