Update proc_creation_win_pdqdeploy_runner_susp_children.yml

2022-07-23 12:08:29 +02:00
parent 6a3bfb57c0
commit 402f171a89
1 changed files with 0 additions and 1 deletions
@@ -23,7 +23,6 @@ detection:
            - '\rundll32.exe'
            - '\mshta.exe'
            - '\csc.exe'
-            - '\powershell.exe'
        - Image|contains:
            - 'C:\Users\Public\'
            - '\AppData\Local\Temp'