Update proc_creation_win_persistence_userinitmprlogonscript.yml

When logging into Windows Core, userinit.exe normalls calls PowerShell.exe without parameters to bring up a PowerShell window.
2023-06-05 12:57:52 -04:00
parent 715cc0589c
commit b478f24985
1 changed files with 2 additions and 0 deletions
@@ -23,6 +23,8 @@ detection:
            - 'netlogon*.bat'
            - 'UsrLogon.cmd'
            - 'C:\WINDOWS\Explorer.EXE'
+        - CommandLine:
+            - 'PowerShell.exe'
        - Image|endswith:
            - '\explorer.exe'
            - '\proquota.exe'