sigma icon indicating copy to clipboard operation
sigma copied to clipboard

Minor fix for rule regex

Open CR-OfirTal opened this issue 1 year ago • 1 comments

Summary of the Pull Request

Just adding a bracket to the regex

Changelog

fix: Dynamic .NET Compilation Via Csc.EXE - small regex fix fix: Csc.EXE Execution Form Potentially Suspicious Parent - small regex fix

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

CR-OfirTal avatar May 21 '24 02:05 CR-OfirTal

Hi, Thanks for the fix. As the regex fix change the detection the field modified must be updated.

frack113 avatar May 23 '24 18:05 frack113