[Rule Tuning] Unusual Print Spooler Child Process #4987
Description
Link to Rule
No response
Rule Tuning Type
False Positives - Reducing benign events mistakenly identified as threats.
Description
The current rule allows for ?:\\Program Files (x86)\\CutePDF Writer\\CPWriter2.exe, but I found C:\Program Files (x86)\CutePDF Writer\CPWSave.exe with the following signature in my environment.
https://www.virustotal.com/gui/file/59f6afe416182af25cf9f30ef2bf69e4141755c40d34020e8ac3a014b474e18d/details
Please determine if it is reasonable to also allow for ?:\\Program Files (x86)\\CutePDF Writer\\CPWSave.exe.
Thanks!
Example Data
No response