Update rules/windows/process_creation/proc_creation_win_iis_service_account_password_dumped.yml

Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
2022-11-19 15:06:36 +11:00
parent 09d6d3e407
commit fcd41ed3e3
1 changed files with 1 additions and 3 deletions
@@ -19,9 +19,7 @@ detection:
        - Image|endswith: '\appcmd.exe'
        - OriginalFilename: 'appcmd.exe'
    selection_list:
-        CommandLine|contains:
-            - ' /list '
-            - ' list '
+        CommandLine|contains: 'list '
    selection_cmd1:
        CommandLine|contains|all:
            - ' /text'