Update proc_creation_win_findstr_subfolder_search.yml

SigmaHQ · Nov 11, 2023 · 491829f · 491829f
1 parent b5fb5db
commit 491829f
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml b/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml
@@ -27,15 +27,15 @@ detection:
         - CommandLine|contains: findstr
         - Image|endswith: 'findstr.exe'
         - OriginalFileName: 'FINDSTR.EXE'
-    selection_cli_creds_1:
+    selection_cli_search_subfolder:
         CommandLine|contains:
             - ' /s '
             - ' -s '
-    selection_cli_creds_2:
+    selection_cli_search_insensitive:
         CommandLine|contains:
             - ' /i '
             - ' -i '
-    condition: selection_findstr and all of selection_cli_download_*
+    condition: selection_findstr and all of selection_cli_search_*
 falsepositives:
     - Administrative or software activity
 level: low