Cleanup PS rules

2021-08-21 09:58:58 +02:00
parent da839775fe
commit 0fb6c35b1f
12 changed files with 12 additions and 14 deletions
@@ -0,0 +1,22 @@
+title: Accessing WinAPI in PowerShell. Code Injection.
+id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
+status: experimental
+description: Detecting Code injection with PowerShell in another process
+author: Nikita Nazarov, oscd.community
+date: 2020/10/06
+references:
+    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
+tags:
+    - attack.execution
+    - attack.t1059.001
+logsource:
+    product: windows
+    category: create_remote_thread
+    definition: 'Note that you have to configure logging for CreateRemoteThread in Symson config'
+detection:
+    selection:
+        SourceImage|endswith: '\powershell.exe'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high