refactor: add accepteula to flags

2021-12-19 19:43:37 +01:00
parent 70f3f4fa88
commit 89e1f491b3
1 changed files with 5 additions and 4 deletions
@@ -31,10 +31,11 @@ detection:
          - '/x'
          - '-s'
          - '/s'
-    eventlog:
-        CommandLine|contains:
-          - 'security'
-    condition: (1 of selection*) or (flags and eventlog)
+    other:
+        CommandLine|contains|all: 
+            - 'security'
+            - 'accepteula'
+    condition: (1 of selection*) or (flags and other)
 falsepositives:
    - Another tool that uses the command line switches of PsLogList
    - Legitimate use of PsLogList by an administrator