Merge PR #4693 from @qasimqlf - Update selection to remove overlap
chore: PowerShell ShellCode - Remove "selection" as it was overlapping with "selection2"
This commit is contained in:
@@ -6,7 +6,7 @@ references:
|
||||
- https://twitter.com/cyb3rops/status/1063072865992523776
|
||||
author: David Ledbetter (shellcode), Florian Roth (Nextron Systems)
|
||||
date: 2018/11/17
|
||||
modified: 2022/12/25
|
||||
modified: 2024/01/25
|
||||
tags:
|
||||
- attack.defense_evasion
|
||||
- attack.privilege_escalation
|
||||
@@ -19,12 +19,10 @@ logsource:
|
||||
definition: 'Requirements: Script Block Logging must be enabled'
|
||||
detection:
|
||||
selection:
|
||||
ScriptBlockText|contains: 'AAAAYInlM'
|
||||
selection2:
|
||||
ScriptBlockText|contains:
|
||||
- 'OiCAAAAYInlM'
|
||||
- 'OiJAAAAYInlM'
|
||||
condition: selection and selection2
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- Unknown
|
||||
level: high
|
||||
|
||||
Reference in New Issue
Block a user