Forum Discussion
Timeline events - T1105: Ingress Tool Transfer
I see a "T1105: Ingress Tool Transfer" event for a device of us but this is a false positive. Does Defender takes any action on this or is it just a notification? Can I whitelist this? How? ...
There is no action taken on this sort of tagging, it is just there to assist an analyst who is looking for odd things in the timeline.