Update powershell_CL_Invocation_LOLScript.yml

2020-10-18 10:38:40 +03:00
parent a6f00d6acc
commit 3aa2a73ba7
1 changed files with 2 additions and 1 deletions
@@ -26,7 +26,8 @@ detection:
          - 'SyncInvoke'
    timeframe: 1m
    condition: 
-        - selection or (selection2 | count(ScriptBlockText) by Computer > 2)
+        - selection
+        - selection2 | count(ScriptBlockText) by Computer > 2
      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; SyncInvoke c:\Evil.exe
      # or
      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1