Forum Discussion

TomWuyts's avatar
TomWuyts
Copper Contributor
Sep 23, 2024

Timeline events - T1105: Ingress Tool Transfer

I see a "T1105: Ingress Tool Transfer" event for a device of us but this is a false positive.
Does Defender takes any action on this or is it just a notification?

Can I whitelist this? How?

 

 

  • jbmartin6's avatar
    jbmartin6
    Iron Contributor
    There is no action taken on this sort of tagging, it is just there to assist an analyst who is looking for odd things in the timeline.

Resources