fix: wrong condition

2022-12-15 19:02:56 +01:00
parent 0b3a068327
commit b1504c7632
1 changed files with 1 additions and 1 deletions
@@ -23,7 +23,7 @@ detection:
        DestinationIp|startswith: '51.10'  # Microsoft Range
    filter_cmdline:
        CommandLine|contains: '\UpdateDeploy.dll /ClassId '
-    condition: selection
+    condition: selection and not 1 of filter*
 falsepositives:
    - Legitimate use of wuauclt.exe over the network.
 level: medium