diff --git a/collection/database/wmi/reference-wmi-statements.yml b/collection/database/wmi/reference-wmi-statements.yml index e703a382..de2006e5 100644 --- a/collection/database/wmi/reference-wmi-statements.yml +++ b/collection/database/wmi/reference-wmi-statements.yml @@ -13,6 +13,6 @@ rule: - al-khaser_x86.exe_:0x433490 features: - or: - - string: /SELECT\s+\*\s+FROM\s+CIM_./ - - string: /SELECT\s+\*\s+FROM\s+Win32_./ - - string: /SELECT\s+\*\s+FROM\s+MSAcpi_./ + - string: /SELECT\s+\*\s+FROM\s+CIM_.+/ + - string: /SELECT\s+\*\s+FROM\s+Win32_.+/ + - string: /SELECT\s+\*\s+FROM\s+MSAcpi_.+/