Office Document Spawned Child Process To Download / wrong exclusion "OriginalFileName" #1458

Hi

The ESCU "Office Document Spawned Child Process To Download" defines an exclusion for some well known browsers.
Unfortunately that exclusion does not work correctly because the "OriginalFileName" values from Sysmon do not contain the full path but only the file name.

So changing
.. NOT(OriginalFileName IN("\firefox.exe", "\chrome.exe","\iexplore.exe","\msedge.exe")) ...
to
.. NOT(OriginalFileName IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) ...

should do the trick. And with less wildcards -> we even get more speed. \o/.

cheers