Correct misspelling of AppDara to AppData (#2952)
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
creation_date = "2023/01/12"
|
||||
integration = ["endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/07/20"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
|
||||
@@ -31,7 +31,7 @@ process where host.os.type == "windows" and event.type == "start" and
|
||||
(process.name : "wsl.exe" and process.args : ("-d", "--distribution", "-i", "--install") and process.args : "kali*") or
|
||||
process.executable :
|
||||
("?:\\Users\\*\\AppData\\Local\\packages\\kalilinux*",
|
||||
"?:\\Users\\*\\AppDara\\Local\\Microsoft\\WindowsApps\\kali.exe",
|
||||
"?:\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
|
||||
"?:\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe")
|
||||
)
|
||||
'''
|
||||
|
||||
Reference in New Issue
Block a user