Update rules/network/initial_access_potential_toolshell_exploit_attempt.toml

Co-authored-by: Jonhnathan <[email protected]>

Author: terrancedejesus

rules/network/initial_access_potential_toolshell_exploit_attempt.toml

@@ -42,13 +42,12 @@ type = "query"
 
 query = '''
 data_stream.dataset : "network_traffic.http" and
-    url.path: /_layouts*ToolPane.aspx and
+    url.path: (/_layouts*ToolPane.aspx* or /_layouts*toolpane.aspx*) and
     http.request.referrer: *SignOut.aspx and
-    http.request.headers.content-type: "application/x-www-form-urlencoded" and
     network.direction: "ingress" and
     http.request.method: "POST" and
     request: (*MSOTlPn_Uri* and *DisplayMode*) and
-    http.request.body.bytes >  5000
+    http.request.body.bytes >  2000
 '''