Merge PR #4618 from @ruppde - Filter out Webex binary

fix: title: LSASS Access From Program In Potentially Suspicious Folder - Filter out Webex binary
This commit is contained in:
Arnim Rupp
2023-12-18 11:20:56 +01:00
committed by GitHub
parent dc4456fc0f
commit d652a9e8fb
@@ -10,7 +10,7 @@ references:
- http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
author: Florian Roth (Nextron Systems)
date: 2021/11/27
modified: 2023/11/27
modified: 2023/12/06
tags:
- attack.credential_access
- attack.t1003.001
@@ -64,6 +64,7 @@ detection:
- '\DropboxUpdate.exe'
- '\MBAMInstallerService.exe'
- '\WebexMTA.exe'
- '\Meetings\WebexMTAV2.exe'
- '\WebEx\WebexHost.exe'
- '\JetBrains\Toolbox\bin\jetbrains-toolbox.exe'
GrantedAccess: '0x410'