refactor: rule extended

2022-03-21 12:59:14 +01:00
parent 007e52ccb9
commit 35828985e0
1 changed files with 2 additions and 0 deletions
@@ -23,11 +23,13 @@ detection:
         - '\csrss.exe'
         - '\certutil.exe'
         - '\schtasks.exe'
+         - '\eventvwr.exe'
   filter_special:
      Image|endswith:
         - '\WerFault.exe'
         - '\wermgr.exe'
         - '\conhost.exe'  # csrss.exe, certutil.exe
+         - '\mmc.exe'      # eventvwr.exe
 condition: selection or ( selection_special and not filter_special )
 falsepositives:
   - Unknown