improve filter handler rule

mandiant · Dec 3, 2024 · 7e21058 · 7e21058
1 parent 9f0a131
commit 7e21058
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/nursery/persist-via-filter-handlers-registry-key.yml b/nursery/persist-via-filter-handlers-registry-key.yml
@@ -14,6 +14,6 @@ rule:
   features:
     - and:
       - match: set registry value
-      - string: /\\\.(.*?)\\Handler/i
-      - optional:
-        - match: persist via COM hijack
+      - or:
+        - string: /\\\..*\\PersistentHandler/i
+        - string: /CLSID\\.*\\PersistentHandler/i