Merge pull request #2825 from SigmaHQ/aurora-false-positive-fixing

fix: FPs noticed with EdgeTransport sub processes
2022-03-18 11:04:10 +01:00
parent d0eef19e95 2f51f8e1d2
commit fbf1b8456c
1 changed files with 4 additions and 2 deletions
@@ -7,14 +7,16 @@ references:
  - https://twitter.com/cglyer/status/1182389676876980224
  - https://twitter.com/cglyer/status/1182391019633029120
 date: 2019/10/11
-modified: 2021/11/27
+modified: 2022/03/18
 logsource:
  category: process_creation
  product: windows
 detection:
  selection:
    ParentImage|endswith: '\EdgeTransport.exe'
-  condition: selection
+  filter:
+    Image: 'C:\Windows\System32\conhost.exe'
+  condition: selection and not filter
 falsepositives:
  - Unknown
 level: critical