Update 900000-exclusion_rules.xml

socfortress · Sep 9, 2023 · 98c505c · 98c505c
1 parent dae2f5d
commit 98c505c
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/Exclusion Rules/900000-exclusion_rules.xml b/Exclusion Rules/900000-exclusion_rules.xml
@@ -449,4 +449,12 @@
     <description>Exclude LogonSessions Running Sigma Alert</description>
     <options>no_full_log</options>
   </rule>
+  <!-- Exclude LogonSessions Running Sigma Alert -->
+  <rule id="900065" level="1">
+    <if_sid>200051</if_sid>
+    <field name="name" type="pcre2">(?i)^Remote Thread Creation In Uncommon Target Image$</field>
+    <field name="event.SourceImage" type="pcre2">(?i)^C:\\Program Files\\socfortress\\sysinternals\\logonsessions64\.exe$</field>
+    <description>Exclude LogonSessions Running Sigma Aler</description>
+    <options>no_full_log</options>
+  </rule>
 </group>