fix(ci): Only consider modified rules

rabbitstack · rabbitstack · commit 0d653ab2de86 · 2025-03-19T18:38:56.000+01:00
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -250,7 +250,7 @@ jobs:
       - name: Check version increment
         if: steps.changed-rules.outputs.any_changed == 'true'
         env:
-          CHANGED_RULES: ${{ steps.changed-rules.outputs.all_changed_files }}
+          CHANGED_RULES: ${{ steps.changed-rules.outputs.modified_files }}
         shell: bash
         run: |
           choco install yq -y
diff --git a/rules/defense_evasion_dll_loaded_via_apc_queue.yml b/rules/defense_evasion_dll_loaded_via_apc_queue.yml
@@ -18,7 +18,7 @@ references:
 condition: >
   load_dll and image.name iin 
     (
-      'winhttp.dll', 'clr.dll', 'bcrypt.dll', 'bcryptprimitives.dll',
+      'winhttp.dll', 'clr.dll' , 'bcrypt.dll', 'bcryptprimitives.dll',
       'wininet.dll', 'taskschd.dll', 'dnsapi.dll', 'coreclr.dll', 'ws2_32.dll',
       'wmiutils.dll', 'vaultcli.dll', 'System.Management.Automation.dll', 'psapi.dll',
       'mstscax.dll', 'dsquery.dll', 'mstask.dll', 'bitsproxy.dll'

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ references:`
`18`	`18`	`condition: >`
`19`	`19`	`load_dll and image.name iin`
`20`	`20`	`(`
`21`		`- 'winhttp.dll', 'clr.dll', 'bcrypt.dll', 'bcryptprimitives.dll',`
	`21`	`+ 'winhttp.dll', 'clr.dll' , 'bcrypt.dll', 'bcryptprimitives.dll',`
`22`	`22`	`'wininet.dll', 'taskschd.dll', 'dnsapi.dll', 'coreclr.dll', 'ws2_32.dll',`
`23`	`23`	`'wmiutils.dll', 'vaultcli.dll', 'System.Management.Automation.dll', 'psapi.dll',`
`24`	`24`	`'mstscax.dll', 'dsquery.dll', 'mstask.dll', 'bitsproxy.dll'`