Update win_av_relevant_match.yml

rules/windows/builtin/win_av_relevant_match.yml

@@ -8,32 +8,32 @@ logsource:
     service: application
 detection:
     keywords:
-        Message:
-            - "*HTool*"
-            - "*Hacktool*"
-            - "*ASP/Backdoor*"
-            - "*JSP/Backdoor*"
-            - "*PHP/Backdoor*"
-            - "*Backdoor.ASP*"
-            - "*Backdoor.JSP*"
-            - "*Backdoor.PHP*"
-            - "*Webshell*"
-            - "*Portscan*"
-            - "*Mimikatz*"
-            - "*WinCred*"
-            - "*PlugX*"
-            - "*Korplug*"
-            - "*Pwdump*"
-            - "*Chopper*"
-            - "*WmiExec*"
-            - "*Xscan*"
-            - "*Clearlog*"
-            - "*ASPXSpy*"
-    filters:
-        Message:
-            - "*Keygen*"
-            - "*Crack*"
-    condition: keywords and not 1 of filters
+        Message|contains:
+            - "HTool"
+            - "Hacktool"
+            - "ASP/Backdoor"
+            - "JSP/Backdoor"
+            - "PHP/Backdoor"
+            - "Backdoor.ASP"
+            - "Backdoor.JSP"
+            - "Backdoor.PHP"
+            - "Webshell"
+            - "Portscan"
+            - "Mimikatz"
+            - "WinCred"
+            - "PlugX"
+            - "Korplug"
+            - "Pwdump"
+            - "Chopper"
+            - "WmiExec"
+            - "Xscan"
+            - "Clearlog"
+            - "ASPXSpy"
+    filter:
+        Message|contains:
+            - "Keygen"
+            - "Crack"
+    condition: keywords and not filter
 falsepositives:
     - Some software piracy tools (key generators, cracks) are classified as hack tools
 level: high