diff --git a/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml b/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml index 8bbf6e456..267ba326d 100644 --- a/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml +++ b/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml @@ -10,7 +10,7 @@ references: - http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf author: Florian Roth (Nextron Systems) date: 2021/11/27 -modified: 2023/11/27 +modified: 2023/12/06 tags: - attack.credential_access - attack.t1003.001 @@ -64,6 +64,7 @@ detection: - '\DropboxUpdate.exe' - '\MBAMInstallerService.exe' - '\WebexMTA.exe' + - '\Meetings\WebexMTAV2.exe' - '\WebEx\WebexHost.exe' - '\JetBrains\Toolbox\bin\jetbrains-toolbox.exe' GrantedAccess: '0x410'