refactor: any finding in spool drivers is relevant

2021-07-01 09:46:35 +02:00
parent 3382d5da09
commit a9500a3b1a
1 changed files with 3 additions and 8 deletions
@@ -13,14 +13,9 @@ tag:
 logsource:
    product: antivirus
 detection:
-    selection_path:
-        FileName|contains:
-            - 'C:\Windows\System32\spool\drivers\x64\'
-    selection_malware:
-        FileName|endswith:
-            - '.dll'
-            - '.exe'
-    condition: selection_path and selection_malware
+    selection:
+        FileName|contains: 'C:\Windows\System32\spool\drivers\x64\'
+    condition: selection
 fields:
    - Signature
    - FileName