Update win_mal_ursnif.yml

2020-10-15 16:18:38 -03:00
parent 983e9cb9ae
commit acfe0633e2
1 changed files with 1 additions and 1 deletions
@@ -16,7 +16,7 @@ logsource:
 detection:
    selection:
        EventID: 13
-        TargetObject: '*\Software\AppDataLow\Software\Microsoft\\*'
+        TargetObject|contains: '\Software\AppDataLow\Software\Microsoft\\'
    condition: selection
 falsepositives:
    - Unknown