fix: rule string casing

bboosz · Mar 16, 2021 · 5534a7d · 5534a7d
1 parent 95b6adf
commit 5534a7d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/yara/mal_exchange_cryptominer.yar b/yara/mal_exchange_cryptominer.yar
@@ -7,7 +7,7 @@ rule MAL_Exchange_CryptoMiner_Mar21_1 {
       score = 60
    strings:
       $s1 = "wmic.exe product where"
-      $s2 = "%Antivirus%"
+      $s2 = "%AntiVirus%"
       $s3 = "call uninstall /noninteractive"
    condition:
       all of them