refactor: remove unnesessary escape.
This commit is contained in:
@@ -6,7 +6,7 @@ references:
|
||||
- https://github.com/Neo23x0/sigma/issues/1009 #(Task 25)
|
||||
author: Jonathan Cheong, oscd.community
|
||||
date: 2020/10/15
|
||||
modified: 2022/11/29
|
||||
modified: 2022/12/03
|
||||
tags:
|
||||
- attack.defense_evasion
|
||||
- attack.t1027
|
||||
@@ -18,7 +18,7 @@ logsource:
|
||||
definition: Script block logging must be enabled
|
||||
detection:
|
||||
selection_4104:
|
||||
ScriptBlockText|re: '.*cmd.{0,5}(?:\/c|\/r).+powershell.+(?:\$?\{?input\}?|noexit).+\"'
|
||||
ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+"'
|
||||
condition: selection_4104
|
||||
falsepositives:
|
||||
- Unknown
|
||||
|
||||
Reference in New Issue
Block a user