add sdbinst.exe to shimming rule

jorik-utwente · jorik-utwente · commit d95d7b6027e7 · 2024-11-13T11:56:26.000+01:00
diff --git a/nursery/persist-via-application-shimming.yml b/nursery/persist-via-application-shimming.yml
@@ -23,3 +23,6 @@ rule:
           - match: move file
           - match: host-interaction/file-system/write
         - string: /.sdb/i
+      - and:
+        - match: host-interaction/process/create
+        - string: /sdbinst(|\.exe) /i
