security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3139 from redsand/fp_direct_syscall_amazonssmagentsetup

Browse Source 
False positive: ignore amazon ssm agent setup
This commit is contained in:
Florian Roth
2022-06-17 18:45:49 +02:00
committed by GitHub
parent 4b17d2df48 e56dab0016
commit e4493d945f
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_access/proc_access_win_direct_syscall_ntopenprocess.yml
+4 -1
View File
@@ -6,7 +6,7 @@ references:
status: experimental
author: Christian Burkard, Tim Shelton
date: 2021/07/28
modified: 2022/05/15
modified: 2022/06/17
logsource:
category: process_access
product: windows
@@ -25,6 +25,9 @@ detection:
falsepositive4:
TargetImage: 'C:\Windows\system32\systeminfo.exe'
SourceImage|endswith: 'setup64.exe' #vmware
falsepositive5:
TargetImage|endswith: 'AmazonSSMAgentSetup.exe'
SourceImage|endswith: 'AmazonSSMAgentSetup.exe'
condition: selection and not 1 of falsepositive*
falsepositives:
- Unknown