Skip to content

Commit

Permalink
Update net_connection_win_notepad.yml
Browse files Browse the repository at this point in the history
  • Loading branch information
nasbench committed Feb 9, 2024
1 parent 3425518 commit 30af0cb
Showing 1 changed file with 3 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,9 @@ logsource:
detection:
selection:
Image|endswith: '\notepad.exe'
condition: selection
filter_optional_printing:
DestinationPort: 9100
condition: selection and not 1 of filter_optional_*
falsepositives:
- Printing documents via notepad might cause communication with the printer via port 9100 or similar.
level: high

0 comments on commit 30af0cb

Please sign in to comment.