rule: extended csc rule

2019-08-28 09:00:43 +02:00
parent 406b40af11
commit f71dc41531
1 changed files with 3 additions and 1 deletions
@@ -15,7 +15,9 @@ logsource:
 detection:
    selection:
        Image: '*\csc.exe'
-        CommandLine: '*\AppData\*'
+        CommandLine: 
+            - '*\AppData\*'
+            - '*\Windows\Temp\*'
    condition: selection
 falsepositives:
    - Unkown