security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Update powershell_CL_Invocation_LOLScript_v2.yml

Browse Source
This commit is contained in:
nsaddler
2020-10-28 19:30:21 +03:00
committed by GitHub
parent d0a796439b
commit 7ee644eac0
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_CL_Invocation_LOLScript_v2.yml
+3 -3
View File
@@ -1,5 +1,5 @@
title: Execution via CL_Invocation.ps1
id: 4cd29327-685a-460e-9dac-c3ab96e549dc
title: Execution via CL_Invocation.ps1 (2 Lines)
id: f588e69b-0750-46bb-8f87-0e9320d57536
description: Detects Execution via SyncInvoke in CL_Invocation.ps1 module
status: experimental
author: oscd.community, Natalia Shornikova
@@ -23,4 +23,4 @@ detection:
# PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
# PS > SyncInvoke c:\Evil.exe
falsepositives: Unknown
level: high
level: high