Update win_malware_notpetya.yml

2020-10-15 18:02:08 -03:00
parent 99451424f6
commit da7648f154
1 changed files with 5 additions and 5 deletions
@@ -24,12 +24,12 @@ logsource:
    product: windows
 detection:
    pipe_com:
-        CommandLine: '*\AppData\Local\Temp\\* \\.\pipe\\*'
+        CommandLine|contains: '\AppData\Local\Temp\\* \\.\pipe\\'
    rundll32_dash1:
-        Image: '*\rundll32.exe'
-        CommandLine: '*.dat,#1'
-    perfc_keyword:
-        - '*\perfc.dat*'
+        Image|endswith: '\rundll32.exe'
+        CommandLine|endswith: '.dat,#1'
+    perfc_keyword|contains:
+        - '\perfc.dat'
    condition: 1 of them
 fields:
    - CommandLine