[Rule Tuning] Potential RemoteMonologue Attack - alerts about MS Defender #4942
Description
Link to Rule
Rule Tuning Type
False Positives - Reducing benign events mistakenly identified as threats.
Description
Rule "Potential RemoteMonologue Attack" frequently alerts about MS Defender activities.
Potentially useful values:
process.executable C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25060.7-0\MsMpEng.exe
registry.key SOFTWARE\Classes\AppID{1111A26D-EF95-4A45-9F55-21E52ADF9887}
registry.path HKLM\SOFTWARE\Classes\AppID{1111A26D-EF95-4A45-9F55-21E52ADF9887}\RunAs
process.Ext.code_signature.exists true
process.Ext.code_signature.status trusted
process.Ext.code_signature.subject_name Microsoft Windows Publisher
process.Ext.code_signature.trusted true
process.code_signature.exists true
process.code_signature.status trusted
process.code_signature.subject_name Microsoft Windows Publisher
process.code_signature.trusted true
Example Data
No response