attack-pattern json flagged as TrojanDownloader:Win32/Bumoru.A by Windows Defender about cti

[khho]

I tested and the change works. Windows Defender is not triggered.

[jburns12]

@khho - thanks for bringing this up. One option we're considering to resolve this is providing some amount of obfuscation for the string. For example, adding brackets around the colons and periods - cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs

I tested this in VirusTotal and it looks like it resolves the issue there. Would you be willing to mod the file as such and see if it still triggers Windows Defender?

[jburns12]

Thanks for testing that out @khho . We're going to work on getting this and similar descriptions obfuscated. I'll leave this issue open until those updates have occurred.

Many thanks again for bringing this to our attention!

[jburns12]

This issue was resolved in the October 2018 ATT&CK content update.