Update image_load_dll_rstrtmgr_susp_load.yml

SigmaHQ · Nov 22, 2023 · fc8c83b · fc8c83b
1 parent 8ac550c
commit fc8c83b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/image_load/image_load_dll_rstrtmgr_susp_load.yml b/rules/windows/image_load/image_load_dll_rstrtmgr_susp_load.yml
@@ -40,7 +40,7 @@ detection:
             - '\TiWorker.exe'
     filter_software_installation:
         Image|startswith: 'C:\Users\'
-        Image|contains:
+        Image|contains|all:
             - '\AppData\Local\Temp\is-'
             - '.tmp\'
         Image|endswith: '.tmp'