fix

rules/windows/process_creation/process_creation_dotnet.yml

@@ -16,9 +16,9 @@ logsource:
     product: windows
 detection:
     selection:
-        ProcessCommandline|contains:
-            - '*.dll'
-            - '*.csproj'
+        Commandline|endswith:
+            - '.dll'
+            - '.csproj'
         Image|endswith:
             - '\dotnet.exe'
     condition: selection

rules/windows/process_creation/process_creation_msdeploy.yml

@@ -1,9 +1,9 @@
-title: Msdeploy.exe LOLBIN
+title: Execute Files with Msdeploy.exe
 status: experimental
 id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3
 author: Beyu Denis, oscd.community
 date: 2020/10/18
-description: launch binary via msdeploy.exe
+description: Detects file execution using the msdeploy.exe lolbin
 references:
     - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Msdeploy.yml
     - https://twitter.com/pabraeken/status/995837734379032576
@@ -16,7 +16,7 @@ logsource:
     product: windows
 detection:
     selection:
-        ProcessCommandline|contains|all:
+        Commandline|contains|all:
             - 'verb:sync'
             - '-source:RunCommand'
             - '-dest:runCommand'