fix: FPs with LSASS access rule

2021-11-22 13:43:20 +01:00
parent a5b7a92d91
commit 37ff832fda
1 changed files with 19 additions and 1 deletions
@@ -49,7 +49,25 @@ detection:
            - 'BA'
            - 'DA'
            - 'FA'
-    condition: selection
+    filter1:
+        SourceImage:
+            - 'C:\WINDOWS\system32\taskmgr.exe'
+    filter2:
+        SourceImage|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
+        SourceImage|endswith: '\MsMpEng.exe'
+    filter3:
+        SourceImage|startswith: 'C:\Program Files\WindowsApps\'
+        SourceImage|endswith: '\GamingServices.exe'
+        GrantedAccess: '0x1410'
+    filter4:
+        SourceImage|endswith: 
+            - '\PROCEXP64.EXE'
+            - '\PROCEXP.EXE'
+        GrantedAccess: '0x1410'
+    filter5:
+        SourceImage|startswith: 'C:\ProgramData\VMware\VMware Tools\'
+        SourceImage|endswith: '\vmtoolsd.exe'
+    condition: selection and not filter1 and not filter2 and not filter3 and not filter4 and not filter5
 fields:
    - User
    - SourceImage