diff --git a/modules/signatures/windows/lolbas.py b/modules/signatures/windows/lolbas.py index 5ceb74c0..fe31c429 100644 --- a/modules/signatures/windows/lolbas.py +++ b/modules/signatures/windows/lolbas.py @@ -111,8 +111,7 @@ def run(self): cmdlines = self.results.get("behavior", {}).get("summary", {}).get("executed_commands", []) for cmdline in cmdlines: lower = cmdline.lower() - if ("conhost.exe" in lower and - any(process in lower for process in ("cmd /c", "powershell", "script", "mshta", "curl"))): + if "conhost.exe" in lower and any(process in lower for process in ("cmd /c", "powershell", "script", "mshta", "curl")): self.data.append({"command": cmdline}) return True return False