diff --git a/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml b/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml index 3a97e90fb..c7e482c88 100644 --- a/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml +++ b/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml @@ -26,10 +26,10 @@ detection: - 'SyncInvoke' timeframe: 1m condition: - - selection + - selection or (selection2 | count(ScriptBlockText) by Computer > 2) # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; SyncInvoke c:\Evil.exe - - selection2 | count(ScriptBlockText) by Computer > 2 + # or # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1 # PS > SyncInvoke c:\Evil.exe falsepositives: Unknown -level: high \ No newline at end of file +level: high