Update win_pc_sqlcmd_veeam_dump.yml

2021-12-21 13:28:47 +01:00
parent 6e19e75ece
commit 59bfca6aba
1 changed files with 1 additions and 1 deletions
@@ -15,7 +15,7 @@ logsource:
    product: windows
 detection:
    selection_tools:
-        Image|endswith: 'sqlcmd.exe'
+        Image|endswith: '\sqlcmd.exe'
    selection_query:
        CommandLine|contains|all:
            - 'SELECT'