Merge PR SigmaHQ#4799 from @fukusuket - Fix typo in selection name

chore: fix typo in selection name
SavinSpring · Apr 15, 2024 · 1a85bc5 · 1a85bc5
1 parent ae49e3a
commit 1a85bc5
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml b/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml
@@ -9,7 +9,7 @@ references:
     - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
 author: frack113
 date: 2022/02/04
-modified: 2024/03/26
+modified: 2024/04/03
 tags:
     - attack.persistence
     - attack.privilege_escalation
@@ -32,7 +32,7 @@ detection:
         Details: '%%systemroot%%\system32\ntdsa.dll'
     filter_main_poqexec:
         Image: 'C:\Windows\System32\poqexec.exe'
-    filter_optional_safetica\:
+    filter_optional_safetica:
         Image|endswith: '\regsvr32.exe'
         Details: 'C:\Windows\System32\STAgent.dll'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*