chore: exclude noisy rules via mapping file

wawawao · Jul 7, 2022 · 0c76b48 · 0c76b48
1 parent b537956
commit 0c76b48
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/mappings/sigma-event-logs-all.yml b/mappings/sigma-event-logs-all.yml
@@ -12,6 +12,10 @@ exclusions:
 - Raw Disk Access Using Illegitimate Tools
 - Executable in ADS
 - Space After Filename - macOS
+- Execution Of Non-Existing File
+- Execution of Suspicious File Type Extension
+- Execution from Suspicious Folder
+- Process Start From Suspicious Folder
 
 groups:
   - name: Sigma

diff --git a/mappings/sigma-event-logs.yml b/mappings/sigma-event-logs.yml
@@ -9,6 +9,14 @@ exclusions:
   - NetNTLM Downgrade Attack
   - Non Interactive PowerShell
   - Wuauclt Network Connection
+  - Raw Disk Access Using Illegitimate Tools
+  - Executable in ADS
+  - Space After Filename - macOS
+  - Execution Of Non-Existing File
+  - Execution of Suspicious File Type Extension
+  - Execution from Suspicious Folder
+  - Process Start From Suspicious Folder
+
 
 groups:
   - name: Suspicious Process Creation