diff --git a/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml b/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml index bfff23265..434e2386f 100644 --- a/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml +++ b/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml @@ -25,6 +25,7 @@ references: - https://github.com/besimorhino/powercat author: Nasreddine Bencherchali date: 2023/01/20 +modified: 2023/01/21 tags: - attack.execution - attack.discovery @@ -193,7 +194,7 @@ detection: - 'Out-Minidump' - 'Port-Scan' - 'PowerBreach' - - 'powercat' + - 'powercat ' - 'PowerUp' - 'PowerView' - 'Remove-Update' diff --git a/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml b/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml index e81d3072e..9ec4b9318 100644 --- a/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml +++ b/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml @@ -29,7 +29,7 @@ references: - https://github.com/besimorhino/powercat author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer date: 2017/03/05 -modified: 2023/01/20 +modified: 2023/01/21 tags: - attack.execution - attack.discovery @@ -198,7 +198,7 @@ detection: - 'Out-Minidump' - 'Port-Scan' - 'PowerBreach' - - 'powercat' + - 'powercat ' - 'PowerUp' - 'PowerView' - 'Remove-Update' diff --git a/rules/windows/process_creation/proc_creation_win_malicious_cmdlets.yml b/rules/windows/process_creation/proc_creation_win_malicious_cmdlets.yml index 70e991f2b..305091d08 100644 --- a/rules/windows/process_creation/proc_creation_win_malicious_cmdlets.yml +++ b/rules/windows/process_creation/proc_creation_win_malicious_cmdlets.yml @@ -25,7 +25,7 @@ references: - https://github.com/besimorhino/powercat author: Nasreddine Bencherchali date: 2023/01/02 -modified: 2023/01/20 +modified: 2023/01/21 tags: - attack.execution - attack.discovery @@ -193,7 +193,7 @@ detection: - 'Out-Minidump' - 'Port-Scan' - 'PowerBreach' - - 'powercat' + - 'powercat ' - 'PowerUp' - 'PowerView' - 'Remove-Update'