security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FP: ignore calling function Convert-GuidToCompressedGuid, part of amazon ssm worker

Browse Source
This commit is contained in:
Tim Shelton
2022-11-18 16:35:48 +00:00
parent f0bac30cfb
commit e0c53c1948
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml
+3 -2
View File
@@ -4,7 +4,7 @@ status: test
description: Detects suspicious powershell process which includes bxor command, alternative obfuscation method to b64 encoded commands.
author: Sami Ruohonen, Harish Segar (improvement), Tim Shelton
date: 2018/09/05
modified: 2022/01/10
modified: 2022/11/18
tags:
- attack.defense_evasion
- attack.t1059.001
@@ -26,7 +26,8 @@ detection:
- '-join`'
- 'char'
false_positives:
ParentImage: C:\Program Files\Amazon\SSM\ssm-document-worker.exe
ParentImage: 'C:\Program Files\Amazon\SSM\ssm-document-worker.exe'
CommandLine|contains: 'function Convert-GuidToCompressedGuid'
condition: selection and filter and not false_positives
falsepositives:
- Unknown