Enhanced to improve specificity

Enhanced to improve specificity per feedback received;
2020-10-26 12:05:16 -04:00
parent 7b49a4690e
commit 8a9db12d30
1 changed files with 3 additions and 3 deletions
@@ -16,9 +16,9 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine:
-            - '*\WerFault.exe'
-            - '*\rundll32.exe'
+        CommandLine|endswith:
+            - '\WerFault.exe'
+            - '\rundll32.exe'
    condition: selection
 falsepositives:
    - Unlikely