update UserInitMprLogonScript rule

mandiant · Dec 3, 2024 · cf67b5d · cf67b5d
1 parent b39b921
commit cf67b5d
Showing 1 changed file with 1 addition and 3 deletions.
diff --git a/nursery/persist-via-userinitmprlogonscript-registry-value.yml b/nursery/persist-via-userinitmprlogonscript-registry-value.yml
@@ -14,7 +14,5 @@ rule:
   features:
     - and:
       - match: set registry value
-      - or:
-        - string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\Session Manager\\Environment/i
-        - string: /Environment/i
+      - string: /Environment/i
       - string: /UserInitMprLogonScript/i