Add PowerPoint and Publisher to sleep signature whitelist

PowerPoint and Publisher similarly to Word and Excel cause false positives with the sleep signature. Add them to the exclude list.
cuckoosandbox · Jul 7, 2020 · 4db2820 · 4db2820
1 parent 14864b9
commit 4db2820
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/modules/signatures/windows/antisandbox_sleep.py b/modules/signatures/windows/antisandbox_sleep.py
@@ -32,6 +32,8 @@ class AntiSandboxSleep(Signature):
         "acrord32.exe",
         "winword.exe",
         "excel.exe",
+        "powerpnt.exe",
+        "mspub.exe",
     ]
 
     def init(self):