Potential Command Line Path Traversal Evasion Attempt

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_1": {
    "CommandLine
| contains": [
      "\\..\\Windows\\",
      "\\..\\System32\\",
      "\\..\\..\\"
    ],
    "NewProcessName
| contains": "\\Windows\\"
  },
  "selection_2": {
    "CommandLine
| contains": ".exe\\..\\"
  },
  "filter_optional_google_drive": {
    "CommandLine
| contains": "\\Google\\Drive\\googledrivesync.exe\\..\\"
  },
  "filter_optional_citrix": {
    "CommandLine
| contains": "\\Citrix\\Virtual Smart Card\\Citrix.Authentication.VirtualSmartcard.Launcher.exe\\..\\"
  },
  "condition": "process_creation and (1 of selection_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Google Drive
• ⚠ Citrix