Update rules/windows/image_load/image_load_susp_vss_dll_load.yml

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
2022-10-31 19:33:13 +01:00
parent 20ef4b880c
commit f27ddc8a0f
1 changed files with 4 additions and 1 deletions
@@ -19,7 +19,10 @@ detection:
            - '\vsstrace.dll'
            - '\vssapi.dll'
    filter_legit:
-        Image|contains: 'c:\windows\'
+        Image|startswith:
+            - 'C:\Windows\'
+            - 'C:\Program Files\'
+            - 'C:\Program Files (x86)\
    condition: selection and not 1 of filter_*
 falsepositives:
    - Unknown