fix: change keyword and bound it to a field

2019-10-29 19:59:43 +01:00
parent 632c45843b
commit ab5556ae8c
1 changed files with 2 additions and 1 deletions
@@ -14,7 +14,8 @@ logsource:
    definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 https://adsecurity.org/?p=2277'
 detection:
    keywords:
-        - System.Reflection.Assembly.Load
+        Message:
+            - "*[System.Reflection.Assembly]::Load*"
    condition: keywords
 falsepositives:
    - Penetration tests