fix: syntax bug in rule

veritasr3x · Sep 3, 2020 · 720ac0d · 720ac0d
1 parent 198469b
commit 720ac0d
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/rules/windows/process_creation/win_mouse_lock.yml b/rules/windows/process_creation/win_mouse_lock.yml
@@ -15,9 +15,9 @@ logsource:
     category: process_creation
 detection:
     selection:
-        Product:|contains: 'Mouse Lock'
-        Company:|contains: 'Misc314'
-        CommandLine:|contains: 'Mouse Lock_'
+        - Product|contains: 'Mouse Lock'
+        - Company|contains: 'Misc314'
+        - CommandLine|contains: 'Mouse Lock_'
     condition: selection
 fields:
     - Product