fix: fix FP with bonjour in CI rule

2022-10-25 01:55:08 +02:00
parent 1258eca847
commit ec425c836d
1 changed files with 5 additions and 0 deletions
@@ -35,6 +35,11 @@ detection:
        ProcessNameBuffer|endswith: '\AppData\Local\Keybase\Gui\Keybase.exe'
        RequestedPolicy: 8
        ValidatedPolicy: 1
+    filter_bonjour:
+        FileNameBuffer|endswith: '\Program Files\Bonjour\mdnsNSP.dll'
+        ProcessNameBuffer|endswith: '\Windows\System32\svchost.exe'
+        RequestedPolicy: 8
+        ValidatedPolicy: 1
    condition: selection and not 1 of filter_*
 falsepositives:
    - Unknown