Update sysmon_susp_driver_load.yml

2024-11-07 17:58:52 +00:00 · 2020-11-19 22:56:34 -03:00 · 2020-11-19 22:56:34 -03:00 · 6ecafac619
commit 6ecafac619
parent f42ef96140
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/driver_load/sysmon_susp_driver_load.yml
+++ b/rules/windows/driver_load/sysmon_susp_driver_load.yml
@ -14,7 +14,7 @@ logsource:
    product: windows
 detection:
    selection: 
-        ImageLoaded|contains: '\Temp\\'
+        ImageLoaded|contains: '\Temp\'
    condition: selection
 falsepositives:
    - there is a relevant set of false positives depending on applications in the environment