fix: remove duplicate and forbidden null/'' in list

phantinuss · Oct 23, 2023 · 4054798 · 4054798
1 parent 6512d73
commit 4054798
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml b/rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml
@@ -68,10 +68,7 @@ detection:
         ParentImage|endswith: '\CompatTelRunner.exe'
         ParentCommandLine|contains: ':\Windows\system32\CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun'
     filter_optional_ibm_spectrumprotect:
-        ParentImage|contains:
-            - ':\IBM\SpectrumProtect\webserver\scripts\'
-            - ''
-            - null
+        ParentImage|contains: ':\IBM\SpectrumProtect\webserver\scripts\'
         CommandLine|contains: ':\IBM\SpectrumProtect\webserver\scripts\'
     filter_main_msiexec:
         ParentImage|endswith: ':\Windows\SysWOW64\msiexec.exe'