security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2764 from SigmaHQ/rule-devel

Browse Source 
refactor: PowerShell Defender modifications
This commit is contained in:
Florian Roth
2022-03-03 23:29:08 +01:00
committed by GitHub
parent ea2b6d8a08 b3b5b2cbdd
commit eb06a6fdd1
3 changed files with 54 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_tamper_defender.yml
+2 -1
View File
@@ -24,10 +24,11 @@ detection:
- DisableBehaviorMonitoring
- DisableScriptScanning
- DisableBlockAtFirstSeen
- DisableIOAVProtection
condition: selection
falsepositives:
- Legitimate PowerShell scripts
level: medium
level: high
tags:
- attack.defense_evasion
- attack.t1562.001