Rule needs endwith, not exact match.

Fix ImageLoaded filter to match with endswith, rather than exact match.
2020-06-15 13:54:02 -04:00
parent d371fd864c
commit dfae2a6df6
1 changed files with 1 additions and 1 deletions
@@ -16,7 +16,7 @@ detection:
    selection:
        EventID: 7
        Image: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
-        ImageLoaded: 'wbemcons.dll'
+        ImageLoaded|endswith: '\wbemcons.dll'
    condition: selection
 falsepositives: 
    - Unknown (data set is too small; further testing needed)