Skip to content

Commit 4904818

Browse files
committed
fix(rules): Remove Windows Defender exceptions
1 parent 166546a commit 4904818

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

rules/credentail_access_file_access_to_sam_database.yml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: File access to SAM database
22
id: e3dace20-4962-4381-884e-40dcdde66626
3-
version: 1.0.6
3+
version: 1.0.7
44
description: |
55
Identifies access to the Security Account Manager on-disk database.
66
labels:
@@ -33,8 +33,6 @@ condition: >
3333
'?:\\Windows\\System32\\vmwp.exe',
3434
'?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe',
3535
'?:\\Windows\\System32\\wuauclt.exe',
36-
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
37-
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe',
3836
'?:\\Windows\\System32\\MRT.exe'
3937
)
4038

0 commit comments

Comments
 (0)