Merge PR #5229 from @dsplice - Update Potential APT FIN7 Exploitation Activity

update: Potential APT FIN7 Exploitation Activity - Add false positive description

Author: dsplice

rules-emerging-threats/2024/TA/FIN7/proc_creation_win_apt_fin7_exploitation_indicators.yml

@@ -25,5 +25,5 @@ detection:
         Image|endswith: '\notepad++.exe'
     condition: 1 of selection_*
 falsepositives:
-    - Unknown
+    - Notepad++ can legitimately spawn cmd (Open Containing Folder in CMD)
 level: medium