Assistance Needed: Reformatting Provided Events to Match Structure of 'blacklist3'

AL3Z — Sat, 02 Dec 2023 07:14:42 GMT

Hi,

Tanium Events:

C:\\Program Files $x86$\\Tanium\\Tanium Client\\Tools\\StdUtils\\TaniumExecWrapper\.exe|
C:\\Program Files (\x86\)\\Tanium\\Tanium Client\\Patch\\tools\\TaniumExecWrapper\.exe|
C:\\Program Files $x86$\\Tanium\\Tanium Client\\TaniumClient\.exe|
C:\\Program Files $x86$\\Tanium\\Tanium Client\\Patch\\tools\\TaniumFileInfo\.exe|
C:\\Program Files $x86$\\Tanium\\Tanium Client\\TaniumCX\.exe|
C:\\Program Files $x86$\\Tanium\\Tanium Client\\python38\\TPython\.exe|
C:\Program Files (x86)\Tanium\Tanium Client\Tools\Patch\7za.exe

Windows defender:

C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\.*\MpCmdRun.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\.*\MsMpEng.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\.*\OpenHandleCollector.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\.*\SenseCM.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\.*\SenseIR.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\.*\MsSense.exe
C:\Program Files\Windows Defender\MpCmdRun.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\10.8560.25364.1036\SenseTVM.exe

Rapid7

ParentProcessName count
C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.2.4.63\ir_agent.exe
C:\Program Files\Rapid7\Insight Agent\components\insight_agent\4.0.0.1\ir_agent.exe
C:\Program Files\Rapid7\Insight Agent\ir_agent.exe
C:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\.*\\get_proxy\.exe|

Azure:

C:\Program Files\AzureConnectedMachineAgent\ExtensionService\GC\gc_service.exe
C:\Program Files\AzureConnectedMachineAgent\GCArcService\GC\gc_arc_service.exe
C:\Program Files\AzureConnectedMachineAgent\GCArcService\GC\gc_service.exe
C:\Program Files\AzureConnectedMachineAgent\GCArcService\GC\gc_worker.exe
C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe

Gytpol:

C:\\Program Files\\WindowsPowerShell\\Modules\\gytpol\\Client\\fw.*\\GytpolClientFW.*\.exe|

forescout:

ParentProcessName count
C:\Program Files\ForeScout SecureConnector\SecureConnector.exe

Thanks//..

topic Assistance Needed: Reformatting Provided Events to Match Structure of 'blacklist3' in Getting Data In

Assistance Needed: Reformatting Provided Events to Match Structure of 'blacklist3'