+1
@@ -1,6 +1,7 @@
|
||||
title: Change PowerShell Policies to a Unsecure Level
|
||||
id: 61d0475c-173f-4844-86f7-f3eebae1c66b
|
||||
description: Detects use of Set-ExecutionPolicy to set a unsecure policies
|
||||
status: experimental
|
||||
references:
|
||||
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1
|
||||
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1
|
||||
|
||||
+1
@@ -6,6 +6,7 @@ related:
|
||||
- id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299
|
||||
type: derived
|
||||
description: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
|
||||
status: experimental
|
||||
references:
|
||||
- https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
|
||||
author: 'Ensar Şamil, @sblmsrsn, OSCD Community'
|
||||
|
||||
Reference in New Issue
Block a user