Update PS rules
This commit is contained in:
@@ -14,7 +14,7 @@ tags:
|
||||
logsource:
|
||||
product: windows
|
||||
service: powershell
|
||||
definition: 'Script block logging must be enabled'
|
||||
definition: Script block logging must be enabled
|
||||
detection:
|
||||
selection:
|
||||
EventID: 4104
|
||||
|
||||
Reference in New Issue
Block a user