From dae7fff20905d2a0bfd4eaf4e40c23d0327a12be Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com> Date: Mon, 31 Jul 2023 12:29:16 +0200 Subject: [PATCH] Update rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com> --- .../powershell_script/posh_ps_win_api_library_access.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml b/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml index 5bdacc631..ad78be048 100644 --- a/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml +++ b/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml @@ -8,7 +8,7 @@ related: - id: 19d65a1c-8540-4140-8062-8eb00db0bba5 type: similar status: experimental -description: Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these API to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts. +description: Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts. references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)