tools/config/uberagent.yml

title: uberAgent configuration
order: 20
backends:
  - uberagent
exclusion:
  - e6ce8457-68b1-485b-9bdd-3c2b5d679aa9 # 'VBA DLL Loaded Via Microsoft Word': Rule already included in default configuration.
  - a457f232-7df9-491d-898f-b5aabd2cbe2f # 'Windows Management Instrumentation DLL Loaded Via Microsoft Word': Rule already included in default configuration.
  - 295a59c1-7b79-4b47-a930-df12c15fc9c2 # 'Windows Registry Trust Record Modification': Rule already included in default configuration.
  - a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd # 'Detects registry changes to Office macro settings': Rule already included in default configuration.
  - e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a # 'Detects suspicious a certutil command that used to encode files, which is sometimes used for data exfiltration'
Implemented backend configuration to exclude certain rules during generation. 2022-04-11 14:02:11 +02:00			`title: uberAgent configuration`
			`order: 20`
			`backends:`
			`- uberagent`
			`exclusion:`
			`- e6ce8457-68b1-485b-9bdd-3c2b5d679aa9 # 'VBA DLL Loaded Via Microsoft Word': Rule already included in default configuration.`
			`- a457f232-7df9-491d-898f-b5aabd2cbe2f # 'Windows Management Instrumentation DLL Loaded Via Microsoft Word': Rule already included in default configuration.`
Add more entries to exclusion configuration. 2022-04-13 15:53:19 +02:00			`- 295a59c1-7b79-4b47-a930-df12c15fc9c2 # 'Windows Registry Trust Record Modification': Rule already included in default configuration.`
			`- a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd # 'Detects registry changes to Office macro settings': Rule already included in default configuration.`
			`- e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a # 'Detects suspicious a certutil command that used to encode files, which is sometimes used for data exfiltration'`