增加白名单、进程链增加详细信息

2022-08-31 17:52:26 +08:00
parent 5c15aa975d
commit e3ae734150
29 changed files with 666 additions and 335 deletions
--- a/Server/rules/py/action.py
+++ b/Server/rules/py/action.py
@@ -17,7 +17,7 @@ rule = [
        'rules': [
            'action == "processaccess" and calltrace =~ ".*unknown.*" and not calltrace =~ ".*conpty\.node.*" and not calltrace =~ ".*java\.dll.*" and not calltrace =~ ".*appvisvsubsystems64\.dll.*" and not calltrace =~ ".*twinui\.dll.*" and not calltrace =~ ".*nativeimages.*" and not targetimage == "c:\\windows\\system32\\cmd.exe"',
        ],
-        'score': 40,
+        'score': 20,
        'name': '异常进程访问'
    },
    {