Update proc_creation_win_susp_ntfs_short_name_use_image.yml

rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml

@@ -50,7 +50,7 @@ detection:
     filter_optional_winzip:
         Image: 'C:\PROGRA~1\WinZip\WZPREL~1.EXE'
     filter_optional_vcred:
-        Image|endswith: '\vcredist\VCREDI~1.EXE'
+        Image|endswith: '\VCREDI~1.EXE'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Software Installers