From e2d7980289bd215a4df7284d111f11101e293ba7 Mon Sep 17 00:00:00 2001 From: Chronicle Team Date: Thu, 9 Apr 2026 11:29:43 -0700 Subject: [PATCH] No public description PiperOrigin-RevId: 897214755 --- .../microsoft/windows/process_memory_dump_via_comsvcs_dll.yaral | 1 - 1 file changed, 1 deletion(-) diff --git a/rules/community/microsoft/windows/process_memory_dump_via_comsvcs_dll.yaral b/rules/community/microsoft/windows/process_memory_dump_via_comsvcs_dll.yaral index 9dc507b..01f3056 100644 --- a/rules/community/microsoft/windows/process_memory_dump_via_comsvcs_dll.yaral +++ b/rules/community/microsoft/windows/process_memory_dump_via_comsvcs_dll.yaral @@ -54,7 +54,6 @@ rule process_memory_dump_via_comsvcs_dll { strings.contains($process.target.process.command_line, "#-") or strings.contains($process.target.process.command_line, "#+") or strings.contains($process.target.process.command_line, "#24") or - strings.contains($process.target.process.command_line, "24 ") or strings.contains(strings.to_lower($process.target.process.command_line), "minidump") ) )