Skip to content

Minor Fixes Against False Positive Patterns - #4249

Open
onurmerdogan wants to merge 8 commits into
developfrom
fix_fp_patterns_0831
Open

Minor Fixes Against False Positive Patterns#4249
onurmerdogan wants to merge 8 commits into
developfrom
fix_fp_patterns_0831

Conversation

@onurmerdogan

@onurmerdogan onurmerdogan commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Details

Applied minor fixes to some of the detections that are exhibiting clusters of FP.

Windows Private Keys Discovery

  • Detection was reporting on non-Windows activities
  • dir pattern often mis-matching variables($dir), command line parameters(output-dir), or incorrect commands(mkdir)
  • Key extensions matching objects, paths, domain names etc.

Jscript Execution Using Cscript App

  • Triggers on regular runs of Symantec Host Integrity checks

Comment thread detections/endpoint/windows_private_keys_discovery.yml Outdated
@nasbench nasbench added this to the v6.6.0 milestone Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Linux Adding Crontab Using List Parameter — add redirection coverage, fix Industroyer2 reference

2 participants