Skip to content

Commit a1a10aa

Browse files
Update rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml
fix typo
1 parent 54e288f commit a1a10aa

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ detection:
3131
- ' ls' # Short for lsass
3232
- ' keyiso'
3333
- ' samss'
34-
condition: all of selection*
34+
condition: all of selection_*
3535
falsepositives:
3636
- Unlikely, because no one should dump an lsass process memory
3737
- Another tool that uses command line flags similar to ProcDump

0 commit comments

Comments
 (0)