security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3111 from redsand/fp_posh_ps_malicious_commandlets

Browse Source 
False positive - another amazon module filter
This commit is contained in:
frack113
2022-06-08 22:17:43 +02:00
committed by GitHub
parent 98e218722c d3ef79018c
commit 7fbfa45d74
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml
+2 -2
View File
@@ -7,7 +7,7 @@ references:
- https://adsecurity.org/?p=2921
- https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries
date: 2017/03/05
modified: 2022/05/26
modified: 2022/06/07
logsource:
product: windows
category: ps_script
@@ -187,7 +187,7 @@ detection:
false_positive1:
ScriptBlockText|contains:
- Get-SystemDriveInfo # http://bheltborg.dk/Windows/WinSxS/amd64_microsoft-windows-maintenancediagnostic_31bf3856ad364e35_10.0.10240.16384_none_91ef7543a4514b5e/CL_Utility.ps1
- C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Scripts\Set-Wallpaper.ps1 # false positive form Amazon EC2
- C:\ProgramData\Amazon\EC2-Windows\Launch\Module\ # false positive form Amazon EC2
false_positive2:
ScriptBlockText|startswith: '# Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved'
condition: select_Malicious and not 1 of false_positive*