Suggested addition to ProcessAccess event, for MS Intune

[cyb3rxp]

Hi,

I'd like to report the following field feedback: numerous events 10 being generated by Microsoft Intune process, targeting regular/legit running processes.

Here is the common SourceImage (should be needed for exclusion, IMHO) of those events:
C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe

Below are examples of legit processes being listed in the "TargetImage" for those events:

• C:\WINDOWS\system32\wbem\WmiApSrv.exe
• C:\WINDOWS\system32\deviceenroller.exe
• \?\C:\WINDOWS\system32\wbem\WMIADAP.EXE
• C:\Program Files\WSL\wsl.exe
• C:\Program Files\Notepad++\notepad++.exe
• C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
• C:\Program Files\WindowsApps\Microsoft.SurfaceHub_74.8150.129.0_x64__8wekyb3d8bbwe\Services\DeviceColorDm.exe

HTH.
Thanks.