security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adding missing :

Browse Source
This commit is contained in:
Tim Shelton
2021-12-01 23:14:57 +00:00
parent bd13c7b77b
commit 0e55a06e6e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/powershell_malicious_commandlets.yml
+1 -1
View File
@@ -114,7 +114,7 @@ detection:
- "Invoke-Mimikittenz"
- "Invoke-AllChecks"
false_positives:
ScriptBlockText|contains
ScriptBlockText|contains:
- Get-SystemDriveInfo # http://bheltborg.dk/Windows/WinSxS/amd64_microsoft-windows-maintenancediagnostic_31bf3856ad364e35_10.0.10240.16384_none_91ef7543a4514b5e/CL_Utility.ps1
- C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Scripts\Set-Wallpaper.ps1 # false positive form Amazon EC2
condition: select_Malicious and not false_positives