diff --git a/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml b/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml index c7e482c88..7c1fc3063 100644 --- a/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml +++ b/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml @@ -26,7 +26,8 @@ detection: - 'SyncInvoke' timeframe: 1m condition: - - selection or (selection2 | count(ScriptBlockText) by Computer > 2) + - selection + - selection2 | count(ScriptBlockText) by Computer > 2 # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; SyncInvoke c:\Evil.exe # or # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1