Hello, I am currently creating a Chronicle rule that checks specific registry key values and was wondering if I reference a list am I able to put the entire file path? For example I have the following file path that is returned in the events:
c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe
Right now I am using the RegEx syntax for the List and have the following:
vpnagent.exe // From c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe
Now it does work but I really would like to reference the entire path and not just the name of the exe file. Any ideas?
LinkedIn
Twitter
