Sysmon - Legitimate Parent Image - smss.exe

Description

field win.eventdata.parentImage="system"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 61632 Sysmon - Suspicious Process - smss.exe anchor level 12
   field win.eventdata.image="smss.exe"
2. 61633 Sysmon - Legitimate Parent Image - smss.exe suppression level 0 this rule
   field win.eventdata.parentImage="system"

Rule dependencies

Depends on

• composes · Wazuh if_sid 61632
  • Sysmon - Suspicious Process - smss.exe