[Suspicious PowerShell Engine ImageLoad] Add Ssms.exe to query exceptions (#2831)
* Add Ssms.exe to query exceptions * Changed updated_date --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
This commit is contained in:
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/02/22"
|
||||
updated_date = "2023/06/06"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -139,6 +139,7 @@ not process.executable regex~ """C:\\Program Files( \(x86\))?\\*\.exe""" and
|
||||
"SPCAF.Client.exe",
|
||||
"SPCAF.SettingsEditor.exe",
|
||||
"SQLPS.exe",
|
||||
"Ssms.exe",
|
||||
"telemetryservice.exe",
|
||||
"UMWorkerProcess.exe",
|
||||
"w3wp.exe",
|
||||
|
||||
Reference in New Issue
Block a user