Update selections and indentation

2022-07-07 20:13:45 +01:00
parent 49e389db5c
commit aec95b6d65
38 changed files with 368 additions and 366 deletions
@@ -4,20 +4,20 @@ status: test
 description: Detecting Code injection with PowerShell in another process
 author: Nikita Nazarov, oscd.community
 references:
-  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
+    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
 date: 2020/10/06
 modified: 2021/11/27
 logsource:
-  product: windows
-  category: create_remote_thread
-  definition: 'Note that you have to configure logging for CreateRemoteThread in Symson config'
+    product: windows
+    category: create_remote_thread
+    definition: 'Note that you have to configure logging for CreateRemoteThread in Symson config'
 detection:
-  selection:
-    SourceImage|endswith: '\powershell.exe'
-  condition: selection
+    selection:
+        SourceImage|endswith: '\powershell.exe'
+    condition: selection
 falsepositives:
-  - Unknown
+    - Unknown
 level: high
 tags:
-  - attack.execution
-  - attack.t1059.001
+    - attack.execution
+    - attack.t1059.001