Filename changed

SigmaHQ · Oct 2, 2024 · 66ad654 · 66ad654
1 parent cfaf929
commit 66ad654
Showing 1 changed file with 10 additions and 10 deletions.
diff --git a/..._load/image_load_susp_python_dll_load.yml → ...mage_load/image_load_side_load_python.yml b/..._load/image_load_susp_python_dll_load.yml → ...mage_load/image_load_side_load_python.yml
@@ -20,16 +20,16 @@ detection:
             - '\python311.dll'
             - '\python310.dll'
             - '\python39.dll'
-        filter_image_path:
-            ImageLoaded|contains:
-                - 'C:\program files\Python3'
-                - 'C:\program files (x86)\Python3'
-                - 'C:\Users\*\AppData\Local\Programs\Python\Python3'
-        filter_signature_status:
-            Product: 'Python'
-            Signed: 'true'
-            description: 'Python'
-            Company: 'Python Software Foundation'
+    filter_image_path:
+        ImageLoaded|contains:
+            - 'C:\program files\Python3'
+            - 'C:\program files (x86)\Python3'
+            - 'C:\Users\*\AppData\Local\Programs\Python\Python3'
+    filter_signature_status:
+        Product: 'Python'
+        Signed: 'true'
+        description: 'Python'
+        Company: 'Python Software Foundation'
     condition: selection and not 1 of filter_*
 falsepositives:
     - Legitimate software using Python 3.x DLLs (e.g., Python installations, applications with embedded Python)