Add tagg Endswith

Prevent the trigger of {}.exe.log
adityavarma9 · May 29, 2020 · a00f7f1 · a00f7f1
1 parent 38afd8b
commit a00f7f1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/sysmon/sysmon_creation_system_file.yml b/rules/windows/sysmon/sysmon_creation_system_file.yml
@@ -15,7 +15,7 @@ logsource:
 detection:
     selection:
         EventID: 11
-        TargetFilename:
+        TargetFilename|endswith:
             - '*\svchost.exe'
             - '*\rundll32.exe'
             - '*\services.exe'