From 52d0cb67eb22bafd47098ca56eb79e2e7b32804e Mon Sep 17 00:00:00 2001
From: Tim Shelton <tshelton@hawkdefense.com>
Date: Wed, 10 Nov 2021 17:09:15 +0000
Subject: [PATCH] adding additional allow for dns service (domain controllers)

---
 rules/windows/network_connection/sysmon_susp_rdp.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rules/windows/network_connection/sysmon_susp_rdp.yml b/rules/windows/network_connection/sysmon_susp_rdp.yml
index e12fde626..9867e2b1d 100755
--- a/rules/windows/network_connection/sysmon_susp_rdp.yml
+++ b/rules/windows/network_connection/sysmon_susp_rdp.yml
@@ -38,9 +38,11 @@ detection:
             - '\FSAssessment.exe'
             - '\MobaRTE.exe'
             - '\chrome.exe'
+            - '\System32\dns.exe'
             - '\thor.exe'
             - '\thor64.exe'
     condition: selection and not filter 
 falsepositives:
     - Other Remote Desktop RDP tools
+    - domain controller using dns.exe
 level: high