fix: apply suggestions from code review

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
2022-12-22 14:25:50 +01:00
parent 3b54d8de79
commit cc3dce61d7
2 changed files with 3 additions and 2 deletions
@@ -17,7 +17,7 @@ detection:
        # Look for the header: X-OWA-ExplicitLogonUser: owa/mastermailbox@outlook.com
        cs-method: 'POST'
        c-uri|contains|all:
-            - '/owa/mastermailbox'
+            - '/owa/'
            - '/powershell'
    condition: selection
 falsepositives:
@@ -17,7 +17,8 @@ detection:
        # Look for the header: X-OWA-ExplicitLogonUser: owa/mastermailbox@outlook.com
        cs-method: 'POST'
        c-uri|contains|all:
-            - '/owa/mastermailbox'
+            - '/owa/'
+            - `@`
            - '/powershell'
    condition: selection
 falsepositives: