added backslash for image search

2024-11-08 10:13:57 +00:00 · 2020-10-15 14:01:30 +03:00 · 2020-10-15 14:01:30 +03:00 · 787c87e032
commit 787c87e032
parent f79342cc59
1 changed files with 1 additions and 1 deletions
--- a/rules/windows/process_creation/win_susp_diskshadow.yml
+++ b/rules/windows/process_creation/win_susp_diskshadow.yml
@ -15,7 +15,7 @@ logsource:
    definition: 'Requirements: Sysmon ProcessCreation logging must be activated and Windows audit msut Include command line in process creation events'
 detection:
    selection:
-            Image|endswith: 'diskshadow.exe'
+            Image|endswith: '\diskshadow.exe'
            CommandLine|contains:
                - '/s'
    condition: selection