Update win_system_exe_anomaly.yml

Following sigma event I've noticed my twitter account was referenced:
https://twitter.com/GelosSnake/status/934900723426439170

Rule:
https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml

Seems like - '\SystemRoot\System32\\*' is missing and hence triggering an FP.

rules/windows/process_creation/win_system_exe_anomaly.yml

@@ -29,13 +29,14 @@ detection:
             - '*\lsm.exe'
             - '*\winlogon.exe'
             - '*\explorer.exe'
-            - '*\taskhost.exe' 
+            - '*\taskhost.exe'
     filter:
         Image:
             - 'C:\Windows\System32\\*'
             - 'C:\Windows\SysWow64\\*'
             - 'C:\Windows\explorer.exe'
             - 'C:\Windows\winsxs\\*'
+             - '\SystemRoot\System32\\*'
     condition: selection and not filter
 falsepositives:
     - Exotic software