Update image_load_susp_cmstp.yml

2022-08-31 09:53:07 +02:00
parent 343b0ef199
commit 80098113d0
1 changed files with 1 additions and 2 deletions
@@ -20,8 +20,7 @@ detection:
        ImageLoaded|endswith:
            - '.dll'
            - '.ocx'
-        Image|endswith:
-            - '\cmstp.exe'
+        Image|endswith: '\cmstp.exe'
    condition: selection
 falsepositives:
    - Unikely