Update win_susp_wmi_login.yml

2020-10-15 15:54:21 -03:00
parent 496cfcb26a
commit d96bd0d9f3
1 changed files with 1 additions and 1 deletions
@@ -13,7 +13,7 @@ logsource:
 detection:
    selection:
        EventID: 4624
-        ProcessName: "*\\WmiPrvSE.exe"
+        ProcessName|endswith: "\\WmiPrvSE.exe"
    condition: selection
 falsepositives:
    - Monitoring tools