fix: fixed image in taskmgr rule

SigmaHQ · Jun 21, 2019 · 26036e0 · 26036e0
1 parent ff71282
commit 26036e0
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/windows/process_creation/win_susp_taskmgr_parent.yml b/rules/windows/process_creation/win_susp_taskmgr_parent.yml
@@ -14,8 +14,8 @@ detection:
         ParentImage: '*\taskmgr.exe'
     filter:
         Image:
-            - resmon.exe
-            - mmc.exe
+            - '*\resmon.exe'
+            - '*\mmc.exe'
     condition: selection and not filter
 fields:
     - Image