Update powershell_cmdline_specific_comb_methods.yml

2020-10-13 10:59:20 +03:00
parent 95cd271686
commit dff2e16ad2
1 changed files with 10 additions and 9 deletions
@@ -17,15 +17,16 @@ logsource:
 detection:
    selection1:
        Image|endswith: '\powershell.exe'
-        CommandLine|all:
-            - '*char*'
-            - '*join*'
+        CommandLine|contains|all:
+            - 'char'
+            - 'join'
    selection2:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'ToInt'
            - 'ToDecimal'
            - 'ToByte'
+            - 'ToUint'
            - 'ToSingle'
            - 'ToSByte'
    selection3:
@@ -36,14 +37,14 @@ detection:
            - 'String'
    selection4:
        Image|endswith: '\powershell.exe'
-        CommandLine|all:
-            - '*split*'
-            - '*join*'
+        CommandLine|contains|all:
+            - 'split'
+            - 'join'
    selection5:
        Image|endswith: '\powershell.exe'
-        CommandLine|all:
-            - '*ForEach*'
-            - '*Xor*'
+        CommandLine|contains|all:
+            - 'ForEach'
+            - 'Xor'
    selection6:
        Image|endswith: '\powershell.exe'
        CommandLine|contains: