Update image_load_dll_rstrtmgr_susp_load.yml

SigmaHQ · Nov 22, 2023 · 0700812 · 0700812
1 parent 4b8a1ec
commit 0700812
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/image_load/image_load_dll_rstrtmgr_susp_load.yml b/rules/windows/image_load/image_load_dll_rstrtmgr_susp_load.yml
@@ -22,7 +22,7 @@ logsource:
     product: windows
 detection:
     selection:
-        ImageLoaded|endswith:
+        - ImageLoaded|endswith:
             - '\RstrtMgr.dll'
         - OriginalFileName:
               - 'RstrtMgr.dll'