Add forward slash usecase to TemplateInjection detection (Velocidex#1173

)
tlinman67 · Aug 2, 2021 · 43a9679 · 43a9679
1 parent 875851a
commit 43a9679
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/artifacts/definitions/Windows/Detection/TemplateInjection.yaml b/artifacts/definitions/Windows/Detection/TemplateInjection.yaml
@@ -20,7 +20,7 @@ parameters:
     default: C:\Users\**\*.{docx,dotx,xlsx,xltx,pptx,potx,ppsx,sldx}
   - name: TemplateRegex
     description: Regex to search inside resource section.
-    default: '^(https?|smb|\\\\\\\\)'
+    default: '^(https?|smb|\\\\|//)'
   - name: UploadDocument
     type: bool
     description: Select to upload document on detection.