Splitting into two rules

2020-10-28 19:08:23 +03:00
parent 3aa2a73ba7
commit 55a7fe6b9d
2 changed files with 28 additions and 14 deletions
@@ -19,18 +19,6 @@ detection:
        ScriptBlockText|contains|all:
          - 'CL_Invocation.ps1'
          - 'SyncInvoke'
-    selection2:
-        EventID: 4104
-        ScriptBlockText|contains:
-          - 'CL_Invocation.ps1'
-          - 'SyncInvoke'
-    timeframe: 1m
-    condition: 
-        - selection
-        - selection2 | count(ScriptBlockText) by Computer > 2
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; SyncInvoke c:\Evil.exe
-      # or
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
-      # PS > SyncInvoke c:\Evil.exe
+    condition:  selection
 falsepositives: Unknown
-level: high
+level: high