fix detection

stboissdev · Nov 10, 2021 · 95b9cd3 · 95b9cd3
1 parent 3ea1eda
commit 95b9cd3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/network_connection/silenttrinity_stager_msbuild_activity.yml b/rules/windows/network_connection/silenttrinity_stager_msbuild_activity.yml
@@ -14,7 +14,7 @@ logsource:
     product: windows
 detection:
     selection:
-        ParentImage|endswith: '\msbuild.exe'
+        Image|endswith: '\msbuild.exe'
     filter:
         DestinationPort:
             - '80'