Update condition to filter out printer port

2020-05-14 18:22:49 +07:00
parent 443bf09d27
commit e53a97fa2f
1 changed files with 2 additions and 2 deletions
@@ -18,8 +18,8 @@ detection:
        EventID: 3
        Image: '*\notepad.exe'
    filter:
-        DestinationPort: 9100
-    condition: selection
+        DestinationPort: '9100'
+    condition: selection and not filter
 falsepositives:
    - None observed so far
 level: high