This showed up in our SIEM today. I have been trying to figure this out. I can get it to work in a UDM search, but not in a rule.
UDM
principal.hostname in regex %CCF_SM_WINDOWS_Hack_Tools_CommandLine_Group1_Exclude.Hostname nocase
target.process.file.full_path in regex %CCF_SM_WINDOWS_Hack_Tools_CommandLine_Group1_Exclude.target_process_file_full_path nocase
Rule:
or ($e1.principal.hostname in regex %CCF_SM_WINDOWS_Hack_Tools_CommandLine_Group1 nocase
and $e1.target.process.file.full_path in regex %CCF_SM_WINDOWS_Hack_Tools_CommandLine_Group1_Exclude.target_process_file_full_path nocase
)
what am I doing wrong?
