refactor: remove unnesessary escape.

This commit is contained in:
fukusuket
2022-12-03 21:56:00 +09:00
parent 76a624e4a9
commit 9c76aac1fc
2 changed files with 4 additions and 4 deletions
@@ -6,7 +6,7 @@ references:
- https://github.com/Neo23x0/sigma/issues/1009 #(Task 25)
author: Jonathan Cheong, oscd.community
date: 2020/10/15
modified: 2022/11/29
modified: 2022/12/03
tags:
- attack.defense_evasion
- attack.t1027
@@ -18,7 +18,7 @@ logsource:
definition: Script block logging must be enabled
detection:
selection_4104:
ScriptBlockText|re: '.*cmd.{0,5}(?:\/c|\/r).+powershell.+(?:\$?\{?input\}?|noexit).+\"'
ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+"'
condition: selection_4104
falsepositives:
- Unknown