Update windows_vssvc_process_accessing_defender_engine.yml

nasbench · nasbench · commit f60a0be5cb65 · 2026-06-15T16:19:45.000+02:00
diff --git a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml
@@ -16,8 +16,8 @@ data_source:
 search: |-
     `sysmon`
     EventCode=10
-    TargetImage="\\MsMpEng.exe"
-    SourceImage="\\vssvc.exe"
+    TargetImage="*\\MsMpEng.exe"
+    SourceImage="*\\vssvc.exe"
     | stats count min(_time) as firstTime
                   max(_time) as lastTime
       by EventID GrantedAccess Guid Opcode ProcessID
