[BUG] False positive in rule "Suspicious Copy on System32"
iso-rgomez opened this issue · 2 comments
iso-rgomez commented
Describe the bug
The rule "Suspicious Copy on System32" triggers when the executable performing the copy has "windows\system32" in the path. In this case, it's not system32 that's being copied to or from, it's being referenced in a full command line. Example:
"C:\WINDOWS\system32\xcopy.exe" [redacted] [redacted] /D /E /C /H /I /K /Y
Neither redacted entry has system32 in it.
Expected behavior
Look for a match anywhere other than the first part of the command line, where the executable and path to executable are.
App Version:
- ESCU: 4.7.0
tccontre commented
looking to this one
tccontre commented
Thanks for this great feedback. the fixed for this issue is this PR: https://github.com/splunk/security_content/pull/2808/files