j-gray 37 Posted June 12 Share Posted June 12 Our Remote Desktop Server creates many detections daily for 'Injection into system process [F0413b]'. The triggering processes are different, but as far as I can tell, the event is always, "CodeInjection tssdis.exe(6864) (ApcQueue)" What would be the proper syntax to exclude any Event triggered by tssdis.exe? Appreciate any assistance. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.