Merge pull request #1263 from Neo23x0/rule-devel

feat: cover newest emotet campaigns
2020-10-24 00:02:39 +02:00
parent 16d63cc5d2 75637324e0
commit 6f9aeb5ea9
1 changed files with 1 additions and 0 deletions
@@ -40,6 +40,7 @@ detection:
            - '* -e* IAB*'
            - '* -e* UwB*'
            - '* -e* cwB*'
+            - '*.exe -ENCOD *'
    falsepositive1:
        CommandLine: '* -ExecutionPolicy remotesigned *'
    condition: selection and not falsepositive1