Skip to content

Commit a45dedb

Browse files
olafhartongolafhartong
authored
Merge pull request #230 from DetectionDude/fix-exclusion-paths
Fix exclusions that never match
2 parents 45318ec + 38052d4 commit a45dedb

7 files changed

Lines changed: 7 additions & 7 deletions

File tree

10_process_access/exclude_defender_for_endpoint copy.xml renamed to 10_process_access/exclude_microsoft_defender_for_endpoint.xml

File renamed without changes.

‎17_18_pipe_event/exclude_MSSQL.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<PipeName condition="is">\SQLLocal\RTCLOCAL</PipeName>
1010
<PipeName condition="is">\SQLLocal\RTC</PipeName>
1111
<PipeName condition="is">\SQLLocal\TMSM</PipeName>
12-
<Image condition="is">Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe</Image>
12+
<Image condition="is">C:\Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe</Image>
1313
</PipeEvent>
1414
</RuleGroup>
1515
</EventFiltering>

‎17_18_pipe_event/exclude_azure_sentinel_agent.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<EventFiltering>
33
<RuleGroup name="" groupRelation="or">
44
<PipeEvent onmatch="exclude">
5-
<Image condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe"</Image> <!--Microsoft Sentinel SIEM agent, based on MOM - thanks d4ph1l -->
5+
<Image condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</Image> <!--Microsoft Sentinel SIEM agent, based on MOM - thanks d4ph1l -->
66
</PipeEvent>
77
</RuleGroup>
88
</EventFiltering>

‎17_18_pipe_event/exclude_qlik_sense.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<EventFiltering>
33
<RuleGroup name="" groupRelation="or">
44
<PipeEvent onmatch="exclude">
5-
<Image condition="is">Program Files\Qlik\Sense\Engine\Engine.exe</Image>
5+
<Image condition="is">C:\Program Files\Qlik\Sense\Engine\Engine.exe</Image>
66
</PipeEvent>
77
</RuleGroup>
88
</EventFiltering>

‎17_18_pipe_event/exclude_windows_generic.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
<PipeName condition="is">\lsass</PipeName>
99
<PipeName condition="is">\winreg</PipeName>
1010
<PipeName condition="is">\spoolss</PipeName>
11-
<PipeName condition="contains">Anonymous Pipe</PipeName>
11+
<PipeName condition="is">&lt;Anonymous Pipe&gt;</PipeName>
1212
<Image condition="is">c:\windows\system32\inetsrv\w3wp.exe</Image>
1313
</PipeEvent>
1414
</RuleGroup>

‎1_process_creation/exclude_azure_sentinel_agent.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<ProcessCreate onmatch="exclude">
55
<ParentCommandLine condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding</ParentCommandLine>
66
<Rule groupRelation="and">
7-
<ParentImage condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe"</ParentImage>
7+
<ParentImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</ParentImage>
88
<CommandLine condition="is">"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"</CommandLine> <!--Microsoft Sentinel SIEM agent, based on MOM - thanks d4ph1l-->
99
</Rule>
1010
</ProcessCreate>

‎7_image_load/exclude_dotnet_load_powershell.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
<Rule groupRelation="and">
66
<!-- COMMENT: Removes unnecessary ImageLoaded events. These 4 DLLs flag as Process Injection normally -->
77
<!-- COMMENT: I consider this to be noise - there are many other notifications PowerShell has been started. -->
8-
<Image condition="is">powershell.exe</Image>
9-
<OriginalFileName condition="excludes all">mscoree.dll;mscoreei.dll;mscoreeis.dll;clr.dll;clrjit.dll</OriginalFileName>
8+
<Image condition="is any">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe</Image>
9+
<OriginalFileName condition="is any">mscoree.dll;mscoreei.dll;mscoreeis.dll;clr.dll;clrjit.dll</OriginalFileName>
1010
</Rule>
1111
</ImageLoad>
1212
</RuleGroup>

0 commit comments

Comments
 (0)