Update win_susp_sam_dump.yml

2020-10-27 22:01:31 -03:00
parent 61ccdc598d
commit dde5b46726
1 changed files with 3 additions and 2 deletions
@@ -15,8 +15,9 @@ logsource:
 detection:
    selection:
        EventID: 16
-        Message|contains:
-            - '\AppData\Local\Temp\SAM-*.dmp'
+        Message|contains|all:
+            - '\AppData\Local\Temp\SAM-'
+            - '.dmp'
    condition: selection
 falsepositives:
    - Penetration testing