Update silenttrinity_stager_msbuild_activity.yml

2020-10-14 13:04:49 +05:30
parent 6b25378a61
commit 2fa7ae2c1c
1 changed files with 1 additions and 1 deletions
@@ -17,7 +17,7 @@ logsource:
 detection:
    selection:
        EventID: 3
-        ParentImage|endswith: '\msbuild.exe'
+        ParentImage|endswith: 'msbuild.exe'
    condition: selection
 fields:
    - ParentImage