refactor: removed unnecessary regex

2022-02-21 11:01:18 +01:00
parent ab3f1f6e7d
commit 6ce58d7201
1 changed files with 4 additions and 2 deletions
@@ -11,7 +11,7 @@ tags:
    - attack.t1053
 author: Sreeman
 date: 2020/09/29
-modified: 2021/09/09
+modified: 2022/02/21
 fields:
    - EventID
    - CommandLine
@@ -22,7 +22,9 @@ logsource:
    category: process_creation
 detection:
    selection:
-        CommandLine|re: '(?i).*schtasks.*(-|\/)r.*\\\\Application Experience\\\\Microsoft Compatibility Appraiser.*'
+        CommandLine|contains|all: 
+            - 'schtasks'
+            - '\Application Experience\Microsoft Compatibility Appraiser'
    condition: selection
 falsepositives:
    - none