Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel

2021-08-17 12:03:54 +02:00
parent 80b3acfce9 d2790f2450
commit 9684c4e55f
2 changed files with 3 additions and 3 deletions
@@ -1,5 +1,5 @@
 title: Procdump Usage
-id: 03795938-1387-481b-9f4c-3f6241e604fe
+id: 2e65275c-8288-4ab4-aeb7-6274f58b6b20
 description: Detects uses of the SysInternals Procdump utility
 status: experimental
 references:
@@ -16,11 +16,11 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine|contains:
+        CommandLine|contains|all:
            - ' -ma '
            - ' -accepteula '
    condition: selection
 falsepositives:
    - Another tool that uses the command line switches of Procdump
    - Legitimate use of procdump by a developer or administrator
-level: high
+level: high