Update win_susp_ping_hex_ip.yml

2020-10-15 19:34:00 -03:00
parent 6bb9f1b3c9
commit 90d20094ac
1 changed files with 3 additions and 3 deletions
@@ -15,9 +15,9 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine:
-            - '*\ping.exe 0x*'
-            - '*\ping 0x*'
+        CommandLine|contains:
+            - '\ping.exe 0x'
+            - '\ping 0x'
    condition: selection
 fields:
    - ParentCommandLine