Merge pull request SigmaHQ#3769 from qasimqlf/patch-15

Fix the filter
Korving-F · Dec 9, 2022 · 9afbf6d · 9afbf6d
2 parents 30ca301 + 868be24
commit 9afbf6d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_susp_userinit_child.yml b/rules/windows/process_creation/proc_creation_win_susp_userinit_child.yml
@@ -6,7 +6,7 @@ references:
     - https://twitter.com/SBousseaden/status/1139811587760562176
 author: Florian Roth (rule), Samir Bousseaden (idea)
 date: 2019/06/17
-modified: 2022/10/09
+modified: 2022/12/09
 tags:
     - attack.defense_evasion
     - attack.t1055
@@ -20,7 +20,7 @@ detection:
         CommandLine|contains: '\netlogon\'
     filter2:
         - Image|endswith: '\explorer.exe'
-        - ImageFileName: 'explorer.exe'
+        - OriginalFileName: 'explorer.exe'
     condition: selection and not 1 of filter*
 fields:
     - CommandLine