Bugfix: PowerShell rules log source inconstency

rules/windows/powershell/powershell_exe_calling_ps.yml

@@ -4,8 +4,8 @@ description: Detects PowerShell called from an executable by the version mismatc
 reference: https://adsecurity.org/?p=2921
 author: Sean Metcalf (source), Florian Roth (rule)
 logsource:
-    platform: windows
-    product: powershell
+    product: windows
+    service: powershell
     description: 'It is recommanded to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
 detection:
     selection1:

rules/windows/powershell/powershell_malicious_commandlets.yml

@@ -4,8 +4,8 @@ description: Detects Commandlet names from well-known PowerShell exploitation fr
 reference: https://adsecurity.org/?p=2921
 author: Sean Metcalf (source), Florian Roth (rule)
 logsource:
-    platform: windows
-    product: powershell
+    product: windows
+    service: powershell
     description: 'It is recommanded to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
 detection:
     keywords:

rules/windows/powershell/powershell_malicious_keywords.yml

@@ -4,8 +4,8 @@ description: Detects Commandlet names from well-known PowerShell exploitation fr
 reference: https://adsecurity.org/?p=2921
 author: Sean Metcalf (source), Florian Roth (rule)
 logsource:
-    platform: windows
-    product: powershell
+    product: windows
+    service: powershell
     description: 'It is recommanded to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
 detection:
     keywords:

rules/windows/powershell/powershell_psattack.yml

@@ -4,8 +4,8 @@ description: Detects the use of PSAttack PowerShell hack tool
 reference: https://adsecurity.org/?p=2921
 author: Sean Metcalf (source), Florian Roth (rule)
 logsource:
-    platform: windows
-    product: powershell
+    product: windows
+    service: powershell
     description: 'It is recommanded to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
 detection:
     EventID: 4103

rules/windows/powershell/powershell_suspicious_download.yml

@@ -3,8 +3,8 @@ status: experimental
 description: Detects suspicious PowerShell download command
 author: Florian Roth
 logsource:
-    platform: windows
-    product: powershell
+    product: windows
+    service: powershell
 detection:
     keywords:
         - 'System.Net.WebClient).DownloadString('

rules/windows/powershell/powershell_suspicious_invocation_generic.yml

@@ -3,8 +3,8 @@ status: experimental
 description: Detects suspicious PowerShell invocation command parameters
 author: Florian Roth (rule)
 logsource:
-    platform: windows
-    product: powershell
+    product: windows
+    service: powershell
 detection:
     encoded:
         - ' -enc '

rules/windows/powershell/powershell_suspicious_invocation_specific.yml

@@ -3,8 +3,8 @@ status: experimental
 description: Detects suspicious PowerShell invocation command parameters
 author: Florian Roth (rule)
 logsource:
-    platform: windows
-    product: powershell
+    product: windows
+    service: powershell
 detection:
     keywords:
         - ' -nop -w hidden -c * [Convert]::FromBase64String'