From 2ca470be98f7863f48c7334aa387d7daef30ae3f Mon Sep 17 00:00:00 2001
From: taylor_socfortress <111797488+taylorwalton@users.noreply.github.com>
Date: Tue, 20 Jun 2023 08:29:55 -0500
Subject: [PATCH] Update 900000-exclusion_rules.xml

---
 Exclusion Rules/900000-exclusion_rules.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Exclusion Rules/900000-exclusion_rules.xml b/Exclusion Rules/900000-exclusion_rules.xml
index 51d474e..a5865a2 100644
--- a/Exclusion Rules/900000-exclusion_rules.xml	
+++ b/Exclusion Rules/900000-exclusion_rules.xml	
@@ -258,7 +258,7 @@
   </rule>
   <!-- Exclude MicroSoft Teams -->
   <rule id="900040" level="1">
-    <if_sid>92910</if_sid>
+    <if_sid>92910,106117</if_sid>
     <field name="win.eventdata.sourceImage" type="pcre2">(?i)C:\\\\ProgramData\\\\.*\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe$|</field>
     <description>Exclude Microsoft Teams</description>
     <options>no_full_log</options>