From 5c549a2825b96eefd25870c961a38bbf9900a4af Mon Sep 17 00:00:00 2001
From: Tomasuh <3432107+Tomasuh@users.noreply.github.com>
Date: Fri, 12 Aug 2022 12:45:52 +0200
Subject: [PATCH] Escape ? character

---
 rules/proxy/proxy_turla_comrat.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/proxy/proxy_turla_comrat.yml b/rules/proxy/proxy_turla_comrat.yml
index c546ddb69..4423e4a74 100644
--- a/rules/proxy/proxy_turla_comrat.yml
+++ b/rules/proxy/proxy_turla_comrat.yml
@@ -11,7 +11,7 @@ logsource:
   category: proxy
 detection:
   selection:
-    c-uri|contains: '/index/index.php?h='
+    c-uri|contains: '/index/index.php\?h='
   condition: selection
 falsepositives:
   - Unknown