fixed contains rules

Author: SwiftOnSecurity

z-AlphaVersion.xml

@@ -625,9 +625,9 @@
 			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\WinStations\RDP-Tcp\PortNumber</TargetObject> <!--Windows: RDP port change under Control [ https://blog.menasec.net/2019/02/of-rdp-hijacking-part1-remote-desktop.html ]-->
 			<TargetObject name="RDP port change" condition="end with">Control\Terminal Server\fSingleSessionPerUser</TargetObject>
 			<TargetObject name="ModifyRemoteDesktopState" condition="end with">fDenyTSConnections</TargetObject>
-			<TargetObject condition="contains">LastLoggedOnUser</TargetObject>
-			<TargetObject name="ModifyRemoteDesktopPort"  condition="contains">RDP-tcp\PortNumber</TargetObject>
-			<TargetObject condition="contains">Services\PortProxy\v4tov4</TargetObject>
+			<TargetObject condition="end with">LastLoggedOnUser</TargetObject>
+			<TargetObject name="ModifyRemoteDesktopPort" condition="end with">RDP-tcp\PortNumber</TargetObject>
+			<TargetObject condition="end with">Services\PortProxy\v4tov4</TargetObject>
 
 			<!--CLSID launch commands and Default File Association changes-->
 			<TargetObject name="T1042" condition="contains">\command\</TargetObject> <!--Windows: Sensitive sub-key under file associations and CLSID that map to launch command-->