Add PowerPoint and Publisher to sleep signature whitelist

PowerPoint and Publisher similarly to Word and Excel cause false positives with the sleep signature. Add them to the exclude list.
cuckoosandbox · Jul 31, 2019 · dab22dc · dab22dc
1 parent bea52ce
commit dab22dc
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/modules/signatures/windows/antisandbox_sleep.py b/modules/signatures/windows/antisandbox_sleep.py
@@ -32,6 +32,8 @@ class AntiSandboxSleep(Signature):
         "acrord32.exe",
         "winword.exe",
         "excel.exe",
+        "powerpnt.exe",
+        "mspub.exe",
     ]
 
     def init(self):