t1555.003 | LoFP

t1555.003

Title	Tags
antivirus, anti-spyware, anti-malware software	t1003 t1217 t1555 t1555.003 windows sigma
as the script block is a blob of text. false positive may occur with scripts that contain the keyword as a reference or simply use it for detection.	t1046 t1082 t1106 t1518 t1548 t1548.002 t1552 t1552.001 t1555 t1555.003 windows sigma
false positive is quite limited. filter is needed	t1555.003 endpoint splunk
legitimate software accessing browser data for synchronization or backup purposes.	t1217 t1555 t1555.003 windows sigma
legitimate software installed on partitions other than \"c:\\"	t1003 t1217 t1555 t1555.003 windows sigma
legitimate use	t1005 t1040 t1059 t1072 t1090 t1124 t1127 t1219 t1219.002 t1484 t1484.001 t1546 t1546.015 t1555 t1555.003 t1562 t1562.001 windows sigma
other browser not listed related to chrome may catch by this rule.	t1555.003 endpoint splunk
other browser not listed related to firefox may catch by this rule.	t1555.003 endpoint splunk