Update sysmon_lazagne_cred_dump_lsass_access.yml

2020-11-20 01:32:41 -03:00
parent 2194744803
commit ebd9973dcb
1 changed files with 5 additions and 1 deletions
@@ -16,7 +16,11 @@ logsource:
 detection:
    selection: 
        TargetImage|endswith: '\lsass.exe'
-        CallTrace: "C:\\Windows\\SYSTEM32\\ntdll.dll+*|C:\\Windows\\System32\\KERNELBASE.dll+*_ctypes.pyd+*python27.dll+*"
+        CallTrace|contains|all: 
+            - 'C:\\Windows\\SYSTEM32\\ntdll.dll+'
+            - '|C:\\Windows\\System32\\KERNELBASE.dll+'
+            - '_ctypes.pyd+'
+            - 'python27.dll+'
        GrantedAccess: "0x1FFFFF"
    condition: selection
 level: critical