diff --git a/rules/windows/process_creation/win_mshta_spawn_shell.yml b/rules/windows/process_creation/win_mshta_spawn_shell.yml index d437e26d8..e4bed4a29 100644 --- a/rules/windows/process_creation/win_mshta_spawn_shell.yml +++ b/rules/windows/process_creation/win_mshta_spawn_shell.yml @@ -20,10 +20,6 @@ detection: - '*\reg.exe' - '*\regsvr32.exe' - '*\BITSADMIN*' - filter: - CommandLine: - - '*/HP/HP*' - - '*\HP\HP*' condition: selection and not filter fields: - CommandLine