Fixed test

SigmaHQ · May 4, 2022 · dd76d12 · dd76d12
1 parent e7f463b
commit dd76d12
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/tests/test_processing_pipelines_sysmon.py b/tests/test_processing_pipelines_sysmon.py
@@ -295,7 +295,7 @@ def sysmon_error_sigma_rule():
 
 def test_sysmon_process_creation(process_creation_sigma_rule):
     backend = TextQueryTestBackend(sysmon_pipeline())
-    assert backend.convert(process_creation_sigma_rule) == ["EventID=1 and CommandLine=\"test.exe foo bar\" and Image=\"*\\test.exe\""]
+    assert backend.convert(process_creation_sigma_rule) == ["EventID=1 and CommandLine=\"test.exe foo bar\" and Image endswith \"\\test.exe\""]
 
 def test_sysmon_file_change(file_change_sigma_rule):
     backend = TextQueryTestBackend(sysmon_pipeline())