security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: apply suggestions from code review

Browse Source 
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
This commit is contained in:
Nasreddine Bencherchali
2023-07-24 12:35:11 +02:00
committed by GitHub
parent 72b658b4c2
commit ad0d3f58ac
9 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml
+1 -1
View File
@@ -1,4 +1,4 @@
title: Potential Suspicious Call To Win32_NTEventlogFile Class - PSScript
title: Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript
id: e2812b49-bae0-4b21-b366-7c142eafcde2
status: experimental
description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script