Merge pull request #3983 from qasimqlf/patch-24

fix: value
2023-01-31 13:50:02 +01:00
parent 93f9f1b5f3 9249996504
commit dfe448aba6
1 changed files with 2 additions and 1 deletions
@@ -6,6 +6,7 @@ references:
    - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
 author: frack113
 date: 2022/03/17
+modified: 2023/01/31
 tags:
    - attack.credential_access
    - attack.t1040
@@ -14,7 +15,7 @@ logsource:
    product: windows
 detection:
    selection:
-        - Image|endswith: 'PktMon.exe'
+        - Image|endswith: '\pktmon.exe'
        - OriginalFileName: 'PktMon.exe'
    condition: selection
 falsepositives: