Merge pull request #323 from Karneades/filterFix

Restrict filter in system exe anomaly rule
2019-04-19 09:17:16 +02:00
parent f78413deab d75ea35295
commit 8a5ae01f0e
1 changed files with 2 additions and 2 deletions
@@ -26,8 +26,8 @@ detection:
            - '*\conhost.exe'
    filter:
        Image:
-            - '*\System32\\*'
-            - '*\SysWow64\\*'
+            - 'C:\Windows\System32\\*'
+            - 'C:\Windows\SysWow64\\*'
    condition: selection and not filter
 falsepositives:
    - Exotic software