diff --git a/rules/macos/lateral_movement_mounting_smb_share.toml b/rules/macos/lateral_movement_mounting_smb_share.toml index 4c9642cee..34691b1a2 100644 --- a/rules/macos/lateral_movement_mounting_smb_share.toml +++ b/rules/macos/lateral_movement_mounting_smb_share.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2021/01/25" maturity = "production" -updated_date = "2022/03/31" +updated_date = "2022/07/22" [rule] author = ["Elastic"] @@ -33,7 +33,8 @@ process where event.type in ("start", "process_started") and (process.name : "open" and process.args : "smb://*") or (process.name : "mount" and process.args : "smbfs") or (process.name : "osascript" and process.command_line : "osascript*mount volume*smb://*") - ) + ) and + not process.parent.executable : "/Applications/Google Drive.app/Contents/MacOS/Google Drive" '''