From d207154de3bba3b91e4cbef1ef57433449ee6018 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 22 Jul 2021 06:19:55 -0600
Subject: [PATCH] Update detect_renamed_winrar.yml

Resolving #1524. Thank you!
---
 detections/endpoint/detect_renamed_winrar.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 74fa6a310b..1b6ffa8a61 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -12,7 +12,7 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
   In this instance, we are using `OriginalFileName` from Sysmon to determine if the
   process is WinRAR. During triage, validate additional metadata from the binary that
   this is `WinRAR`. Review parallel processes and file modifications.
-search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
+search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
   parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
   | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`