fix: other locations

https://twitter.com/ber_m1ng/status/1397948048135778309

rules/windows/process_creation/win_susp_procs_req_dlls.yml

@@ -22,7 +22,7 @@ detection:
             - '\regsvr32.exe'
     filter1:
         ParentImage|contains: 
-            - '\AppData\Local\Temp\'
+            - '\AppData\Local\'
             - '\Microsoft\Edge\'
     condition: selection and not filter1
 fields:

rules/windows/process_creation/win_susp_rundll32_no_params.yml

@@ -16,7 +16,7 @@ detection:
         ParentImage|endswith: '\svchost.exe'
     filter2:
         ParentImage|contains: 
-            - '\AppData\Local\Temp\'
+            - '\AppData\Local\'
             - '\Microsoft\Edge\'
     condition: selection and not filter1 and not filter2
 fields: