refactor: removed OriginalFileName from rule to improve compatibilty

2021-08-12 13:28:24 +02:00
parent 34d70de084
commit d9d543e545
1 changed files with 1 additions and 3 deletions
@@ -17,9 +17,7 @@ logsource:
 detection:
    selection:
        Image|endswith: '\whoami.exe'
-    selection2:
-        OriginalFileName: 'whoami.exe'
-    condition: selection or selection2
+    condition: selection
 falsepositives:
    - Admin activity
    - Scripts and administrative tools used in the monitored environment