Update detections/endpoint/windows_service_create_kernel_mode_driver.yml

Co-authored-by: Nasreddine Bencherchali <[email protected]>

Author: tccontre

detections/endpoint/windows_service_create_kernel_mode_driver.yml

@@ -19,7 +19,7 @@ data_source:
 - CrowdStrike ProcessRollup2
 search: |
   | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name=sc.exe (Processes.process="*kernel*" OR Processes.process="*filesys*") 
+    where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe)  Processes.process IN ("*kernel*", "*filesys*") Processes.process="*type*"
   by Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path