Search ? char

2022-08-13 12:11:32 +02:00
parent fecd7e2fbd
commit c8ab532955
1 changed files with 2 additions and 1 deletions
@@ -3,6 +3,7 @@ id: a4824fca-976f-4964-b334-0621379e84c4
 status: experimental
 author: frack113
 date: 2021/06/03
+modified: 2022/08/13
 description: Use of SDelete to erase a file not the free space
 references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
@@ -20,7 +21,7 @@ detection:
            - ' -h'
            - ' -c'
            - ' -z'
-            - ' /?'
+            - ' /\?'
    condition: selection and not filter
 fields:
    - ComputerName