paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-11-02 12:53:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update 900000-exclusion_rules.xml

Browse Source
This commit is contained in:
taylor_socfortress
2025-02-13 09:37:27 -06:00
committed by GitHub
parent 7830480fc7
commit 813457a498
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
Exclusion Rules/900000-exclusion_rules.xml
View File

@@ -685,4 +685,19 @@
<description>DLL file created by printer spool service, possible malware binary drop from PrintNightmare exploit</description>
<options>no_full_log</options>
</rule>
<!-- Exclude Windows Common Process Creation for Ninja RMM -->
<rule id="900098" level="1">
<if_sid>67027</if_sid>
<field name="win.eventdata.parentProcessName" type="pcre2">(?i)^C:\\\\Program Files \(x86\)\\\\[\w\d\.-]+\\\\NinjaRMMAgent\.exe$</field>
<field name="win.eventdata.newProcessName" type="pcre2">(?i)^C:\\\\Windows\\\\SysWOW64\\\\sc\.exe$|(?i)^C:\\\\Program Files\\\\SentinelOne\\\\Sentinel Agent \d+\.\d+\.\d+\.\d+\\\\SentinelCtl\.exe$|(?i)^C:\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1\.0\\\\powershell\.exe$|(?i)^C:\\\\Windows\\\\SysWOW64\\\\cmd\.exe$</field>
<description>Exclude Windows Common Process Creation for NinjaRMM.</description>
<options>no_full_log</options>
</rule>
<!-- Exclude Windows Common Process Creation for LTSVC -->
<rule id="900099" level="1">
<if_sid>67027</if_sid>
<field name="win.eventdata.parentProcessName" type="pcre2">(?i)^C:\\\\Windows\\\\LTSvc\\\\LTSVC\.exe$</field>
<description>Exclude Windows Common Process Creation for LTSVC.</description>
<options>no_full_log</options>
</rule>
</group>