Update win_system_exe_anomaly.yml

fixing to much original fork.

rules/windows/process_creation/win_system_exe_anomaly.yml

@@ -29,14 +29,14 @@ detection:
             - '*\lsm.exe'
             - '*\winlogon.exe'
             - '*\explorer.exe'
-            - '*\taskhost.exe'
+            - '*\taskhost.exe' 
     filter:
         Image:
             - 'C:\Windows\System32\\*'
             - 'C:\Windows\SysWow64\\*'
             - 'C:\Windows\explorer.exe'
             - 'C:\Windows\winsxs\\*'
-             - '\SystemRoot\System32\\*'
+            - '\SystemRoot\System32\\*'
     condition: selection and not filter
 falsepositives:
     - Exotic software