Update win_susp_ntdsutil.yml

2020-10-15 19:33:10 -03:00
parent ec9f9fd929
commit 98ebb4965d
1 changed files with 1 additions and 1 deletions
@@ -15,7 +15,7 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine: '*\ntdsutil*'
+        CommandLine|contains: '\ntdsutil'
    condition: selection
 falsepositives:
    - NTDS maintenance