Remove additional backslash

2020-11-28 13:25:28 -03:00
parent 0357472635
commit 7aa831eac3
1 changed files with 1 additions and 1 deletions
@@ -17,7 +17,7 @@ detection:
    selection:
        CommandLine|contains|all:
            - 'sysprep.exe'
-            - '\AppData\\'
+            - '\AppData\'
    condition: selection
 falsepositives:
    - False positives depend on scripts and administrative tools used in the monitored environment