fix: FPs - extended filter

V1D1AN · Nov 20, 2021 · dfbaadf · dfbaadf
1 parent 8271b04
commit dfbaadf
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/rules/windows/image_load/sysmon_uipromptforcreds_dlls.yml b/rules/windows/image_load/sysmon_uipromptforcreds_dlls.yml
@@ -25,9 +25,8 @@ detection:
             - 'credui.dll'
             - 'wincredui.dll'
     filter:
-        Image: 
-            - 'C:\Windows\System32\Taskmgr.exe'
-            - 'C:\Windows\System32\consent.exe'
+        Image|startswith: 
+            - 'C:\Windows\System32\'
             - 'C:\Windows\explorer.exe'
     condition: selection and not filter
 falsepositives: