Update lnx_install_root_certificate.yml

2020-11-07 11:50:30 +03:00
parent 373c637e66
commit 89a24d4bfa
1 changed files with 4 additions and 2 deletions
@@ -14,12 +14,14 @@ detection:
        - CommandLine|contains|all:
          - 'mv '
          - '/usr/local/share/ca-certificates'
-          - 'update-ca-certificates'
    selection2:
+        - ProcessName|contains:
+          - 'update-ca-certificates'
+    selection3:
        - CommandLine|contains|all:
          - 'cp '
          - 'rootCA.crt'
          - 'update-ca-trust'
-    condition: selection or selection2
+    condition: (selection and selection2) or selection3
 falsepositives:
    - Legitimate administration activities