Update win_hwp_exploits.yml

2020-10-15 17:55:04 -03:00
parent d1e447a3fd
commit 9e99832b76
1 changed files with 2 additions and 2 deletions
@@ -25,8 +25,8 @@ logsource:
    product: windows
 detection:
    selection:
-        ParentImage: '*\Hwp.exe'
-        Image: '*\gbb.exe'
+        ParentImage|endswith: '\Hwp.exe'
+        Image|endswith: '\gbb.exe'
    condition: selection
 falsepositives:
    - Unknown