fix: typo in ET Snake malware rule filter (SigmaHQ#4248)

SavinSpring · May 18, 2023 · 4038141 · 4038141
1 parent 62caac4
commit 4038141
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_werfault_creation.yml b/rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_werfault_creation.yml
@@ -6,6 +6,7 @@ references:
     - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023/05/10
+modified: 2023/05/18
 tags:
     - attack.execution
 logsource:
@@ -17,7 +18,7 @@ detection:
         TargetFilename|endswith: '\WerFault.exe'
     filter_main_system_location:
         Image|startswith:
-            - 'C:\Windows\Systems32\'
+            - 'C:\Windows\System32\'
             - 'C:\Windows\SysWOW64\'
             - 'C:\Windows\WinSxS\'
     condition: selection and not 1 of filter_main_*