security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use doublequotes instead of ' because of ' in string

Browse Source
This commit is contained in:
phantinuss
2022-02-11 16:52:45 +01:00
parent 809f7abbb8
commit 646ce36809
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml
+1 -1
View File
@@ -26,7 +26,7 @@ detection:
filter:
- ParentImage:
- 'C:\ProgramData\chocolatey\choco.exe'
- ScriptBlockText|contains: '(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')'
- ScriptBlockText|contains: "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')"
condition: cmdlet and option and not filter
falsepositives:
- Administrator script
rules/windows/powershell/powershell_script/posh_ps_suspicious_invocation_specific.yml
+1 -1
View File
@@ -61,7 +61,7 @@ detection:
- 'Net.WebClient'
- '.Download'
filter_chocolatey:
ScriptBlockText|contains: '(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'
ScriptBlockText|contains: "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
condition: 1 of select* and not 1 of filter*
falsepositives:
- Penetration tests