diff --git a/rules/windows/builtin/win_user_driver_loaded.yml b/rules/windows/builtin/win_user_driver_loaded.yml index 9d3ae187f..c64a039a5 100644 --- a/rules/windows/builtin/win_user_driver_loaded.yml +++ b/rules/windows/builtin/win_user_driver_loaded.yml @@ -32,6 +32,7 @@ detection: - '*\procexp.exe' - '*\procmon64.exe' - '*\procmon.exe' + - '*\Google\Chrome\Application\chrome.exe' condition: selection_1 and not selection_2 falsepositives: - Other legimate tools loading drivers. There are some: Sysinternals, CPU-Z, AVs etc. - but not much. You have to baseline this according to your used products and allowed tools. Also try to exclude users, which are allowed to load drivers.