reworked rule

2022-08-02 18:08:39 +02:00
parent afa0d77025
commit e7c57671bd
1 changed files with 4 additions and 4 deletions
@@ -15,10 +15,10 @@ logsource:
 detection:
    selection:
        EventID: 12 # MDE: ExploitGuardNonMicrosoftSignedBlocked
-        ProcessPath|endswith: 
-          - '\MpCmdRun.exe'
-          - '\NisSrv.exe'
-        Image|endswith: '.dll'
+        ProcessPath|endswith:
+            - '\MpCmdRun.exe'
+            - '\NisSrv.exe'
+        ImageName|endswith: '.dll'
    condition: selection
 falsepositives:
    - Unknown