Update win_webshell_detection.yml

2020-11-28 13:38:34 -03:00
parent 9f4bbb7e65
commit f0bf3d13b5
1 changed files with 10 additions and 4 deletions
@@ -25,13 +25,19 @@ detection:
            - '\apache'
            - '\tomcat'
    selection2:
-        CommandLine|contains:
+        - CommandLine|contains:
            - 'whoami'
-            - 'net user '
-            - 'ping -n '
            - 'systeminfo'
            - '&cd&echo'
-            - 'cd /d'  # https://www.computerhope.com/cdhlp.htm
+        - CommandLine|contains|all:
+            - 'net'
+            - 'user'
+        - CommandLine|contains|all:
+            - 'cd' # https://www.computerhope.com/cdhlp.htm
+            - '/d'
+        - CommandLine|contains|all:
+            - 'ping'
+            - '-n'
    condition: selection and selection2
 fields:
    - CommandLine