Remove too loose filter in notepad updater rule

jiluhu · Apr 4, 2019 · 840eb2f · 840eb2f
1 parent 81693d8
commit 840eb2f
Showing 1 changed file with 0 additions and 2 deletions.
diff --git a/rules/windows/process_creation/win_susp_gup.yml b/rules/windows/process_creation/win_susp_gup.yml
@@ -14,8 +14,6 @@ logsource:
 detection:
     selection:
         Image: '*\GUP.exe'
-    filter:
-        Image: '*\updater\*'
     condition: selection and not filter
 falsepositives:
     - Execution of tools named GUP.exe and located in folders different than Notepad++\updater