From 38cd9baaef4b2d2df72bb65a43dd2f252a1d8c8a Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 18 Jul 2022 09:44:25 -0500
Subject: [PATCH] Removed mpcmdrun.exe

---
 .../ssa___windows_lolbin_binary_in_non_standard_path.yml     | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 44f29b9c6c..0f3dd5e707 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -19,8 +19,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
   process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
   process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
-  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
-  process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
+  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
   process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
   process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
@@ -29,7 +28,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND 
   match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
   AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false
-  AND match_regex(process_path, /(?i)\\microsoft.net/)=false AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false | eval start_time=timestamp,
+  AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
   event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.