Improved tscon rule

2018-03-20 10:54:04 +01:00
parent 8fb6bc7a8a
commit a6d293e31d
1 changed files with 1 additions and 1 deletions
@@ -10,7 +10,7 @@ author: Florian Roth
 date: 2018/03/17
 detection:
    selection:
-        CommandLine: '*\tscon.exe * /dest:rdp-tcp:*'
+        CommandLine: '* /dest:rdp-tcp:*'
    condition: selection
 falsepositives:
    - Unknown