prepend MD5 to hash value

SigmaHQ · Jan 22, 2025 · a542546 · a542546
1 parent fb27bee
commit a542546
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml b/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml
@@ -16,7 +16,7 @@ logsource:
     product: windows
 detection:
     selection:
-        - Hashes|contains: '09D278F9DE118EF09163C6140255C690'
+        - Hashes|contains: 'MD5=09D278F9DE118EF09163C6140255C690'
         - CommandLine|contains: 'Dumpert.dll'
     condition: selection
 falsepositives: