Update proc_creation_win_ssh_proxy_execution.yml

Author: nasbench

rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml

@@ -10,7 +10,7 @@ references:
     - https://man.openbsd.org/ssh_config#LocalCommand
 author: frack113, Nasreddine Bencherchali
 date: 2022-12-29
-modified: 2025-07-02
+modified: 2025-10-16
 tags:
     - attack.defense-evasion
     - attack.t1218
@@ -37,8 +37,8 @@ detection:
     selection_cli_flags:
         - CommandLine|contains: 'ProxyCommand='
         - CommandLine|contains|all:
-              - 'PermitLocalCommand'
-              - 'LocalCommand'
+              - 'PermitLocalCommand=yes'
+              - ' LocalCommand'
     condition: selection_parent or all of selection_cli_*
 falsepositives:
     - Legitimate usage for administration purposes