Merge pull request #3268 from nasbench/nasbench-rule-dev

Fix typo
2022-07-25 12:30:27 +02:00
parent e1afd68f40 524ea4bfeb
commit ee2aae08b8
1 changed files with 2 additions and 0 deletions
@@ -7,12 +7,14 @@ references:
    - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
    - https://twitter.com/wdormann/status/1547583317410607110
 date: 2022/07/17
+modified: 2022/07/25
 logsource:
    product: windows
    category: image_load
 detection:
    selection:
        Image: C:\Windows\SysWOW64\iscsicpl.exe
+        ImageLoaded|endswith: '\iscsiexe.dll'
    filter:
        ImageLoaded|contains|all:
            - 'C:\Windows\'