Update sysmon_uac_bypass_eventvwr.yml

2020-10-15 20:11:11 -03:00
parent 6ea18efdaf
commit 8a52610bf8
1 changed files with 2 additions and 2 deletions
@@ -32,9 +32,9 @@ logsource:
    product: windows
 detection:
    methprocess:
-        ParentImage: '*\eventvwr.exe'
+        ParentImage|endswith: '\eventvwr.exe'
    filterprocess:
-        Image: '*\mmc.exe'
+        Image|endswith: '\mmc.exe'
    condition: methprocess and not filterprocess
 fields:
    - CommandLine