Ensure CommandLine items are properly quoted to resolve parsing issues

rules/koadicpostexploitationrootkit.yml

@@ -15,7 +15,7 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *chcp 437 & schtasks /query /tn K0adic*
-            - *chcp 437 & schtasks /create /tn K0adic*
+            - '*chcp 437 & schtasks /query /tn K0adic*'
+            - '*chcp 437 & schtasks /create /tn K0adic*'
     condition: selection
 level: critical

rules/powershelldownloadingfilefromurlshortenersite.yml

@@ -29,10 +29,10 @@ detection:
             - '*powershell*new-object net.*https://cutt.*'
             - '*powershell*new-object net.*https://rebrand.*'
             - '*powershell*new-object net.*https://bit.ly*'
-            - '*powershell*net.web*https://tinyurl.*
-            - '*powershell*net.web*https://bitly.*
-            - '*powershell*net.web*https://shorturl.*
-            - '*powershell*net.web*https://rebrandly.*
+            - '*powershell*net.web*https://tinyurl.*'
+            - '*powershell*net.web*https://bitly.*'
+            - '*powershell*net.web*https://shorturl.*'
+            - '*powershell*net.web*https://rebrandly.*'
             - '*powershell*net.web*https://cutt.*'
             - '*powershell*net.web*https://rebrand.*'
             - '*powershell*net.web*https://bit.ly*'

rules/powershelllaunchregsvr32.yml

@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *powershell*regsvr32*
+            - '*powershell*regsvr32*'
     condition: selection
 level: critical

rules/powershellsleepandlaunchexecutable.yml

@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *powershell -c sleep -s *;saps *.exe*
+            - '*powershell -c sleep -s *;saps *.exe*'
     condition: selection
 level: critical

rules/registerdllwithspoofedextension.yml

@@ -16,10 +16,10 @@ detection:
     selection:
         CommandLine:
             - '*rundll32*.html,DllRegisterServer*'
-            - '*regsvr32*\\*.jpg*
-            - '*regsvr32*\\*.png*
-            - '*regsvr32*\\*.jpeg*
-            - '*regsvr32*\\*.pdf*
+            - '*regsvr32*\\*.jpg*'
+            - '*regsvr32*\\*.png*'
+            - '*regsvr32*\\*.jpeg*'
+            - '*regsvr32*\\*.pdf*'
             - '*regsvr32*\\*.txt*'
     condition: selection
 level: critical

rules/shedulehiddenpowershellscript.yml

@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *schtasks.exe*/create*powershell*hidden*
+            - '*schtasks.exe*/create*powershell*hidden*'
     condition: selection
 level: critical

rules/wscriptdownloadfileintotemplocationfromwordpresssite.yml

@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *cmd /c wscript.exe *\AppData\Local\Temp*/wp-data/*
+            - '*cmd /c wscript.exe *\AppData\Local\Temp*/wp-data/*'
     condition: selection
 level: critical