From d0eff26cde13ce6990680a55579ffeec52f84dca Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 15 Sep 2021 13:48:22 +0200 Subject: [PATCH] fin7 --- .../endpoint/non_firefox_process_access_firefox_profile_dir.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 92797d8a67..b43dcc6bb4 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -12,7 +12,7 @@ description: This search is to detect an anomaly event of non-firefox process ac This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. -search: 'eventtype=wineventlog_security EventCode=4663 +search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user