Update win_susp_ntlm_rdp.yml

2020-10-15 15:50:44 -03:00
parent 9b8817f489
commit dae1f3fa71
1 changed files with 1 additions and 1 deletions
@@ -16,7 +16,7 @@ logsource:
 detection:
    selection:
        EventID: 8001
-        TargetName: TERMSRV*
+        TargetName|startswith: TERMSRV
    condition: selection
 fields:
    - Computer