From f00aaf8461f97abec19f81aa4fc0edaa76ff6cf1 Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Thu, 9 Sep 2021 12:55:10 +0200 Subject: [PATCH] refactor: exclude case in which upper ticks are used --- .../process_creation/win_susp_control_cve_2021_40444.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rules/windows/process_creation/win_susp_control_cve_2021_40444.yml b/rules/windows/process_creation/win_susp_control_cve_2021_40444.yml index 312b047b7..2a02b7ad7 100644 --- a/rules/windows/process_creation/win_susp_control_cve_2021_40444.yml +++ b/rules/windows/process_creation/win_susp_control_cve_2021_40444.yml @@ -20,7 +20,9 @@ detection: - '\powerpnt.exe' - '\excel.exe' filter: - CommandLine|endswith: '\control.exe input.dll' + CommandLine|endswith: + - '\control.exe input.dll' + - '\control.exe" input.dll' condition: selection and not filter falsepositives: - Unknown