security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: more chocolatey FPs

Browse Source
This commit is contained in:
phantinuss
2022-02-16 13:04:26 +01:00
parent 96bf7421fc
commit 12fffc5fd5
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/deprecated/powershell_suspicious_invocation_specific.yml
+2 -1
View File
@@ -7,7 +7,7 @@ tags:
- attack.t1059.001
author: Florian Roth (rule), Jonhnathan Ribeiro
date: 2017/03/05
modified: 2022/02/11
modified: 2022/02/16
logsource:
product: windows
service: powershell
@@ -53,6 +53,7 @@ detection:
- '.Download'
filter_chocolatey:
- "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
- "(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')"
condition: (all of convert_b64 or all of iex_selection or all of enc_selection or all of reg_selection or all of webclient_selection or all of iex_webclient) and not 1 of filter_*
falsepositives:
- Penetration tests
rules/windows/powershell/powershell_script/posh_ps_suspicious_invocation_specific.yml
+4 -2
View File
@@ -10,7 +10,7 @@ tags:
- attack.t1059.001
author: Florian Roth (rule), Jonhnathan Ribeiro
date: 2017/03/05
modified: 2022/02/11
modified: 2022/02/16
logsource:
product: windows
category: ps_script
@@ -61,7 +61,9 @@ detection:
- 'Net.WebClient'
- '.Download'
filter_chocolatey:
ScriptBlockText|contains: "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
ScriptBlockText|contains:
- "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
- "(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')"
condition: 1 of select* and not 1 of filter*
falsepositives:
- Penetration tests