update syntax to re-run the test once more...

2020-10-20 21:17:59 +02:00
parent 40f6d5e543
commit f050cedf92
1 changed files with 1 additions and 2 deletions
@@ -16,8 +16,7 @@ logsource:
 detection:
    selection:
        Image|endswith: '\regedit.exe'
-        CommandLine|contains:
-            - ' /E '
+        CommandLine|contains: ' /E '
        filter_1: # filters to avoid intersection with critical keys rule
            CommandLine|contains:
                - 'hklm'