security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #751 from zaphodef/fix/powershell_ntfs_ads_access

Browse Source 
Add 'Add-Content' to powershell_ntfs_ads_access
This commit is contained in:
Florian Roth
2020-05-26 13:20:40 +02:00
committed by GitHub
parent e131f3476e 1a598282f4
commit ce1f46346f
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_ntfs_ads_access.yml
+1
View File
@@ -16,6 +16,7 @@ logsource:
detection:
keyword1:
- "set-content"
- "add-content"
keyword2:
- "-stream"
condition: keyword1 and keyword2