fix: null value in separate expression

fslds · Jul 2, 2019 · 0b883a9 · 0b883a9
1 parent f5a8a81
commit 0b883a9
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/rules/windows/process_creation/win_susp_svchost.yml b/rules/windows/process_creation/win_susp_svchost.yml
@@ -18,8 +18,9 @@ detection:
             - '*\MsMpEng.exe'
             - '*\Mrt.exe'
             - '*\rpcnet.exe'
-            - null
-    condition: selection and not filter
+    filter_null:
+        ParentImage: null
+    condition: selection and not filter and not filter_null
 fields:
     - CommandLine
     - ParentCommandLine