Update sysmon_susp_office_dotnet_clr_dll_load.yml

2020-10-15 16:06:47 -03:00
parent 0d4f372351
commit ecbec06709
1 changed files with 7 additions and 7 deletions
@@ -16,13 +16,13 @@ logsource:
    product: windows
 detection:
    selection:
-        Image:
-            - '*\winword.exe'
-            - '*\powerpnt.exe'
-            - '*\excel.exe'
-            - '*\outlook.exe'
-        ImageLoaded:
-            - '*\clr.dll*'
+        Image|endswith:
+            - '\winword.exe'
+            - '\powerpnt.exe'
+            - '\excel.exe'
+            - '\outlook.exe'
+        ImageLoaded|contains:
+            - '\clr.dll'
    condition: selection
 falsepositives:
    - Alerts on legitimate macro usage as well, will need to filter as appropriate