fix: FP found in customer Env

phantinuss · Oct 13, 2023 · a143728 · a143728
1 parent 857ac87
commit a143728
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/iocs/filename-iocs.txt b/iocs/filename-iocs.txt
@@ -4333,7 +4333,7 @@ C:\\ProgramData\\TPM\\winscard\.dll;85
 
 # WER Exploit POC CVE-2023-36874 https://github.com/Wh04m1001/CVE-2023-36874
 \\WerExpl\.exe;75
-\\System32\\wermgr\.exe;70;(?i)(:\\Windows\\|%windir%|\$env:windir|%SystemRoot%|$env:systemroot)
+\\System32\\wermgr\.exe;70;(?i)(:\\Windows\\|%windir%|\$env:windir|%SystemRoot%|$env:systemroot|\\Device\\)
 
 # PPLFault https://github.com/gabriellandau/PPLFault
 C:\\PPLFaultTemp\\;90