Update win_powershell_downgrade_attack.yml

2020-03-28 13:17:58 +01:00
parent 0e94eb9e86
commit bbb10a51f4
1 changed files with 7 additions and 1 deletions
@@ -23,6 +23,12 @@ logsource:
    product: windows
 detection:
    selection:
-        CommandLine|contains: ' -version 2 '
+        CommandLine|contains: 
+            - ' -version 2 '
+            - ' -versio 2 '
+            - ' -versi 2 '
+            - ' -vers 2 '
+            - ' -ver 2 '
+            - ' -ve 2 '        
        Image|endswith: '\powershell.exe'
    condition: selection