fix: FPs with partial paths

phantinuss · Nov 21, 2023 · 764478b · 764478b
1 parent f14dda3
commit 764478b
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/...hunting/windows/process_creation/proc_creation_win_susp_file_permission_modifications.yml b/...hunting/windows/process_creation/proc_creation_win_susp_file_permission_modifications.yml
@@ -8,7 +8,7 @@ references:
     - https://github.com/swagkarna/Defeat-Defender-V1.2.0
 author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
 date: 2019/10/23
-modified: 2023/11/06
+modified: 2023/11/21
 tags:
     - attack.defense_evasion
     - attack.t1222.001
@@ -41,11 +41,11 @@ detection:
     filter_optional_vscode:
         CommandLine|contains:
             - '\AppData\Local\Programs\Microsoft VS Code'
-            - ':\Program Files\Microsoft VS Code\'
+            - ':\Program Files\Microsoft VS Code'
     filter_optional_avira:
         CommandLine|contains:
-            - ':\Program Files (x86)\Avira\'
-            - ':\Program Files\Avira\'
+            - ':\Program Files (x86)\Avira'
+            - ':\Program Files\Avira'
     condition: 1 of selection_* and not 1 of filter_optional_*
 falsepositives:
     - Users interacting with the files on their own (unlikely unless privileged users).