Fix process creation rule: use single value for Image|endswith

Author: mromanode

…tion_win_curl_sharepoint_jwt_forgery.yml …tion_win_sharepoint_jwt_exploitation.ymlrules/windows/process_creation/proc_creation_win_curl_sharepoint_jwt_forgery.yml renamed to rules/windows/process_creation/proc_creation_win_sharepoint_jwt_exploitation.yml rules/windows/process_creation/proc_creation_win_curl_sharepoint_jwt_forgery.yml renamed to rules/windows/process_creation/proc_creation_win_sharepoint_jwt_exploitation.yml

@@ -2,8 +2,8 @@ title: Suspicious SharePoint JWT Exploitation via Curl
 id: 7a4b9f1e-2e7d-4f8a-9d1b-3e5c6f8a2b4d
 status: experimental
 description: |
-  Detects curl process execution matching command-line arguments generated by
-  the CVE-2026-55040 SharePoint authentication bypass exploit script.
+  Detects curl process execution matching command-line arguments generated by the CVE-2026-55040.
+  The presence of a raw NTLM Type-1 blob and SharePoint API endpoint requests.
 references:
   - https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/
   - https://github.com/sfewer-r7/CVE-2026-55040
@@ -17,17 +17,15 @@ tags:
   - attack.t1212
 detection:
   selection_curl:
-    Image|endswith:
-      - '\curl.exe'
-      - '\curl'
+    Image|endswith: '\curl.exe'
   selection_path:
     CommandLine|contains: "--path-as-is"
   selection_payload:
     CommandLine|contains:
-      - "TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKABhKAAAADw==" # NTLM Type-1 blob used by the script
-      - "/_layouts/15/metadata/json/1" # STS metadata endpoint
-      - "Authorization: Bearer eyJ" # Base64url JWT token header
+      - "TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKABhKAAAADw=="
+      - "/_layouts/15/metadata/json/1"
+      - "Authorization: Bearer eyJ"
   condition: selection_curl and selection_path and selection_payload
 falsepositives:
-  - Unlikely; curl commands with these exact combinations are not standard.
+  - Unlikely
 level: high