Merge branch 'SigmaHQ:master' into master

2022-10-04 09:33:51 +02:00
parent 119c9f5275 029900c284
commit f692271c0a
55 changed files with 540 additions and 81 deletions
@@ -4,7 +4,7 @@ status: experimental
 description: Detecting use WinAPI Functions in PowerShell
 author: Nikita Nazarov, oscd.community, Tim Shelton
 date: 2020/10/06
-modified: 2022/05/23
+modified: 2022/09/29
 references:
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
 tags:
@@ -41,8 +41,8 @@ detection:
            # - 'WriteByte'  # FP with .NET System.IO.FileStream
            - 'WriteInt32'
            - 'OpenThreadToken'
-            - 'PtrToString'
-            - 'FreeHGlobal'
+            # - 'PtrToString'
+            # - 'FreeHGlobal'
            - 'ZeroFreeGlobalAllocUnicode'
            - 'OpenProcessToken'
            - 'GetTokenInformation'