Splitting into two rules

2020-10-28 19:13:29 +03:00
parent ef8f5e626f
commit a4a3e01f25
2 changed files with 28 additions and 12 deletions
@@ -19,17 +19,6 @@ detection:
        ScriptBlockText|contains|all:
          - 'CL_Mutexverifiers.ps1'
          - 'runAfterCancelProcess'
-    selection2:
-        EventID: 4104
-        ScriptBlockText|contains:
-          - 'CL_Mutexverifiers.ps1'
-          - 'runAfterCancelProcess'
-    timeframe: 1m
-    condition: 
-        - selection
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1; runAfterCancelProcess c:\Evil.exe
-        - selection2 | count(ScriptBlockText) by Computer > 2
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1
-      # PS > runAfterCancelProcess c:\Evil.exe
+    condition: selection
 falsepositives: Unknown
 level: high