double quotes = escape

lukiffer · Oct 29, 2017 · 4b64fc1 · 4b64fc1
1 parent 0718524
commit 4b64fc1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/builtin/win_susp_run_locations.yml b/rules/windows/builtin/win_susp_run_locations.yml
@@ -15,7 +15,7 @@ detection:
             - "*:\\RECYCLER\\*"
             - "*:\\SystemVolumeInformation\\*"
             - "%windir%\\Tasks\\*"
-            - "%systemroot%\debug\\*"
+            - "%systemroot%\\debug\\*"
     condition: selection
 falsepositives: 
     - False positives depend on scripts and administrative tools used in the monitored environment