Update sysmon_dhcp_calloutdll.yml

2020-10-15 20:02:58 -03:00
parent 337e26a034
commit bdca2febe9
1 changed files with 3 additions and 4 deletions
@@ -19,10 +19,9 @@ logsource:
    product: windows
 detection:
    selection:
-        
-        TargetObject:
-            - '*\Services\DHCPServer\Parameters\CalloutDlls'
-            - '*\Services\DHCPServer\Parameters\CalloutEnabled'
+        TargetObject|endswith:
+            - '\Services\DHCPServer\Parameters\CalloutDlls'
+            - '\Services\DHCPServer\Parameters\CalloutEnabled'
    condition: selection
 falsepositives:
    - unknown