diff --git a/rules/windows/file_event/win_file_winword_cve_2021_40444.yml b/rules/windows/file_event/win_file_winword_cve_2021_40444.yml index 777217355..1c20b1f83 100644 --- a/rules/windows/file_event/win_file_winword_cve_2021_40444.yml +++ b/rules/windows/file_event/win_file_winword_cve_2021_40444.yml @@ -17,7 +17,7 @@ detection: TargetFilename|contains: '\Windows\INetCache' selection_inf: Image: '\winword.exe' - TargetFilename|contains|all: + TargetFilename|contains|all: - '\AppData\Local\Temp\' - '.inf' condition: selection or selection_inf