From dde5b46726afe2bc2fbb3ec27a08d574ed4acfca Mon Sep 17 00:00:00 2001 From: Jonhnathan Date: Tue, 27 Oct 2020 22:01:31 -0300 Subject: [PATCH] Update win_susp_sam_dump.yml --- rules/windows/builtin/win_susp_sam_dump.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/windows/builtin/win_susp_sam_dump.yml b/rules/windows/builtin/win_susp_sam_dump.yml index 19d97f8e2..d014cb46e 100644 --- a/rules/windows/builtin/win_susp_sam_dump.yml +++ b/rules/windows/builtin/win_susp_sam_dump.yml @@ -15,8 +15,9 @@ logsource: detection: selection: EventID: 16 - Message|contains: - - '\AppData\Local\Temp\SAM-*.dmp' + Message|contains|all: + - '\AppData\Local\Temp\SAM-' + - '.dmp' condition: selection falsepositives: - Penetration testing