Forum Discussion
Timeline events - T1105: Ingress Tool Transfer
I see a "T1105: Ingress Tool Transfer" event for a device of us but this is a false positive.
Does Defender takes any action on this or is it just a notification?
Can I whitelist this? How?
- There is no action taken on this sort of tagging, it is just there to assist an analyst who is looking for odd things in the timeline.
