Merge pull request SigmaHQ#996 from fryguy04/master

removed leading slash and allow for mult spaces
lukiffer · Oct 12, 2020 · f064102 · f064102
2 parents 976fc92 + 2e6f87e
commit f064102
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/rules/windows/process_creation/win_susp_ping_hex_ip.yml b/rules/windows/process_creation/win_susp_ping_hex_ip.yml
@@ -15,9 +15,9 @@ logsource:
     product: windows
 detection:
     selection:
-        CommandLine:
-            - '*\ping.exe 0x*'
-            - '*\ping 0x*'
+        CommandLine|contains:
+            - 'ping.exe*0x*'
+            - 'ping*0x*'
     condition: selection
 fields:
     - ParentCommandLine