Update proc_creation_win_rundll32_parent_explorer.yml

2022-05-22 15:21:41 -04:00
parent 1e728d9598
commit e9976bc3db
1 changed files with 2 additions and 0 deletions
@@ -12,6 +12,8 @@ detection:
    selection:
        Image|endswith: '\rundll32.exe'
        ParentImage|endswith: '\explorer.exe'
+    filter:
+         CommandLine|contains: '\shell32.dll,OpenAs_RunDLL'
    condition: selection
 fields:
    - Image