How to whitelist a command-line argument?

[tmbarnhart]

We have a "Cloud IOC: W32.WMIProcessCores.ioc" triggering.

It's a legit Microsoft SCCM inventory process.

I don't want to whitelist all "wmic.exe" paths or SHAs, only this specific command-line.

Any guidance?

Thanks,

Troy

[Muhammad Awais Khan]

Hi,

You can white list this specific path by adding below in your existing exclusion sets or new:

Under the exclusion set, Choose 'Path' and value = CSIDL_WINDOWS\System32\Wbem

[Troja007]

Hello @tmbarnhart,

there is an open FR for this: AMP4E-I-1143 

You may query your Cisco Representative to get frequently updated for this.

Greetings,

Thorsten

[Dennis Perto]

Any updates on this one? :)