From 8fc7f741d9fba04e378488cbccf4c27705a67a6e Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 2 Feb 2023 21:34:54 +0100
Subject: [PATCH] fix: apply escape suggestion

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 .../process_creation/proc_creation_win_net_use_mount_share.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml b/rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml
index 245cdd378..311a8a250 100644
--- a/rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml
+++ b/rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml
@@ -22,7 +22,7 @@ detection:
             - '\net1.exe'
         CommandLine|contains:
             - ' use '
-            - ' \\'
+            - ' \\\\'
     condition: selection
 falsepositives:
     - Legitimate activity by administrators and scripts