Update image_load_malware_raspberry_robin_side_load_aclui_oleview.yml

SigmaHQ · Aug 1, 2024 · d58a042 · d58a042
1 parent e9ac06b
commit d58a042
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/...24/Malware/Raspberry-Robin/image_load_malware_raspberry_robin_side_load_aclui_oleview.yml b/...24/Malware/Raspberry-Robin/image_load_malware_raspberry_robin_side_load_aclui_oleview.yml
@@ -26,8 +26,8 @@ detection:
         ImageLoaded|endswith: '\aclui.dll'
     filter_main_legit_oleview_paths:
         Image|contains:
-              - 'C:\Program Files (x86)\Windows Kits\'
-              - 'C:\Program Files\Microsoft SDKs\'
+            - 'C:\Program Files (x86)\Windows Kits\'
+            - 'C:\Program Files\Microsoft SDKs\'
     filter_optional_known_oleview_paths:
         Image|contains: '\Windows Resource Kit\'
     filter_main_is_signed: