Fix start-iap-tunnel matching

2023-02-02 20:55:46 -05:00 · 2023-02-02 20:55:46 -05:00 · 9ea6486121
parent 2bdb9f2f3e
commit 9ea6486121
1 changed files with 1 additions and 1 deletions
--- a/detection/initial_access/unexpected-shell-parent-events.sql
+++ b/detection/initial_access/unexpected-shell-parent-events.sql
@ -208,7 +208,7 @@ WHERE
    )
    OR (
      p1_name = 'ssh'
-      AND p0_cmd LIKE 'gcloud.py compute start-iap-tunnel%'
+      AND p0_cmd LIKE '%gcloud.py compute start-iap-tunnel%'
    )
    OR exception_key IN (
      'bash,0,pia-daemon,launchd',