Remove too loose filter in mshta rule

2019-04-04 22:16:24 +02:00
parent 81693d81b6
commit eb690d8902
1 changed files with 0 additions and 4 deletions
@@ -20,10 +20,6 @@ detection:
            - '*\reg.exe'
            - '*\regsvr32.exe'
            - '*\BITSADMIN*'
-    filter:
-        CommandLine:
-            - '*/HP/HP*'
-            - '*\HP\HP*'
    condition: selection and not filter
 fields:
    - CommandLine