security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: optimize "Invoke-Sharp" coverage

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2023-01-21 12:28:08 +01:00
parent 928e77881f
commit dfdc232f55
5 changed files with 235 additions and 416 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml
+1 -37
View File
@@ -166,43 +166,7 @@ detection:
- 'Invoke-Seatbelt'
- 'Invoke-ServiceAbuse'
- 'Invoke-ShadowSpray'
- 'Invoke-SharpAllowedToAct'
- 'Invoke-SharpBlock'
- 'Invoke-SharpBypassUAC'
- 'Invoke-SharpChromium'
- 'Invoke-SharpClipboard'
- 'Invoke-SharpCloud'
- 'Invoke-SharpDPAPI'
- 'Invoke-SharpDump'
- 'Invoke-SharPersist'
- 'Invoke-SharpGPOAbuse'
- 'Invoke-SharpGPO-RemoteAccessPolicies'
- 'Invoke-SharpHandler'
- 'Invoke-SharpHide'
- 'Invoke-Sharphound' # Also Covers "Invoke-SharpHound2", "Invoke-SharpHound3"...etc.
- 'Invoke-SharpImpersonation'
- 'Invoke-SharpImpersonationNoSpace'
- 'Invoke-SharpKatz'
- 'Invoke-SharpLdapRelayScan'
- 'Invoke-Sharplocker'
- 'Invoke-SharpLoginPrompt'
- 'Invoke-SharpMove'
- 'Invoke-SharpPrinter'
- 'Invoke-SharpPrintNightmare'
- 'Invoke-SharpRDP'
- 'Invoke-SharpSCCM'
- 'Invoke-SharpSecDump'
- 'Invoke-Sharpshares'
- 'Invoke-SharpSniper'
- 'Invoke-SharpSploit'
- 'Invoke-SharpSpray'
- 'Invoke-SharpSSDP'
- 'Invoke-SharpStay'
- 'Invoke-SharpUp'
- 'Invoke-Sharpview'
- 'Invoke-SharpWatson'
- 'Invoke-Sharpweb'
- 'Invoke-SharpWSUS'
- 'Invoke-Sharp' # Covers all "Invoke-Sharp" variants
- 'Invoke-Shellcode'
- 'Invoke-SMBScanner'
- 'Invoke-Snaffler'