Merge pull request #725 from WilliamBruneau/fix_null_list

Move null values out from list in rules
2020-06-03 15:53:55 +02:00
parent 022d73f842 84dd8c39c4
commit d97d2ced82
1 changed files with 5 additions and 5 deletions
@@ -17,11 +17,11 @@ logsource:
 detection:
    selection:
        EventID: 15
-    filter:
-        Imphash: 
-            - '00000000000000000000000000000000'
-            - null
-    condition: selection and not filter
+    filter1:
+        Imphash: '00000000000000000000000000000000'
+    filter2:
+        Imphash: null
+    condition: selection and not 1 of filter*
 fields:
    - TargetFilename
    - Image