From 53e035a91fb6ec989d54c6efc0dfbaee45b7d18a Mon Sep 17 00:00:00 2001 From: Mika Ayenson Date: Fri, 22 Jul 2022 17:00:00 -0400 Subject: [PATCH] exclude google drive FP (#2145) (cherry picked from commit 84104773a690b95e01b5f23935270687a3b8c389) --- rules/macos/lateral_movement_mounting_smb_share.toml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/macos/lateral_movement_mounting_smb_share.toml b/rules/macos/lateral_movement_mounting_smb_share.toml index 4c9642cee..34691b1a2 100644 --- a/rules/macos/lateral_movement_mounting_smb_share.toml +++ b/rules/macos/lateral_movement_mounting_smb_share.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2021/01/25" maturity = "production" -updated_date = "2022/03/31" +updated_date = "2022/07/22" [rule] author = ["Elastic"] @@ -33,7 +33,8 @@ process where event.type in ("start", "process_started") and (process.name : "open" and process.args : "smb://*") or (process.name : "mount" and process.args : "smbfs") or (process.name : "osascript" and process.command_line : "osascript*mount volume*smb://*") - ) + ) and + not process.parent.executable : "/Applications/Google Drive.app/Contents/MacOS/Google Drive" '''