Update powershell_CL_Invocation_LOLScript.yml

2020-10-18 02:48:21 +03:00
parent e8f21bc094
commit a6f00d6acc
1 changed files with 3 additions and 3 deletions
@@ -26,10 +26,10 @@ detection:
          - 'SyncInvoke'
    timeframe: 1m
    condition: 
-        - selection
+        - selection or (selection2 | count(ScriptBlockText) by Computer > 2)
      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; SyncInvoke c:\Evil.exe
-        - selection2 | count(ScriptBlockText) by Computer > 2
+      # or
      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
      # PS > SyncInvoke c:\Evil.exe
 falsepositives: Unknown
-level: high
+level: high