fix: selection to use all strings

SigmaHQ · Jul 25, 2023 · 250d6c0 · 250d6c0
1 parent 9f9f232
commit 250d6c0
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml b/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml
@@ -6,6 +6,7 @@ references:
     - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023/02/21
+modified: 2023/07/25
 tags:
     - attack.lateral_movement
     - attack.t1021.002
@@ -21,7 +22,7 @@ detection:
             - 'net.exe'
             - 'net1.exe'
     selection_cli:
-        CommandLine|contains:
+        CommandLine|contains|all:
             - ' use '
             - ' http'
     condition: all of selection_*