Big Update

2022-09-09 15:02:31 +02:00
parent fbc7733078
commit 70f9ff61ca
33 changed files with 492 additions and 127 deletions
@@ -17,12 +17,12 @@ logsource:
 detection:
    selection1:
        ScriptBlockText|contains|all:
-          - 'Move-Item'
-          - 'Cert:\LocalMachine\Root'
+            - 'Move-Item'
+            - 'Cert:\LocalMachine\Root'
    selection2:
        ScriptBlockText|contains|all:
-          - 'Import-Certificate'
-          - 'Cert:\LocalMachine\Root'
+            - 'Import-Certificate'
+            - 'Cert:\LocalMachine\Root'
    condition: 1 of selection*
 falsepositives:
    - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP