Revert "refactor: 2nd condition in CVE-2021-40444 rule"

This reverts commit 015573c450.
2021-09-09 09:41:03 +02:00
parent 015573c450
commit 6d86c7df6c
1 changed files with 2 additions and 5 deletions
@@ -13,18 +13,15 @@ logsource:
    category: process_creation
    product: windows
 detection:
-    selection1:
+    selection:
        Image|endswith: '\control.exe'
        ParentImage|endswith:
            - '\winword.exe'
            - '\powerpnt.exe'
            - '\excel.exe'
-    selection2:
-        Image|endswith: '\control.exe'
-        CommandLine|contains: '.cpl'
    filter:
        CommandLine|endswith: '\control.exe input.dll'
-    condition: ( selection1 or selection2 ) and not filter
+    condition: selection and not filter
 falsepositives:
    - Unknown
 level: critical