exclude google drive FP (#2145)

(cherry picked from commit 84104773a6)
This commit is contained in:
Mika Ayenson
2022-07-22 17:00:00 -04:00
committed by github-actions[bot]
parent 5e21144896
commit 53e035a91f
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/01/25"
maturity = "production"
updated_date = "2022/03/31"
updated_date = "2022/07/22"
[rule]
author = ["Elastic"]
@@ -33,7 +33,8 @@ process where event.type in ("start", "process_started") and
(process.name : "open" and process.args : "smb://*") or
(process.name : "mount" and process.args : "smbfs") or
(process.name : "osascript" and process.command_line : "osascript*mount volume*smb://*")
)
) and
not process.parent.executable : "/Applications/Google Drive.app/Contents/MacOS/Google Drive"
'''