Fix falsepositives list
This commit is contained in:
@@ -4,6 +4,7 @@ description: Detects Execution via SyncInvoke in CL_Invocation.ps1 module
|
||||
status: experimental
|
||||
author: oscd.community, Natalia Shornikova
|
||||
date: 2020/10/14
|
||||
modified: 2021/05/21
|
||||
references:
|
||||
- https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/Cl_invocation.yml
|
||||
- https://twitter.com/bohops/status/948061991012327424
|
||||
@@ -20,5 +21,6 @@ detection:
|
||||
- 'CL_Invocation.ps1'
|
||||
- 'SyncInvoke'
|
||||
condition: selection
|
||||
falsepositives: Unknown
|
||||
falsepositives:
|
||||
- Unknown
|
||||
level: high
|
||||
|
||||
Reference in New Issue
Block a user