Wget/Curl Download and Bash Execution: Changing logic for search terms, to make searches comply with title and intention

detections/endpoint/curl_download_and_bash_execution.yml

@@ -12,7 +12,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
-  (Processes.process="*-s *") OR (Processes.process="*|*" AND Processes.process="*bash*")
+  (Processes.process="*-s *") AND (Processes.process="*|*" AND Processes.process="*bash*")
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`'

detections/endpoint/wget_download_and_bash_execution.yml

@@ -13,7 +13,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wget
   (Processes.process="*-q *" OR Processes.process="*--quiet*"  AND Processes.process="*-O-
-  *") OR (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest
+  *") AND (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wget_download_and_bash_execution_filter`'