chg: [scenario:campaign-multi-isacs] Updated registry-key inject

MISP · Sep 6, 2024 · 42f0cf0 · 42f0cf0
1 parent a1ebdf4
commit 42f0cf0
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/scenarios/Campaign Targeting Multiple ISACs.json b/scenarios/Campaign Targeting Multiple ISACs.json
@@ -391,11 +391,11 @@
                             }
                         },
                         {
-                            "[.Event.Object[].Attribute[], .Event.Attribute[]] | .[].value": {
+                            "[.Event.Object[].Attribute[], .Event.Attribute[]] | .[] | select(.value | match(\"HKCU.+SOFTWARE.+MSCall.\"))": {
                                 "extract_type": "all",
-                                "comparison": "contains-regex",
+                                "comparison": "count",
                                 "values": [
-                                    "HKCU.+SOFTWARE.+MSCall.*"
+                                    ">=1"
                                 ]
                             }
                         }
@@ -485,4 +485,4 @@
             "description": "The XOR Key"
         }
     ]
-}
+}