Update rules/windows/defense_evasion_microsoft_defender_tampering.toml

Co-authored-by: Samirbous <[email protected]>

Author: w0rk3r

rules/windows/defense_evasion_microsoft_defender_tampering.toml

@@ -112,10 +112,10 @@ registry where host.os.type == "windows" and event.type == "change" and process.
     "?:\\Windows\\CCM\\CcmExec.exe", 
     "?:\\Windows\\System32\\DeviceEnroller.exe", 
     "?:\\Program Files (x86)\\Trend Micro\\Security Agent\\tmuninst.exe",
-    "\\Device\\HarddiskVolume?\\Windows\\system32\\svchost.exe", 
-    "\\Device\\HarddiskVolume?\\Windows\\CCM\\CcmExec.exe", 
-    "\\Device\\HarddiskVolume?\\Windows\\System32\\DeviceEnroller.exe", 
-    "\\Device\\HarddiskVolume?\\Program Files (x86)\\Trend Micro\\Security Agent\\tmuninst.exe"
+    "\\Device\\HarddiskVolume*\\Windows\\system32\\svchost.exe", 
+    "\\Device\\HarddiskVolume*\\Windows\\CCM\\CcmExec.exe", 
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\DeviceEnroller.exe", 
+    "\\Device\\HarddiskVolume*\\Program Files (x86)\\Trend Micro\\Security Agent\\tmuninst.exe"
   )
 
 /*