Merge PR #4618 from @ruppde - Filter out Webex binary
fix: title: LSASS Access From Program In Potentially Suspicious Folder - Filter out Webex binary
This commit is contained in:
+2
-1
@@ -10,7 +10,7 @@ references:
|
||||
- http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
|
||||
author: Florian Roth (Nextron Systems)
|
||||
date: 2021/11/27
|
||||
modified: 2023/11/27
|
||||
modified: 2023/12/06
|
||||
tags:
|
||||
- attack.credential_access
|
||||
- attack.t1003.001
|
||||
@@ -64,6 +64,7 @@ detection:
|
||||
- '\DropboxUpdate.exe'
|
||||
- '\MBAMInstallerService.exe'
|
||||
- '\WebexMTA.exe'
|
||||
- '\Meetings\WebexMTAV2.exe'
|
||||
- '\WebEx\WebexHost.exe'
|
||||
- '\JetBrains\Toolbox\bin\jetbrains-toolbox.exe'
|
||||
GrantedAccess: '0x410'
|
||||
|
||||
Reference in New Issue
Block a user