fix fp autorun

JerryLinLinLin · Sep 7, 2023 · 85c18d2 · 85c18d2
1 parent 49a1340
commit 85c18d2
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/rules/Suspicious.SysProcAddAutoRun/auto.json b/rules/Suspicious.SysProcAddAutoRun/auto.json
@@ -25,6 +25,14 @@
                 "action_type": 5,
                 "treatment": 0
             }
+        ],
+        "*\\Windows\\Sys?????\\reg.exe": [
+            {
+                "res_path": "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*",
+                "montype": 2,
+                "action_type": 5,
+                "treatment": 0
+            }
         ]
     }
 }