Merge pull request SigmaHQ#979 from barvhaim/patch-3

Update win_susp_rasdial_activity.yml to use `contains` instead of `equal`
veritasr3x · Aug 18, 2020 · 79adace · 79adace
2 parents fd23a18 + bc74ac1
commit 79adace
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/windows/process_creation/win_susp_rasdial_activity.yml b/rules/windows/process_creation/win_susp_rasdial_activity.yml
@@ -16,8 +16,8 @@ logsource:
     product: windows
 detection:
     selection:
-        CommandLine:
-            - rasdial
+        Image|endswith:
+            - rasdial.exe
     condition: selection
 falsepositives:
     - False positives depend on scripts and administrative tools used in the monitored environment