Skip to content

Commit d6cb0af

Browse files
committed
Adding full path and taxonomy suggestion
1 parent c76781f commit d6cb0af

2 files changed

Lines changed: 2 additions & 3 deletions

File tree

rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,7 @@ detection:
3434
- ';SY' # Local system
3535
- ';WD' # Everyone
3636
filter_optional_hexnode:
37-
- ParentImage|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
38-
- ParentProcessName|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
37+
- ParentImage|endswith: 'C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
3938
condition: all of selection_* and not 1 of filter_optional_*
4039
falsepositives:
4140
- Unknown

rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ detection:
2727
- '\Control\SafeBoot\Minimal\SAVService\(Default)'
2828
- '\Control\SafeBoot\Network\SAVService\(Default)'
2929
filter_optional_hexnode:
30-
Image|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
30+
Image|endswith: 'C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
3131
condition: selection and not 1 of filter_optional_*
3232
falsepositives:
3333
- Unknown

0 commit comments

Comments
 (0)