Remove backslashes in CommandLine for sticky key rule

Example command line is exactly "cmd.exe sethc.exe 211". => the detection with *\cmd.exe... would not match.
2024-11-07 17:58:52 +00:00 · 2019-04-03 16:16:18 +02:00 · 2019-04-03 16:16:18 +02:00 · 865d971704
commit 865d971704
parent 6cc1770351
1 changed files with 6 additions and 6 deletions
--- a/rules/windows/sysmon/sysmon_stickykey_like_backdoor.yml
+++ b/rules/windows/sysmon/sysmon_stickykey_like_backdoor.yml
@ -39,9 +39,9 @@ detection:
        ParentImage:
            - '*\winlogon.exe'
        CommandLine:
-            - '*\cmd.exe sethc.exe *'
-            - '*\cmd.exe utilman.exe *'
-            - '*\cmd.exe osk.exe *'
-            - '*\cmd.exe Magnify.exe *'
-            - '*\cmd.exe Narrator.exe *'
-            - '*\cmd.exe DisplaySwitch.exe *'
+            - '*cmd.exe sethc.exe *'
+            - '*cmd.exe utilman.exe *'
+            - '*cmd.exe osk.exe *'
+            - '*cmd.exe Magnify.exe *'
+            - '*cmd.exe Narrator.exe *'
+            - '*cmd.exe DisplaySwitch.exe *'