fix: update hostname field

SigmaHQ · Apr 19, 2023 · 08e3089 · 08e3089
1 parent 497d856
commit 08e3089
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/rules/windows/network_connection/net_connection_win_binary_susp_com.yml b/rules/windows/network_connection/net_connection_win_binary_susp_com.yml
@@ -33,13 +33,13 @@ detection:
     selection_domains:
         Initiated: 'true'
         DestinationHostname|endswith:
-            - '.ghostbin.co/'
+            - '.ghostbin.co'
             - '.githubusercontent.com'       # Includes both gists and github repositories / Michael Haag (idea)
-            - '.hastebin.com/raw/'
+            - '.hastebin.com'
             - '.paste.ee'
             - '.pastebin.com'
             - 'anonfiles.com'
-            - 'cdn.discordapp.com/attachments/'
+            - 'cdn.discordapp.com'
             - 'ddns.net'
             - 'dl.dropboxusercontent.com'
             - 'mediafire.com'

diff --git a/rules/windows/network_connection/net_connection_win_reddit_api_non_browser_access.yml b/rules/windows/network_connection/net_connection_win_reddit_api_non_browser_access.yml
@@ -17,7 +17,7 @@ logsource:
     category: network_connection
 detection:
     selection:
-        DestinationHostname|contains: 'reddit.com/api'
+        DestinationHostname|contains: 'reddit.com' # Match with Reddit API when you can
     # Other browsers or apps known to use reddit should be added
     # TODO: Add full paths for default install locations
     filter_optional_brave: