Update powershell_shellcode_b64.yml

2020-12-01 02:24:35 +01:00
parent 7309fb7d0e
commit a028cdf1ee
1 changed files with 7 additions and 7 deletions
@@ -13,7 +13,7 @@ tags:
    - attack.t1086  #an old one
 author: David Ledbetter (shellcode), Florian Roth (rule)
 date: 2018/11/17
-modified: 2020/08/24
+modified: 2020/12/01
 logsource:
    product: windows
    service: powershell
@@ -21,12 +21,12 @@ logsource:
 detection:
    selection:
        EventID: 4104
-    keyword1|contains:
-        - 'AAAAYInlM'
-    keyword2|contains:
-        - 'OiCAAAAYInlM'
-        - 'OiJAAAAYInlM'
-    condition: selection and keyword1 and keyword2
+        ScriptBlockText|contains: 'AAAAYInlM'
+    selection2:
+        ScriptBlockText|contains:
+            - 'OiCAAAAYInlM'
+            - 'OiJAAAAYInlM'
+    condition: selection and selection2
 falsepositives:
    - Unknown
 level: critical