The documentation on the conditions in the Detection rule definition of a Declarative process group is not very elaborate. it is somewhat clear that you do not need to use quotes for the value (e.g. svc in $contains(svc)), but what in situations the arguments contains quotes and spaces?
Especially when it comes to command line arguments, that can be used as property.
For example this situation, a process is started like:
myprocess.exe -instance"MYUI interface" -domain"c1234"
Solved! Go to Solution.
Oke, here is the answer, after a session with One Support, who had to inquire with the responsible team internally as well:
So, to capture the example from the original question above, myprocess.exe -instance"MYUI interface" -domain"c1234", you need to create two rules: