[Rule Tuning] Component Object Model Hijacking - alerts about Slack, Spotify

[richlv]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/persistence_suspicious_com_hijack_registry.toml

Rule Tuning Type

False Positives - Reducing benign events mistakenly identified as threats.

Description

Component Object Model Hijacking alerts about Slack, Spotify.
Potentially useful fields/values:

process.code_signature.subject_name Slack Technologies, LLC
process.code_signature.subject_name Spotify AB

Example Data

No response

[richlv]

Thank you for the fix :)