refactor: exclude case in which upper ticks are used

2021-09-09 12:55:10 +02:00
parent 6d86c7df6c
commit f00aaf8461
1 changed files with 3 additions and 1 deletions
@@ -20,7 +20,9 @@ detection:
            - '\powerpnt.exe'
            - '\excel.exe'
    filter:
-        CommandLine|endswith: '\control.exe input.dll'
+        CommandLine|endswith: 
+            - '\control.exe input.dll'
+            - '\control.exe" input.dll'
    condition: selection and not filter
 falsepositives:
    - Unknown