fix: add escape for question mark

SigmaHQ · Nov 9, 2023 · 7a28ab0 · 7a28ab0
1 parent 6193ab7
commit 7a28ab0
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml b/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml
@@ -6,7 +6,7 @@ references:
     - https://twitter.com/Oddvarmoe/status/993383596244258816
 author: Julia Fomina, oscd.community
 date: 2020/10/08
-modified: 2022/07/14
+modified: 2023/11/9
 tags:
     - attack.execution
     - attack.t1059.001
@@ -31,7 +31,7 @@ detection:
     get_help:
         CommandLine|contains:
             - 'help'
-            - '?'
+            - '\?'
     condition: powershell_module or (cmd_execution and get_help)
 falsepositives:
     - Legitimate use of Pester for writing tests for Powershell scripts and modules