From 7b8ea16ca3fb14209c4913077cd102bf8e4d6b2d Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Wed, 16 Feb 2022 13:35:46 +0100
Subject: [PATCH] fix: single list item

---
 .../process_creation/process_creation_susp_non_exe_image.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/process_creation_susp_non_exe_image.yml b/rules/windows/process_creation/process_creation_susp_non_exe_image.yml
index ca9cb4d97..7e864aaee 100644
--- a/rules/windows/process_creation/process_creation_susp_non_exe_image.yml
+++ b/rules/windows/process_creation/process_creation_susp_non_exe_image.yml
@@ -61,7 +61,7 @@ detection:
         Image|startswith:
             - 'C:\Program Files (x86)\WINPAKPRO\'
             - 'C:\Program Files\WINPAKPRO\'
-        Image|endswith: - '.ngn'
+        Image|endswith: '.ngn'
     filter_myq_server:
         Image:
             - 'C:\Program Files (x86)\MyQ\Server\pcltool.dll'