j-gray 37 Posted June 12 Share Posted June 12 Our Remote Desktop Server creates many detections daily for 'Injection into system process [F0413b]'. The triggering processes are different, but as far as I can tell, the event is always, "CodeInjection tssdis.exe(6864) (ApcQueue)" What would be the proper syntax to exclude any Event triggered by tssdis.exe? Appreciate any assistance. Link to comment Share on other sites More sharing options...
Recommended Posts