admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed sfc.exe, which has frequent collisions with AMP for Endpoints

Browse Source
This commit is contained in:
Lou Stella
2023-04-20 12:48:51 -05:00
parent 7b6c1c5e0e
commit bc212909ec
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
+1 -1
View File
@@ -61,7 +61,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe"
OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe"
OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe"
OR process_file_name="sfc.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe"
OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe"
OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"