Improved regex to handle paths

- changed regex for paths
- updated unit test & data

detections/endpoint/ssa___first_time_seen_cmd_line.yml

@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events()
        dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
        process_name=ucast(map_get(input_event, "process_name"), "string", null),
        cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
-       cmd_line_norm=replace(cmd_line, /\w:\\[^\s]+/, "PATH"),
+       cmd_line_norm=replace(cmd_line, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
        cmd_line_norm=replace(cmd_line_norm, /\d+/, "N")
 | where process_name="cmd.exe" AND
         match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true

tests/endpoint/ssa___first_time_seen_cmd_line.test.yml

@@ -2,7 +2,7 @@ name: First time seen command line argument - SSA Unit Test
 tests:
   - name: First time seen command line argument
     file: endpoint/ssa___first_time_seen_cmd_line.yml
-    pass_condition: '@count_eq(3)'
+    pass_condition: '@count_eq(4)'
     description: Test detection of first time seen command
     attack_data:
       - file_name: first_time_seen_commandline.json