Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

chore: update Microsoft references link to use the "learn" subdomain instead of "docs". 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Thanks: @ryanplasma

rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml

@@ -6,7 +6,7 @@ description: |
   This will bypass the default DNS server and uses a specified server for answering the query.
 references:
     - https://twitter.com/NathanMcNulty/status/1569497348841287681
-    - https://docs.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
 author: Borna Talebi
 date: 2021/09/14
 modified: 2022/10/09

rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml

@@ -4,7 +4,7 @@ status: test
 description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information
 references:
     - https://attack.mitre.org/datasources/DS0005/
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7
 author: frack113
 date: 2022/01/12
 tags:

rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml

@@ -6,7 +6,7 @@ description: |
     Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell
-    - https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=dotnet-plat-ext-6.0
+    - https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
 author: frack113
 date: 2021/12/28
 tags:

rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml

@@ -6,7 +6,7 @@ description: |
     Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md
-    - https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
 author: frack113
 date: 2022/09/10
 tags:

rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml

@@ -4,7 +4,7 @@ status: test
 description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2
 author: frack113
 date: 2022/01/07
 tags:

rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml

@@ -8,7 +8,7 @@ description: |
     Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool.
     Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
 references:
-    - https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
     - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
     - https://learn.microsoft.com/en-us/windows/wsl/install-on-server
 author: frack113

rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml

@@ -7,7 +7,7 @@ status: test
 description: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
 references:
     - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
-    - https://docs.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate
+    - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
     - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
 author: Florian Roth (Nextron Systems)
 date: 2021/04/23

rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml

@@ -7,7 +7,7 @@ description: |
     Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
 author: frack113
 date: 2021/12/30
 tags:

rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml

@@ -4,7 +4,7 @@ status: test
 description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-2---invoke-command
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.4
 author: frack113
 date: 2022/01/07
 tags:

rules/windows/powershell/powershell_script/posh_ps_localuser.yml

@@ -6,7 +6,7 @@ description: |
     Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
 author: frack113
 date: 2021/12/28
 tags:

rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml

@@ -3,7 +3,7 @@ id: cd185561-4760-45d6-a63e-a51325112cae
 status: test
 description: Detects usage of a PowerShell command to dump the live memory of a Windows machine
 references:
-    - https://docs.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo
+    - https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps
 author: Max Altgelt (Nextron Systems)
 date: 2021/09/21
 modified: 2022/12/25

rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml

@@ -7,7 +7,7 @@ description: |
     Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt
-    - https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)
+    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)
     - https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
 author: frack113, MatilJ
 date: 2022/01/19

rules/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml

@@ -6,7 +6,7 @@ description: |
     PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-10---powershell-invoke-downloadcradle
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-7.4
 author: frack113
 date: 2022/01/06
 modified: 2023/01/02

rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml

@@ -4,7 +4,7 @@ status: test
 description: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso
-    - https://docs.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
 author: frack113
 date: 2022/02/01
 tags:

rules/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml

@@ -5,7 +5,7 @@ description: Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdle
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md
     - https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.4
 author: frack113
 date: 2022/01/07
 modified: 2023/05/04

rules/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml

@@ -6,7 +6,7 @@ description: |
     The data may also be sent to an alternate network location from the main command and control server.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4
     - https://www.ietf.org/rfc/rfc2821.txt
 author: frack113
 date: 2022/09/26

rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml

@@ -10,8 +10,8 @@ related:
 status: test
 description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.
 references:
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
     - https://adsecurity.org/?p=2604
 author: frack113
 date: 2021/10/20

rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml

@@ -4,7 +4,7 @@ status: test
 description: Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy
-    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy
+    - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps
 author: frack113
 date: 2022/03/17
 tags:

rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml

@@ -4,7 +4,7 @@ status: test
 description: Detect use of Get-GPO to get one GPO or all the GPOs in a domain.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md
-    - https://docs.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
 author: frack113
 date: 2022/06/04
 tags:

rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml

@@ -4,7 +4,7 @@ status: test
 description: Get the processes that are running on the local computer.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.4
 author: frack113
 date: 2022/03/17
 tags:

rules/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml

@@ -3,7 +3,7 @@ id: 42d36aa1-3240-4db0-8257-e0118dcdd9cd
 status: test
 description: Adversaries may carry out malicious operations using a virtual instance to avoid detection
 references:
-    - https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
+    - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine
 author: frack113
 date: 2022/04/09

rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml

@@ -4,7 +4,7 @@ status: test
 description: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
-    - https://docs.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
 author: frack113
 date: 2022/02/01
 tags:

rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml

@@ -4,7 +4,7 @@ status: test
 description: Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2
 author: frack113
 date: 2022/08/13
 tags:

rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml

@@ -4,7 +4,7 @@ status: test
 description: Powershell use PassThru option to start in background
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
 author: frack113
 date: 2022/01/15
 tags:

rules/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml

@@ -4,7 +4,7 @@ status: test
 description: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-3---remove-the-zoneidentifier-alternate-data-stream
-    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2
 author: frack113
 date: 2022/02/01
 tags:

rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml

@@ -7,7 +7,7 @@ status: experimental
 description: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
-    - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
     - https://bidouillesecurity.com/disable-windows-defender-in-powershell/
 author: frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
 date: 2022/01/16

rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml

@@ -6,7 +6,7 @@ description: |
     For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell
-    - https://docs.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
+    - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
 author: frack113
 date: 2022/01/23
 tags:

rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml

@@ -6,7 +6,7 @@ related:
 status: test
 description: Detects when a user disables the Windows Firewall via a Profile to help evade defense.
 references:
-    - https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps
+    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps
     - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
     - http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
     - http://woshub.com/manage-windows-firewall-powershell/