Add PowerPoint and Publisher to sleep signature whitelist

michaelweiser · michaelweiser · commit dab22dcac0bd · 2019-07-31T15:26:45.000+02:00
PowerPoint and Publisher similarly to Word and Excel cause false positives with
the sleep signature. Add them to the exclude list.
diff --git a/modules/signatures/windows/antisandbox_sleep.py b/modules/signatures/windows/antisandbox_sleep.py
@@ -32,6 +32,8 @@ class AntiSandboxSleep(Signature):
         "acrord32.exe",
         "winword.exe",
         "excel.exe",
+        "powerpnt.exe",
+        "mspub.exe",
     ]
 
     def init(self):

Original file line number	Diff line number	Diff line change
`@@ -32,6 +32,8 @@ class AntiSandboxSleep(Signature):`
`32`	`32`	`"acrord32.exe",`
`33`	`33`	`"winword.exe",`
`34`	`34`	`"excel.exe",`
	`35`	`+ "powerpnt.exe",`
	`36`	`+ "mspub.exe",`
`35`	`37`	`]`
`36`	`38`
`37`	`39`	`def init(self):`