Merge pull request SigmaHQ#806 from SanWieb/sysmon_creation_system_file

Fixed wrong field & Improve rule
veritasr3x · May 29, 2020 · e20b58c · e20b58c
2 parents 7f2fa05 + a00f7f1
commit e20b58c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/windows/sysmon/sysmon_creation_system_file.yml b/rules/windows/sysmon/sysmon_creation_system_file.yml
@@ -15,7 +15,7 @@ logsource:
 detection:
     selection:
         EventID: 11
-        Image:
+        TargetFilename|endswith:
             - '*\svchost.exe'
             - '*\rundll32.exe'
             - '*\services.exe'
@@ -41,7 +41,7 @@ detection:
             - '*\audiodg.exe'
             - '*\wlanext.exe'
     filter:
-        Image:
+        TargetFilename:
             - 'C:\Windows\System32\\*'
             - 'C:\Windows\system32\\*'
             - 'C:\Windows\SysWow64\\*'