Skip to content

Commit c76781f

Browse files
Fixing filter data
1 parent 576104f commit c76781f

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ detection:
3333
# If you're already mapping and extracting the field, then obviously use that directly.
3434
Data|re: 'HostId=[a-zA-Z0-9-]{36}\s+EngineVersion='
3535
filter_main_hexnode:
36-
Data|contains: 'HostApplication=HostApplication=C:\Hexnode\Hexnode'
36+
Data|contains: 'HostApplication=C:\Hexnode\Hexnode'
3737
condition: selection and not 1 of filter_main_*
3838
falsepositives:
3939
- Unknown

0 commit comments

Comments
 (0)