Update proc_creation_win_commandline_path_traversal_evasion.yml

Fix FP with Citrix launcher
2022-09-20 17:20:19 -07:00
parent 43b62bf79f
commit fda2ca4308
1 changed files with 3 additions and 1 deletions
@@ -24,8 +24,10 @@ detection:
    selection2:
        CommandLine|contains: '.exe\..\'
    filter:
-        CommandLine|contains: '\Google\Drive\googledrivesync.exe\..\'
+        - CommandLine|contains: '\Google\Drive\googledrivesync.exe\..\'
+        - CommandLine|contains: '\Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\'
    condition: 1 of selection* and not filter
 falsepositives:
    - Google Drive
+    - Citrix
 level: high