committed by
github-actions[bot]
parent
5e21144896
commit
53e035a91f
@@ -1,7 +1,7 @@
|
||||
[metadata]
|
||||
creation_date = "2021/01/25"
|
||||
maturity = "production"
|
||||
updated_date = "2022/03/31"
|
||||
updated_date = "2022/07/22"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -33,7 +33,8 @@ process where event.type in ("start", "process_started") and
|
||||
(process.name : "open" and process.args : "smb://*") or
|
||||
(process.name : "mount" and process.args : "smbfs") or
|
||||
(process.name : "osascript" and process.command_line : "osascript*mount volume*smb://*")
|
||||
)
|
||||
) and
|
||||
not process.parent.executable : "/Applications/Google Drive.app/Contents/MacOS/Google Drive"
|
||||
'''
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user