Apply suggestions from code review

Co-authored-by: Samirbous <[email protected]>

Author: w0rk3r

rules/windows/defense_evasion_wdac_policy_by_unusual_process.toml

@@ -78,12 +78,12 @@ file where host.os.type == "windows" and event.action != "deletion" and
   file.path : (
     "?:\\Windows\\System32\\CodeIntegrity\\*.p7b",
     "?:\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\*.cip",
-    "\\Device\\HarddiskVolume?\\Windows\\System32\\CodeIntegrity\\*.p7b",
-    "\\Device\\HarddiskVolume?\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\*.cip"
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\CodeIntegrity\\*.p7b",
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\*.cip"
   ) and
   not process.executable : (
     "C:\\Windows\\System32\\poqexec.exe",
-    "\\Device\\HarddiskVolume?\\Windows\\System32\\poqexec.exe"
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\poqexec.exe"
   )
 '''