security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: regular expression

Browse Source
This commit is contained in:
Florian Roth
2023-03-16 22:46:08 +01:00
committed by GitHub
parent 4287d790ae
commit e4864b43d2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml
+1 -1
View File
@@ -21,7 +21,7 @@ detection:
ParentImage|endswith: '\svchost.exe'
Image|endswith: '\rundll32.exe'
CommandLine|contains: 'C:\windows\system32\davclnt.dll,DavSetCookie'
CommandLine|re: '//:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
CommandLine|re: ':\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
filter_local_ips:
CommandLine|contains:
- '://10.' #10.0.0.0/8