Merge branch 'master' into dependabot/pip/carbon-black-cloud-sdk-appr…

…ox-eq-1.5.2
redcanaryco · Sep 20, 2024 · d732dfc · d732dfc
2 parents 54aab3d + 0d03e2d
commit d732dfc
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 4 deletions.
diff --git a/definitions/anonymizer.json b/definitions/anonymizer.json
@@ -9,4 +9,8 @@
         "process_name": ["tbear.exe",
                          "tbear.maintenance.exe"]
     }
+    "Brave": {
+        "process_name": ["brave.exe"],
+        "digsig_publisher": ["Brave Software, Inc."]
+    }
 }
diff --git a/definitions/remote-admin.json b/definitions/remote-admin.json
@@ -95,6 +95,11 @@
                         "pcmonitorsrv.exe"],
         "digsig_publisher": ["MMSoft Design Ltd."]
     },
+    "Quick Assist": {
+        "process_name": ["quickassist.exe"],
+        "domain": ["*.support.services.microsoft.com"],
+        "cmdline": ["ms-quick-assist"]
+    },
     "RAdmin": { 
         "process_name": ["radmin3.exe",
                          "famitrfc.exe",
@@ -304,8 +309,7 @@
                         "TakeControl.exe",
                         "BASupSysInf.exe",
                         "BASupAppSrvc.exe",
-                        "BASupAppElev.exe",
-                        "BASupApp.exe"],
+                        "BASupAppElev.exe"],
         "domain": ["beanywhere.com"]
     },
     "Splashtop (Beta)": {
@@ -420,8 +424,8 @@
     },
     "GetScreen":{
         "digsig_publisher":["Get Skrin Softver"],
-        "process_name":["GetScreen.exe", 
-                        "GetScreen.me"]
+        "process_name":["GetScreen.exe"], 
+        "domain":["GetScreen.me"]
     },
     "ManageEngine":{
         "digsig_publisher":["ManageEngine Remote Access Plus", 

diff --git a/definitions/scripting.json b/definitions/scripting.json
@@ -34,4 +34,9 @@
                          "bash",
                          "zsh"]
     }
+    "AutoHotKey": { 
+        "process_name": ["autohotkey.exe",
+                        "AutoHotkeyU32.exe",
+                        "AutoHotkeyA32.exe",
+                        "AutoHotkeyU64.exe"]      
 }