From 600c7057b137a41322bbabdc2d78fcf4f464fe49 Mon Sep 17 00:00:00 2001
From: Jonhnathan <jonhnathancesar@gmail.com>
Date: Thu, 15 Oct 2020 15:53:26 -0300
Subject: [PATCH] Update win_susp_sam_dump.yml

---
 rules/windows/builtin/win_susp_sam_dump.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/windows/builtin/win_susp_sam_dump.yml b/rules/windows/builtin/win_susp_sam_dump.yml
index 7c0894b6b..19d97f8e2 100644
--- a/rules/windows/builtin/win_susp_sam_dump.yml
+++ b/rules/windows/builtin/win_susp_sam_dump.yml
@@ -15,8 +15,8 @@ logsource:
 detection:
     selection:
         EventID: 16
-        Message:
-            - '*\AppData\Local\Temp\SAM-*.dmp *'
+        Message|contains:
+            - '\AppData\Local\Temp\SAM-*.dmp'
     condition: selection
 falsepositives:
     - Penetration testing