From bc212909ec41e7e2254076f20cd8ca98beeea585 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 20 Apr 2023 12:48:51 -0500 Subject: [PATCH] Removed sfc.exe, which has frequent collisions with AMP for Endpoints --- .../ssa___system_process_running_from_unexpected_location.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index d7cda545f3..f4fa4950d4 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -61,7 +61,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe" - OR process_file_name="sfc.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" + OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"