security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update file_event_win_susp_vscode_powershell_profile.yml

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2022-08-24 12:29:54 +01:00
parent 918cf94c1b
commit be2ec96dc2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/file_event/file_event_win_susp_vscode_powershell_profile.yml
+1 -1
View File
@@ -3,7 +3,7 @@ id: 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502
related:
- id: b5b78988-486d-4a80-b991-930eff3ff8bf
type: similar
status: test
status: experimental
description: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
author: Nasreddine Bencherchali
references: