Merge PR #4644 from @qasimqlf - Add Missing CommandLine Field Selection

fix: Suspicious Redirection to Local Admin Share - Add missing CommandLine field selection 

---------

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>

rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml

@@ -7,7 +7,7 @@ references:
     - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
 author: Florian Roth (Nextron Systems)
 date: 2022/01/16
-modified: 2022/09/09
+modified: 2023/12/28
 tags:
     - attack.exfiltration
     - attack.t1048
@@ -18,8 +18,9 @@ detection:
     selection_redirect:
         CommandLine|contains: '>'
     selection_share:
-        - '\\\\127.0.0.1\\admin$\\'
-        - '\\\\localhost\\admin$\\'
+        CommandLine|contains:
+            - '\\\\127.0.0.1\\admin$\\'
+            - '\\\\localhost\\admin$\\'
     condition: all of selection_*
 falsepositives:
     - Unknown