fix(rules): Reduce File access to SAM database FPs

Author: rabbitstack

rules/credentail_access_file_access_to_sam_database.yml

@@ -1,6 +1,6 @@
 name: File access to SAM database
 id: e3dace20-4962-4381-884e-40dcdde66626
-version: 1.0.7
+version: 1.0.8
 description: |
   Identifies access to the Security Account Manager on-disk database.
 labels:
@@ -33,7 +33,8 @@ condition: >
               '?:\\Windows\\System32\\vmwp.exe',
               '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe',
               '?:\\Windows\\System32\\wuauclt.exe',
-              '?:\\Windows\\System32\\MRT.exe'
+              '?:\\Windows\\System32\\MRT.exe',
+              '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe'
             )
 
 min-engine-version: 3.0.0