From 03a7ee7eaa38e55236b6d4be99031f9276182189 Mon Sep 17 00:00:00 2001
From: taylor_socfortress <111797488+taylorwalton@users.noreply.github.com>
Date: Fri, 19 Jan 2024 15:51:30 -0600
Subject: [PATCH] Update 900000-exclusion_rules.xml

---
 Exclusion Rules/900000-exclusion_rules.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Exclusion Rules/900000-exclusion_rules.xml b/Exclusion Rules/900000-exclusion_rules.xml
index 4c008cd..f885b6a 100644
--- a/Exclusion Rules/900000-exclusion_rules.xml	
+++ b/Exclusion Rules/900000-exclusion_rules.xml	
@@ -519,7 +519,7 @@
   <!-- Exclude Windows Defender DNS Queries -->
   <rule id="900074" level="1">
     <if_sid>121101</if_sid>
-    <field name="win.eventdata.image" type="pcre2">(?i)C:\\\\Program Files\\\\Windows Defender Advanced Threat Protection</field>
+    <field name="win.eventdata.image" type="pcre2">(?i)^C:\\\\Program Files\\\\Windows Defender Advanced Threat Protection</field>
     <description>Exceptions rule created for Exclude Windows Defender DNS Queries.</description>
     <options>no_full_log</options>
   </rule>