Endpoint Standard: Test Rule for "Injects code or modifies memory of another process" missing TTP

[#1]

Environment

• Carbon Black Cloud Console: All Versions
  • Endpoint Standard

Symptoms

Logic for TTP: MODIFY_PROCESS_EXECUTION is not included in test rule search, but events with the TTP are blcoked with "Injects code or modifies memory of another process"  rule in place
 

Cause

Test rule is missing TTP - DSER-27456

Resolution

When using the Test Rule feature, append OR ttp:MODIFY_PROCESS_EXECUTION to the query