Update av_relevant_files.yml

rules/windows/malware/av_relevant_files.yml

@@ -10,32 +10,34 @@ logsource:
     product: antivirus
 detection:
     selection:
-        FileName:
-            - 'C:\Windows\Temp\\*'
-            - 'C:\Temp\\*'
-            - '*\\Client\\*'
-            - 'C:\PerfLogs\\*'
-            - 'C:\Users\Public\\*'
-            - 'C:\Users\Default\\*'
-            - '*.ps1'
-            - '*.vbs'
-            - '*.bat'
-            - '*.chm'
-            - '*.xml'
-            - '*.txt'
-            - '*.jsp'
-            - '*.jspx'
-            - '*.asp'
-            - '*.aspx'
-            - '*.php'
-            - '*.war'
-            - '*.hta'
-            - '*.lnk'
-            - '*.scf'
-            - '*.sct'
-            - '*.vbe'
-            - '*.wsf'
-            - '*.wsh'
+        FileName|startswith:
+            - 'C:\Windows\Temp\\'
+            - 'C:\Temp\\'
+            - 'C:\PerfLogs\\'
+            - 'C:\Users\Public\\'
+            - 'C:\Users\Default\\'
+        Filename|contains:
+            - '\\Client\\'
+        Filename|endswith:
+            - '.ps1'
+            - '.vbs'
+            - '.bat'
+            - '.chm'
+            - '.xml'
+            - '.txt'
+            - '.jsp'
+            - '.jspx'
+            - '.asp'
+            - '.aspx'
+            - '.php'
+            - '.war'
+            - '.hta'
+            - '.lnk'
+            - '.scf'
+            - '.sct'
+            - '.vbe'
+            - '.wsf'
+            - '.wsh'
     condition: selection
 fields:
     - Signature