fix: escape character that would be interpreted as wildcard

2021-07-02 22:02:46 +02:00
parent 7c3c0142bb
commit d3d018e600
1 changed files with 1 additions and 1 deletions
@@ -17,7 +17,7 @@ logsource:
 detection:
    selection:
        EventID: 5145
-        ShareName: \\*\IPC$
+        ShareName: \\\*\IPC$
        RelativeTargetName: spoolss
    condition: selection
 falsepositives: