Update win_susp_copy_system32.yml

2020-11-20 02:31:26 -03:00
parent 5d7131bbf2
commit ec1944e2d7
1 changed files with 4 additions and 2 deletions
@@ -16,8 +16,10 @@ tags:
 detection:
    selection:
        CommandLine|contains: 
-            - ' /c copy *\System32\'
-            - 'xcopy*\System32\'
+            - ' /c copy'
+            - 'xcopy'
+        CommandLine|contains|all:
+            - '\System32\'
    condition: selection
 fields:
    - CommandLine