refactor: PowerShell Defender modifications

2022-03-03 13:53:06 +01:00
parent 5e76089044
commit b3b5b2cbdd
3 changed files with 54 additions and 6 deletions
@@ -24,10 +24,11 @@ detection:
            - DisableBehaviorMonitoring
            - DisableScriptScanning
            - DisableBlockAtFirstSeen
+            - DisableIOAVProtection
    condition: selection
 falsepositives:
    - Legitimate PowerShell scripts
-level: medium
+level: high
 tags:
    - attack.defense_evasion
    - attack.t1562.001