Added Exclusion To defense_evasion_process_execution_from_self_deleti…

…ng_binary.yml
rabbitstack · Feb 11, 2025 · 618e5dc · 618e5dc
1 parent eab4790
commit 618e5dc
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/rules/defense_evasion_process_execution_from_self_deleting_binary.yml b/rules/defense_evasion_process_execution_from_self_deleting_binary.yml
@@ -19,8 +19,13 @@ references:
 
 condition: >
   sequence
-  maxspan 1m
-    |delete_file and file.info.is_disposition_delete_file| by file.name
+  maxspan 1m 
+    |delete_file 
+      and 
+    file.info.is_disposition_delete_file
+      and
+    not file.name imatches '?:\\Windows\\SoftwareDistribution\\Download\\*'
+    | by file.name
     |load_module| by image.name
 
 output: >