security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

filter Bitdefender FPs (#2109)

Browse Source
This commit is contained in:
Mika Ayenson
2022-07-25 10:12:30 -04:00
committed by GitHub
parent 1746897359
commit b44714c83f
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/defense_evasion_install_root_certificate.toml
+4 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/01/13"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2022/07/15"
[rule]
author = ["Elastic"]
@@ -27,7 +27,9 @@ type = "query"
query = '''
event.category:process and event.type:(start or process_started) and
process.name:security and process.args:"add-trusted-cert"
process.name:security and process.args:"add-trusted-cert" and
not process.parent.executable:("/Library/Bitdefender/AVP/product/bin/BDCoreIssues" or "/Applications/Bitdefender/SecurityNetworkInstallerApp.app/Contents/MacOS/SecurityNetworkInstallerApp"
)
'''